Command Modular AI Website Attendant

Command Modular AI Website Attendant connects your WordPress site to the AI Website Attendant™ service and loads the chat widget without pasting third-party scripts that Wordfence, CSP, and ad blockers often block.

Important: This plugin requires an active AI Website Attendant account and connected website. The free plugin alone cannot answer visitor chats without that service.

Connect methods

• Connect Account (recommended) — one-click OAuth to your AI Website Attendant™ portal.

• API Key — master or personal token from Settings → Integrations.

• Site Key — widget-only mode using the public embed site key.

First-party architecture

js and /wp-json/cmaiwa/v1/... ). WordPress uses wp_remote_* to reach the AI Website Attendant™ API server-to-server.

REST routes require a matching connected site key in permission_callback (constant-time compare) before any upstream proxy request is made.

External services

This plugin requires the AI Website Attendant hosted service. It does not work as a standalone chatbot. From your WordPress server it contacts the following first-party endpoints operated by AI Website Attendant (Command Modular).

No visitor browser calls are made directly to third-party domains when the plugin is used as intended.

If you use Wordfence or similar, allow the REST namespace cmaiwa/v1 if requested.

AI Website Attendant API

This service is used to connect your WordPress site to your AI Website Attendant account and to generate chat answers from your site’s knowledge base.

com/api/v1 (or a custom Upstream API URL you configure) in these cases:

• When an administrator uses Connect Account: the one-time pairing code, CSRF state, and the WordPress site hostname are posted to /integrations/wordpress/exchange.

• When an administrator uses API Key connect: the API token (Authorization header), platform identifier ( wordpress ), WordPress hostname, and optional site ID are posted to /integrations/connect-with-key.

• When a visitor uses the chat widget: WordPress reverse-proxies the request to the embed API. That can include chat message text, session identifiers, widget config requests, feedback, optional voice audio (transcribe), link-preview URLs, and the site Origin/Referer.

This service is provided by AI Website Attendant: Terms of Service, Privacy Policy.

AI Website Attendant portal and script CDN

This service is used for account connection in wp-admin and to fetch the official chat widget scripts so WordPress can serve them first-party.

com in these cases:

• When an administrator starts Connect Account: the browser is redirected to the portal with the WordPress callback URL, a CSRF state value, and the site hostname.

• When the storefront loads the widget: WordPress requests embed.js, embed.widget.js, and brand logo image assets under /embed/... from the CDN so they can be served from the WordPress origin.

• When an administrator opens Dashboard or Support from the plugin settings screen.

This service is provided by AI Website Attendant: Terms of Service, Privacy Policy.