Platforms
WordPress
Plugin settings, shortcodes, and a local REST proxy that keeps the key server-side.
About 7 minutes hands-on
What this guide does not cover
- The API key must stay in PHP or a server-side proxy. A key placed in theme JavaScript is publicly readable.
- Does not cover multisite networks, page caching interactions, or plugin conflict resolution.
Step 1: Install the plugin
- Copy the plugin folder into
wp-content/plugins/, or upload via Plugins → Add New → Upload Plugin. - Activate SoterAI Guard from the Plugins page.
Package a zip from the repo root:
Terminal
npm run package:wordpress # produces dist/soter-guard.zipStep 2: Configure settings
Navigate to Settings → SoterAI Guard to configure:
| Setting | Notes |
|---|---|
| API Base URL | Your SoterAI host URL or self-hosted URL |
| API Key | ck_live_… Stored server-side, shown only masked |
| Project ID | Optional; forwarded as metadata |
| Enable Input Guard | Guard incoming visitor messages |
| Enable Output Guard | Guard chatbot responses |
| Enable Security Badge | Show "Protected by SoterAI" badge |
| Block message | Shown when a request is blocked |
| Public rate limit | Per-IP per-minute cap on REST proxy routes |
Step 3: Use shortcodes
HTML
[soter_chatbot_guard] // local proxy + optional badge
[soter_security_badge] // badge onlyStep 4: PHP integration (server-side)
PHP
1$in = soter_guard_input( $user_message );
2if ( $in['blocked'] ) {
3 $reply = $in['safe_text'];
4} else {
5 $ai = my_chatbot_generate( $in['safe_text'] );
6 $out = soter_guard_output( $ai );
7 $reply = $out['safe_text'] ?? $ai;
8}Step 5: Frontend via local proxy
The frontend JavaScript calls the local WordPress REST route, never the SoterAI API directly:
javascript
1const res = await fetch("/wp-json/soter/v1/guard-input", {
2 method: "POST",
3 headers: {
4 "Content-Type": "application/json",
5 "X-WP-Nonce": soterNonce,
6 },
7 body: JSON.stringify({ text: userMessage }),
8});
9const { blocked, safe_text, decision } = await res.json();Troubleshooting
Auth error on test
Re-enter the API key (the masked value is a placeholder)
Base URL rejected
Must start with https://
429 from proxy
Lower traffic or raise the per-IP rate limit
Guard unreachable
Input guarding fails open (passes through) so the site keeps working