Assistant exposes customer-facing chat and WooCommerce actions, so production setup must cover licence gating, request limits, secrets, logs, external providers and deletion behaviour.

Runtime and request boundary

Every Assistant REST action requires an active or valid grace-state licence—even for an administrator preview. Public and embedded requests are rate-limited per actor. Logged-in requests use WordPress REST authentication; external embeds use an origin-scoped short-lived token.

External embeds cannot call sensitive cart, checkout, order-status or stock-notification routes. Keep that boundary intact.

Configure rate limits

Open Settings → Advanced → Security & request limits.

• Chat messages per minute has a default recommendation of 60.
• Other chat actions per minute has a default recommendation of 120 and covers product cards, cart, checkout and background actions.

The counters are separate so normal interface requests do not consume the entire chat budget. Start with defaults, observe real traffic and increase only when legitimate users are demonstrably blocked. Do not whitelist arbitrary forwarded IP headers; trusted-proxy handling must match the host/CDN configuration.

Test a normal browsing session, a short burst and a deliberately excessive burst. Protection should return a controlled error without taking down WordPress or exposing server detail.

Protect provider and licence keys

Provider keys are encrypted at rest with installation-specific WordPress salts and used only in server memory. The full value is never rendered to the browser; admin fields show a masked suffix. A blank saved-secret field preserves the current key.

Use provider-side key restrictions, budgets and alerts. Rotate a suspected key before sending logs to support. A NextlerAI licence request/check sends the licence key, installation domain, instance UUID, product identifier and environment to nextlerai.com; it does not send chat messages, orders or catalogue content to the licence server.

Understand provider data flow

Depending on enabled features, the selected AI providers receive:

• product text during catalogue embedding;
• selected page/Q&A content during Knowledge Base embedding;
• visitor message, short conversation history and retrieved context during chat;
• an uploaded image during visual search.

Review the provider account’s terms and data controls, especially for real customer data. Publish a privacy notice that describes the features actually enabled on the site.

Response caching

Under Logs / Analytics → Response caching, enable caching only for answers that remain safe to reuse. Set a deliberate lifetime; the default is 24 hours.

After price, policy, contact, source-scope or model changes, clear the Assistant cache and retest in a new conversation. Live product cards should still resolve current WooCommerce data, but a cached explanatory answer can be stale.

Logs and retention

Demand analytics defaults to 90 days; technical conversation logs default to a shorter 14-day retention and can be configured from 1 to 365 days. Keep email/phone redaction enabled and store page URLs only when needed.

Treat diagnostic exports as personal or operational data. Restrict access, minimise the export and delete the local copy when the case is resolved.

Deactivation versus deletion

Deactivating Assistant does not remove settings or tables. By default, deleting the plugin removes settings, product embeddings, Knowledge Base data, analytics, usage counters, back-in-stock subscribers and cached data.

To keep everything for a later reinstall, enable Settings → Advanced → Keep NextlerAI Assistant’s data when the plugin is deleted before deletion. Test this policy on staging and back up first; do not assume a host restores a deleted custom table automatically.

Security review checklist

• WordPress, PHP, WooCommerce and Assistant are supported/current.
• Licence is bound to the correct environment and domain.
• Provider keys are server-side, restricted and budgeted.
• Only required Knowledge Base sources and custom fields are indexed.
• External origins use exact HTTPS allowlist entries.
• Rate limits are enabled and tested.
• Contact/order actions verify the required identity or nonce.
• Logs are redacted, access-controlled and time-limited.
• Uninstall retention is a documented choice.

Troubleshooting

• Normal users see 429/rate limit: identify whether chat or background actions are hitting the limit; inspect CDN/proxy IP handling before raising it.
• External embed invalid/expired: verify exact origin and cached loader/token state.
• Assistant is read-only: inspect the licence status, domain and environment; an invalid-domain response is not eligible for grace.
• Old answer after source update: rebuild relevant knowledge and clear response caching.
• Key test works but front-end fails: check licence, selected model, rate limit, provider timeout and request logs.
• Deletion must retain data: enable preservation before deleting and verify a backup.