NeccoSpeak – AI Chatbot & Voice Chat

No. NeccoSpeak is self-contained: it needs only WordPress and your own OpenAI API key.

The plugin: yes — free and open source (GPL). The AI usage: billed by OpenAI to your own account (your own key), at OpenAI's rates. Check OpenAI's official pricing for details.

By default it answers from the AI model plus what you enter on the AI settings tab — put your key business facts (hours, prices, policies) in the company information or FAQ settings and it will use them. If you turn on the optional site content search (on the AI settings tab's Content sync card) and page directory (the URL map in the Conversation flow tab's Navigation settings), both off by default, it can also quote excerpts from your own published posts and pages and point visitors to the right one.

The key is stored encrypted in the database with AES-256-CBC. It is never output to the front end (browser) and is masked in the admin screen.

The chat endpoint has per-IP, per-minute rate limiting plus site-wide hourly and daily caps; voice token issuance has a per-IP, per-minute limit plus a site-wide daily cap. When a cap is exceeded, responses are temporarily limited (503). Beyond that, display rules let you reduce exposure to abuse by limiting which pages show the widget. The chat API also refuses requests that do not come from a page on your own site (a same-origin check), but since origins can be forged, the rate limits remain the real line of defense.

Voice chat is on by default (the "Voice feature" setting on the Voice settings tab) — just serve your site over HTTPS (SSL). Browser microphone permission is requested when it is used. Audio goes from the browser directly to OpenAI over WebRTC using a short-lived token — your API key is never handed to the browser.

While the plugin is unconfigured (disabled or no key), nothing is loaded on the front end at all. Once active, it loads a small widget only on the pages your display rules match.

No. The model is chosen from the list of models currently available to your API key, which the settings screen fetches from OpenAI automatically (metadata only — no token billing).

Yes. Replies appear progressively, typewriter-style, instead of all at once. The reply your browser has already received is revealed a bit at a time, so nothing extra is needed from your server. The effect also respects the operating system's "reduce motion" setting.

No — the search itself runs entirely on your own server, against your own database. Only the excerpts actually selected as relevant to a visitor's question are sent to OpenAI, the same way any other part of the prompt is (in voice conversation, they are passed to OpenAI from the visitor's browser as the search result).

No. Both tools (site search, page lookup) are read-only — the assistant can look things up but can never create, edit, or delete anything. Opening a page for the visitor and filling in a Contact Form 7 form happen only inside the visitor's own browser, and the form is never submitted for them. The current date and time is supplied automatically and is not a tool at all, so it cannot change anything either.

Voice connects the browser directly to OpenAI (WebRTC). Because OpenAI's Realtime API does not require STUN/TURN, this plugin does not use a STUN/TURN server by default. On a few highly restrictive networks (UDP blocked, symmetric NAT, etc.), voice may fail to connect; please use text chat there. Advanced users can set their own STUN/TURN servers via window.NECCOSPEAK_RTC_ICE_SERVERS (in that case, that destination becomes something you must disclose).

This is a Chrome-for-Android behavior, not something this plugin controls: while a voice call is active, the call's audio is tied to the device's in-call volume control, and Android will not let that be lowered all the way to silent. To fully silence the assistant's voice during a call, use the widget's own speaker-mute button in the voice control bar instead of the device volume buttons — that mutes the assistant completely, on any device.

After updating, purge any caching plugin (page cache and, if it has one, a separate "minify/combine JS" cache) and any CDN sitting in front of your site, then hard-reload the page. The widget's front-end JavaScript is loaded from several nested files that browsers and CDNs are free to cache independently of the main plugin file's version number, so a stale copy of just one of those files can outlive the update. If the browser's developer console shows a "Version mismatch" warning, that confirms this is exactly what happened.