Skip to content
Vroxy docs

The WordPress plugin

Install the WordPress plugin to run the widget on a WordPress site.

WordPress

Section titled “WordPress”

The plugin injects the standard snippet in wp_footer and identifies logged-in WordPress users. Install it, then go to Settings → Vroxy and paste your workspace public key. Optionally paste the identity secret from the same Embed page to unlock access-gated bot tools.

The identify payload carries the WP user id as external_id, the user’s email, their display name, their WordPress role under meta.role, and — with the secret set — a signed access level of admin for users with the manage_options capability and user for everyone else who is logged in.

Cache safety is the plugin’s central design constraint, and it works differently from the other SDKs for that reason. A signed identify payload is per-user; a full-page cache serving one into another visitor’s page would leak identity. So the plugin never renders identity into page HTML:

  1. wp_footer emits only bytes that are identical for every visitor — the loader tag and a static bootstrap that installs the window.vroxy command queue.
  2. Only if the browser holds a WordPress login cookie does the bootstrap fetch admin-ajax.php?action=vroxy_identify with same-origin credentials.
  3. That endpoint returns the current user’s signed payload with Cache-Control: no-store, private and Vary: Cookie (and {} for anonymous callers), and the bootstrap forwards it through the queue.

One requirement: your cache must not cache admin-ajax.php. No mainstream WordPress cache plugin does by default, but if you run a custom Varnish, nginx or CDN page cache, exclude /wp-admin/admin-ajax.php explicitly and make sure the CDN honors Cache-Control: no-store on it. The settings page detects common cache plugins and reminds you.

Excluded paths: one per line, exact match, or end a line with * for a prefix match.