The challenge
Small businesses get the same questions every day, but can't staff live chat. Generic AI chatbots either invent answers or make the owner manage an AI account, API keys and billing.
// CASE STUDY 11
WORDPRESS PLUGIN + AI SERVICE
Joyno Chatbot
A branded AI assistant that a business adds to its WordPress site. It answers visitors from the business's own FAQs and pages, and the agency runs it as a subscription.
- Role
- Full product: plugin, service, security and deployment
- Platform
- WordPress plugin + Node.js service
- Core stack
- PHP · Node.js · Google Gemini
// 01 / THE STORY
Why this was built.
The approach
The plugin keeps a small search index of the pages the owner picks and sends only relevant excerpts, as a signed server-to-server request, to an agency service that checks the subscription and limits before asking Gemini. The API key never leaves the agency server.
What it delivers
Businesses install a plugin and paste one activation code; the agency runs every client from one dashboard. It's live on a client site, passes the official WordPress Plugin Check with no errors or warnings, and has been submitted to WordPress.org.
// 02
Key capabilities
One product with three audiences: visitors, business owners and the agency.
- Floating chat in dark or light theme, using the business's own colour and logo
- Answers in English and Filipino, grounded only in the owner's FAQs and selected pages
- Search that understands word forms and synonyms, including "magkano" and "presyo"
- Answer buttons that open pages, restricted to pages the owner approved
- Full-screen chat on phones that adjusts to the on-screen keyboard
- Three-step WordPress setup with a checklist and a live preview of the chat
- FAQ editor and page picker, with pages re-indexed automatically when edited
- Agency dashboard to onboard clients, suspend service and set renewal dates
- Monthly, daily and per-minute limits with AI usage and cost estimates per client
- Single-use, 30-minute activation tokens tied to each site's address
- HMAC-signed requests with single-use nonces, so captured requests can't be replayed
- No stored conversation transcripts; visitor IPs kept only as rotating daily hashes
// 03
On the site, in WordPress, and for the agency
Real plugin and dashboard code on a demo page, with scripted replies and demo client data.
// 04
Architecture
Credentials stay on the server; every request is signed, limited and leaves no transcript.
- WordPress plugin
- PHP 8.1+, WordPress REST API, vanilla JavaScript and CSS with no external scripts or fonts
- Agency service
- Node.js with no runtime dependencies, built-in SQLite and Node crypto
- AI
- Google Gemini, called only from the agency server
- Hosting
- Ubuntu VPS with systemd, Nginx, Let's Encrypt HTTPS and online database backups
- Testing
- Node test runner, PHP contract tests, real WordPress installs, Playwright and the official Plugin Check
// AI FOR SMALL BUSINESSES
Let's work together