On this page
WordPress & WooCommerce Setup#
This guide connects a WooCommerce store so your chatbot can answer “where is my order?”. Signed-in shoppers see their own orders straight away; anyone who is not signed in is asked to sign in first. It takes about 15 minutes and needs no code — you install the Gydr WordPress plugin (version 1.5.0 or later) like any other.
Background: Signed-in visitors explains how Gydr recognises a signed-in visitor (on WordPress, the plugin signs the visitor token with your site’s own key), and Guests & data never to send lists what must stay out of a token.
1. Connect WooCommerce in Gydr#
In the Console, open Plugins → WooCommerce Storefront. A short setup walks you through it. Enter your store URL (for example https://shop.example.com) and press Test connection — Gydr checks your store answers before you continue. On the next step you can keep the recommended product-search settings. Then attach the plugin to your widget’s Skill; the chatbot can now search your products. The prerequisites are on the Plugins & MCP page.
2. Download and install the plugin#
In the Console, go to Settings → Visitor sign-in → Add sign-in source → WordPress or WooCommerce. Type your store’s address and download the plugin (a zip file).
- Press Open your WordPress upload page in the Console (or go to Plugins → Add New → Upload Plugin), choose the zip file, press Install Now, then Activate.
- It appears in your plugin list as Gydr Widget - AI Chat.
3. Connect WordPress#
- Back in the Console panel, press Connect WordPress. Your site’s plugin page opens and asks “Connect this site to …?” — press Connect.
- You are taken to your dashboard to approve it. Check the site address is yours, pick the widget to show, and press Approve.
- You land back in WordPress with “Connected”. The chat widget now appears on your store. Nothing secret was copied: your site and your dashboard exchanged the connection directly.
There is nothing more to set up for signed-in customers: your WordPress site signs a short-lived visitor token for each logged-in customer with its own key, Gydr checks it with the matching public key, and your store checks the same token itself when the assistant asks for their orders, so only that customer’s orders are returned. Gydr never calls back into your site to sign anyone in. This needs plugin version 1.5.0 or later — update it from Dashboard → Updates if it is older. With an older plugin the order lookup reports that the plugin needs updating, and shoppers are not shown an order. Order lookup uses the signed-in shopper only: there is no order-number form and no WooCommerce REST key to create.
The store must be connected at exactly your site’s address — the one in Settings → General → Site Address, www. included or not — because each customer’s token is only sent there. Keep /wp-json/gydr/ out of any page cache or CDN rule that ignores no-store: the plugin marks every order answer private, and an answer a cache replays for a different customer is refused, never shown.
4. Check it works#
- Sign in to your store as a customer who has an order, open the chat and ask “where is my order?”. It should list your recent orders without asking anything.
- The Console panel turns to “Recognised a visitor on” the date, and your site’s row in Settings → Visitor sign-in says the same. If it doesn’t, see the troubleshooting table.
- Sign out and ask again. The conversation starts fresh, and the chatbot asks you to sign in before it can look up an order.
Updating the plugin#
WordPress shows Gydr plugin updates like any other plugin, under Dashboard → Updates or Plugins. You can switch on auto-updates for it from the Plugins list.
If your site’s address changes#
Your site signs each customer’s token with the address it connected with, and Gydr accepts only that address. After a move to a new domain, adding or removing www., or a switch between http and https, every signed-in customer is treated as a guest until you reconnect. The plugin’s settings page (and the Plugins page) then says “This site’s address changed from … to …”, and your site’s row in Settings → Visitor sign-in says “Site address changed — reconnect from WordPress”. Press Reconnect on the plugin’s page and approve the new address in your dashboard. The approval page says it is the same site at a new address: your signed-in customers keep their conversations and what the assistant remembers about them, any widget that used the old address follows, and the old address’s entry is removed from Visitor sign-in. Approve only when you moved the site yourself — a staging copy of your site should not be approved this way.
Why it is set up this way#
- Choice
- The token is fetched separately, never printed into the page
- Reason
- Page caches such as LiteSpeed Cache, WP Rocket and Cloudflare APO store whole pages. A token printed into the HTML would be served to the next visitor — with the first customer's orders, so the plugin never does that.
- Choice
- Your site checks the customer, not Gydr
- Reason
- The token is signed with a key only your WordPress site holds, and your site's own order route returns only the signed-in customer's orders. Gydr passes the token along and can never make one, so a mistake on Gydr's side cannot show someone else's orders.
- Choice
- The token expires within an hour
- Reason
- It cannot be withdrawn earlier. Deleting a user or changing your site's security keys stops it working once it expires.
- Choice
- No order-number form
- Reason
- An order number and billing email prove very little to a chatbot, so Gydr does not ask for them. Only a shopper your own site has signed in is shown an order; everyone else is asked to sign in first.
| Choice | Reason |
|---|---|
| The token is fetched separately, never printed into the page | Page caches such as LiteSpeed Cache, WP Rocket and Cloudflare APO store whole pages. A token printed into the HTML would be served to the next visitor — with the first customer's orders, so the plugin never does that. |
| Your site checks the customer, not Gydr | The token is signed with a key only your WordPress site holds, and your site's own order route returns only the signed-in customer's orders. Gydr passes the token along and can never make one, so a mistake on Gydr's side cannot show someone else's orders. |
| The token expires within an hour | It cannot be withdrawn earlier. Deleting a user or changing your site's security keys stops it working once it expires. |
| No order-number form | An order number and billing email prove very little to a chatbot, so Gydr does not ask for them. Only a shopper your own site has signed in is shown an order; everyone else is asked to sign in first. |
What shoppers see#
- Signed in (plugin 1.5.0 or later): their 5 most recent orders, with tracking for the newest, without being asked anything. Asking about a specific order they own shows it. Another customer’s order number gets “no order with that number” — it never reveals that the order exists.
- Not signed in: the chatbot asks the shopper to sign in first. It does not ask for an order number or email, and orders placed as a guest checkout (customer id 0) are not available through the chat.
- Tracking comes from WooCommerce Shipment Tracking, Advanced Shipment Tracking (AST), or WooCommerce order fulfilments.
On WhatsApp, Messenger, Instagram and Telegram
The full plugin reference is in WooCommerce Storefront → Order Status & Delivery Tracking.