Security

• Prevented CSV formula injection in the system logs export by sanitizing cells that start with =, +, -, @, a tab, or a carriage return
• Fixed the conversation log delete action using the wrong nonce, and switched the DeepSeek / OpenAI-compatible endpoint tests to wp_safe_remote_get(); endpoint error messages no longer include response bodies

Product Information: AI Search, Advanced RAG Chatbot Plugin for WordPress – FE Search AI

Security

• Bounded chat request input sizes to prevent cost amplification (denial of wallet): questions are capped at 1000 characters, conversation history is limited to the most recent 10 messages with per-message (2000 characters) and combined (16000 characters) budgets, and the raw history payload is byte-capped before decoding. All limits are adjustable via the new fe_search_ai_chat_input_limits filter
• Fixed an admin-side XSS vector in the API key connection test: the AJAX endpoint now returns structured status data and the admin script renders it via textContent with is-success / is-error CSS classes instead of inserting remote endpoint output as HTML
• Split admin and public AJAX nonces: fe_search_ai_admin_nonce now guards admin-only endpoints together with current_user_can( 'manage_options' ) checks, while the public nonce remains only for visitor-facing chat endpoints

Search and Sync

• Password-protected posts are no longer indexed or returned as chat context, and their index rows and Qdrant points are deleted when a post becomes protected or unpublished
• Realtime post indexing now mirrors vectors to Qdrant (delete-then-upsert), so the external vector store no longer retains stale chunks

Download: GitHub Releases

Chat UI

• Added a stop button that aborts streaming responses mid-generation; pressing it also cancels the upstream AI provider request, so no further tokens are generated
• Aborted responses render any partially received text with a “Response stopped.” note, and the unanswered exchange is removed from session history and excluded from logging and feedback

Multilingual

• Fixed the answer language not being detected on multilingual sites: chat REST requests now carry the rendered page’s language slug via a lang parameter, which Polylang, WPML, and Bogo all understand
• Answer language resolution order is now: script detected from the question text (Japanese, Korean, Russian, Arabic), then the multilingual plugin language (lang parameter, context post language, runtime API), then the WordPress locale, with Japanese as the final fallback
• Moved the forced language rule into the default system prompt as a “Language Rule” section containing the {answer_language} placeholder; sites with custom prompts can keep, move, rewrite, or remove the section, and no language rule is injected when the placeholder is absent

Download: GitHub Releases

What’s new in version 1.2.0

Improvements

• Security hardening
  • All Pro secrets — the forbidden words list, DeepSeek API key, custom endpoint key, and custom embedding endpoint key — are migrated to a new format using libsodium authenticated encryption (XSalsa20-Poly1305)
  • Existing values are re-encrypted automatically on upgrade or the next settings save, so no re-entry is required
  • Tightened output escaping, input sanitization, nonce verification, and prepared-statement handling across the admin screens

Notes

• Migration to the new encryption format requires the free FE Search AI plugin version 1.3.0 or later. Please update the free plugin before updating Pro
• Free version 1.3.0 also ships new features — including the “page context” chip that lets visitors ask questions about the post or page they are viewing, and background sync that no longer blocks publishing. We recommend using them together

What’s new in version 1.3.0

Improvements

• Page context support
  • The chat window now displays the current post or page as a context chip, letting visitors ask questions about “this page” right away
    
  • The chip can be removed with a single click, giving visitors explicit control over what the conversation covers
  • Fine-tuned chip rendering, including label wrapping and remove-button coloring
• Background real-time sync
  • Embedding and summary API calls that used to run when saving or publishing a post are now queued and processed in the background via WP-Cron
  • Publishing no longer waits on AI API responses, making the admin experience noticeably faster
  • The sync queue processes sequentially in the background, so the index stays up to date
• Security hardening
  • Stored secrets — API keys, license keys, and the Yahoo! App ID — now use libsodium authenticated encryption (sodium_crypto_secretbox / XSalsa20-Poly1305) in a new versioned format
  • Tampered ciphertext is now detected and rejected; values saved with the previous format (AES-256-CBC) are still decrypted transparently and re-encrypted automatically, so no re-entry is required
  • A dedicated encryption key can now be defined via the FE_SEARCH_AI_ENCRYPTION_KEY constant in wp-config.php, making secret storage resilient to WordPress salt rotation
  • Added the fe_search_ai_migrate_secret_targets filter, allowing add-on plugins (such as Pro) to register their own encrypted options for migration
• Multilingual support
  • Automatic integration with Polylang / WPML / Bogo String Translation, making custom chat UI texts translatable
  • Added the fe_search_ai_display_texts filter for dynamically changing display text
• Other changes
  • Registered ［fe-search-ai］ as the canonical chat shortcode
  • Added an opaque fallback background to the consent overlay to prevent display issues
  • Admin API status messages now wrap long IDs
  • Significantly expanded the documentation site (Pro feature configuration reference, MCP integration guide, external service setup, index health, troubleshooting — in both English and Japanese)

For full details, please see the release page:
https://github.com/firstelementjp/fe-search-ai/releases/tag/v1.3.0

What’s New in Version 1.0.2

Bug Fixes

• Fixed missing JavaScript module files in the release ZIP, resolving 404 errors for admin scripts on installed sites

Improvements

• Improved admin header styling and Japanese translations

For more details about the plugin, please visit here.

What’s New in Version 1.1.0

Enhancements:

• MCP (Model Context Protocol) Integration
  • Added Dual-Era MCP support, ensuring compatibility with both legacy and modern MCP protocols.
  • Implemented server/discover, protocol version mismatch error handling (-32022), and cacheable result metadata.
  • Added a ready-to-use configuration block with a quick-copy button in the admin panel for easy setup with Claude Desktop (via the mcp-remote bridge).
• Privacy & Zero Data Retention (ZDR)
  • Unified REST /query and MCP endpoints to pass through the same PII (Personally Identifiable Information) masking and preprocessing pipeline used by the chat UI.
  • Switched Claude and Gemini debug logs to “metadata only,” ensuring AI response bodies are never permanently stored.
  • Made conversation log retention configurable (default: 7 days) with automated daily log rotation and cleanup.
  • Ensured the “Delete data on uninstall” setting applies to conversation log database tables as well.
  • Added ZDR compliance notices for eligible Anthropic models directly in the model selection interface.
  • Consolidated privacy settings into a centralized “Privacy” tab, explicitly listing the license server as an external data destination.
• Consent Management
  • Added version-controlled consent tracking by purpose, server-side token validation, and full consent withdrawal functionality.
  • Introduced optional masked conversation analytics and diagnostic summaries that exclude message bodies.
  • Added retention policy management, scheduled deletion for consent records, and purpose-based log filtering.
• Bug Fixes
  • Resolved an issue where API keys were not properly decrypted in non-streaming REST responses.

Supercharge WordPress Search with AI.

FE Search AI Pro is an enterprise-ready add-on that unlocks the full potential of the free FE Search AI plugin. It provides a comprehensive suite of advanced features built for production environments, including:

• Unrestricted AI model selection.
• Prohibited-word masking and filtering.
• Granular opt-in management for Terms of Service and Privacy Policies.
• API rate limiting and token issuance for seamless integration with mobile apps and headless WordPress setups.
• A built-in MCP server that enables autonomous AI agents to search your site.

While powered by state-of-the-art models like GPT and Claude, FE Search AI differs from generic ChatGPT widgets: it answers queries strictly grounded in your site’s actual content. Site visitors can ask questions naturally and conversationally, helping them quickly discover the exact content they need. Furthermore, by combining vector search and traditional keyword matching into a robust Hybrid Search architecture, it uncovers relevant information with exceptional precision—even for complex or ambiguous queries.

To learn more, please visit the FE Search AI Product Page.

What’s New in Version 1.2.0

Feature Improvements

Privacy & Zero Data Retention (ZDR) Compliance

• Enforced a strict “metadata-only” logging policy that never stores conversation content, while clearly documenting external transmission destinations and data flows.
• Fixed an issue where log retention period settings were not functioning properly, and implemented automatic log rotation.
• Enhanced visitor consent management with version tracking, including support for consent withdrawal and local history deletion.
• Hashed IP addresses used for rate limiting to minimize personal data retention risks.
• Resolved an issue where the “Delete data on uninstall” setting failed to trigger, enabling complete removal of all plugin-related data.
• Included recommended template text for WordPress’s built-in Privacy Policy Guide.

Chat UI Enhancements

• Redesigned the options menu into a full-screen overlay for improved usability.
• Added gradient customization (start/end colors, angle, and animations) for chat bubbles and send buttons.
• Improved chat input field styling to automatically derive colors from the background color.
• Enabled draggable resizing for the input area and added footer notifications.

For more details, please visit our release page:
https://github.com/firstelementjp/fe-search-ai/releases/tag/v1.2.0

Striving to Be the Definitive Advanced RAG Plugin for WordPress

Unlike generic AI chat tools like standard ChatGPT, FE Search AI is installed and operated directly within your WordPress site. Acting as an intelligent on-site guide, it searches relevant site content whenever a visitor asks a question in the chat interface and generates accurate answers based on that retrieved information.

While traditional keyword searches often leave users struggling to find what they need unless they guess the exact keywords, FE Search AI delivers precise guidance even when visitors ask ambiguous or natural-language questions.

FE Search AI is available in both a Free version and a paid Pro version. The Free version includes ample functionality, making it easy to adopt on a wide variety of websites (usage fees for AI providers such as OpenAI GPT, Anthropic Claude, and Google Gemini are billed separately based on consumption).

By upgrading to the Professional version, you unlock advanced capabilities and dedicated support, including:

• Complete freedom in AI model selection, including the ability to connect on-premises or custom local LLMs.
• Blocked-keyword filtering and terms-of-service/privacy opt-in management.
• Comprehensive analytics logs and user feedback mechanisms.
• API and MCP (Model Context Protocol) server capabilities, enabling seamless integrations with headless CMS environments, mobile applications, and AI agent workflows.

Experience the next generation of search performance built for WordPress in the AI era with FE Search AI.

What’s New in v1.0.3

Improvements

• Fixed an issue that prevented the forbidden word filter from being applied
• Reduced sensitive data included in forbidden word filter logs
• Improved stop word settings, the system log administration screen, and production license configuration

Bring AI Search to WordPress.

FE Search AI Pro is an add-on that extends the functionality of FE Search AI, our free WordPress plugin for adding AI search and an Advanced RAG chatbot to your site.

It includes a wide range of features designed for more robust, production-ready operations, such as flexible model selection, masking of configured forbidden words, opt-in support for Terms of Service and Privacy Policy agreements, API rate-limit settings, a built-in MCP-compatible server that enables AI agents to use AI search, and API token issuance for using AI search from mobile apps and headless environments.

While leveraging the capabilities of powerful AI models such as GPT and Claude, the AI search and chatbot in FE Search AI answer users’ questions based solely on information available on your website—unlike general-purpose services such as ChatGPT. Users can ask naturally, as if they were having a conversation, about anything they want to know regarding your site.

For site owners, FE Search AI helps visitors discover content more easily. Its hybrid search combines vector search with keyword search, making it possible to find information more accurately—including content that is difficult to locate with conventional keyword search alone.

For more information, please visit the FE Search AI Pro product page.

What’s New in v1.1.1

Improvements

• Sanitized chat history before AI provider calls
• Reduced sensitive data in logs
• Fixed the timezone display for sync timestamps
• And more

What’s New in v1.1.2

Improvements

• Strengthened sanitization and XSS protection for frontend chat rendering using DOMPurify
• Improved the safety of links in AI-generated answers
• Strengthened chat session IDs using cryptographically secure generation
• And more

For full details, please see the release pages:

• https://github.com/firstelementjp/fe-search-ai/releases/tag/v1.1.1
• https://github.com/firstelementjp/fe-search-ai/releases/tag/v1.1.2