chatixy/silverstripe-chatixy

Chatixy AI chat widget for Silverstripe CMS - paste your widget key in Settings, no code.

Maintainers

Package info

github.com/Devoflex/silverstripe-chatixy

Homepage

Issues

Type:silverstripe-vendormodule

pkg:composer/chatixy/silverstripe-chatixy

Transparency log

Statistics

Installs: 0

Dependents: 0

Suggesters: 0

Stars: 0

Security

Advisories: 0

Aikido package health analysis

v1.0.0 2026-08-17 23:15 UTC

Requires

MIT ba84c204d6cf48d17e8b78369ece8460ab88db61

chatsilverstripewidgetlive-chatcustomer-supportchatixyai-chat

Published on Packagist.org on 2026-08-17 23:31 UTC

This package is auto-updated.

Last update: 2026-08-17 23:34:20 UTC

README

Adds the Chatixy AI chat widget to every front-end page of a Silverstripe CMS site. No template edits, no $Requirements call in your theme: install it, paste your widget key in Settings, save.

Requirements
Silverstripe CMS 5.4 or 6 (silverstripe/cms: ^5.4 || ^6)
PHP 8.1+ on CMS 5.4, 8.3+ on CMS 6 (whatever your CMS major requires)

CMS 5 reaches end of life in December 2026; new sites should be on CMS 6.

Installation

composer require chatixy/silverstripe-chatixy
sake dev/build flush=1

The dev/build is not optional: the module adds a ChatixyWidgetKey column to SiteConfig, and the flush is what makes Silverstripe pick up the module's _config/ directory.

Configuration

In the CMS, go to Settings -> Chatixy and paste your widget key. You will find it in your Chatixy dashboard under Install - the bare 64-character key, <key>.js, or the whole <script> snippet all work, and only the key itself is stored.

Leave the field empty to switch the widget off across the whole site. Until a valid key is saved the module adds nothing to any page, so it is safe to install before you have one.

What it does

On every front-end page, the module adds

<script src="https://chatixy.com/source/<key>.js?platform=silverstripe" async data-chatixy-source="silverstripe"></script>

to the <head>, through Requirements::insertHeadTags(). Because that is a Requirements registration and not a template change, it works with any theme and any page type, including page types added by other modules.

Two things it deliberately does not do:

  • It never adds the tag twice. The data-chatixy-source attribute in the tag is also the Requirements uniqueness id, so a second registration in the same request replaces the first instead of booting a second widget.
  • It never touches output that is not an HTML document. RSS feeds, JSON action responses and rendered fragments have no </head>, and Silverstripe's requirements are not injected into those at all.

Security

The loader origin is not configurable. It is pinned in code to https://chatixy.com and its subdomains, over https only, because that origin becomes a first-party <script src> on every page of your site. There is no host field to misconfigure and none to attack: evilchatixy.com, chatixy.com.evil.example, chatixy.com@evil.example and http://chatixy.com are all rejected in favour of the canonical origin.

The stored key is re-validated as 64 hex characters every time it is read, not just when it is saved, so a row written by a fixture or a dev/task cannot put anything else into the page.

License

MIT - see LICENSE.