The Website Snippet

Putting the Chat on Your Websites

Owners and admins open Setup, then Chat Settings, then Website Snippet (action chat.widget.get). Copy the one line it shows and paste it just before the closing body tag of each page where the chat should appear, or into your website builder's custom code setting. It works on any website, on any platform.

If your website has a Content Security Policy, allow scripts and connections to the address in the snippet.

Make a New Snippet (action chat.widget.reset) makes every snippet you have now stop working, for example if someone copied it onto a website that is not yours. Put the new one on your websites afterward. Chats you already have stay as they are. To keep the chat to your own websites all the time, list them in Chat Settings.

What Visitors See

• A round chat bubble in the corner, in your color. It opens the chat window, which fills the screen on phones. A red dot on the bubble means your team replied while the window was closed. Everything fades in and out.
• During office hours: your greeting, then a short form to start a chat. Name and email are optional or required, as Chat Settings say.
• In a chat: their messages and your team's (first names only), notices, and a box to write. Visitors who have not given their email are asked for it once, so you can reply if they leave. The menu offers Email Me a Transcript and End Chat.
• Outside office hours: a frosted note that you are offline, when you are back, and Leave a Message: their name, email, and message. It becomes a Helpdesk ticket when Helpdesk is added, or an open chat in Chat for your team.

How Visitors Are Known

A visitor is known only by a random id until they give a name and email. Their browser keeps a random secret so it is recognized when they come back; your workspace keeps only a scrambled form of it (a hash), so nobody can act as a visitor from your data. Their internet address is never kept: only a scrambled form of it, for the limits below. Nothing else is stored in their browser, and nothing is tracked.

Protection from Abuse

The chat is public, so every request is checked and limited:

• The snippet is signed by MountDev Ops and names your workspace. A changed or made-up snippet is refused before it reaches your workspace, and an old one stops at Make a New Snippet.
• Limits: 30 new visitors an hour from one internet address, 5 new chats an hour from one address and 3 from one visitor, 30 messages every 10 minutes in a chat, 3 offline messages an hour from one address, and 3 transcript emails a day for a chat. Past a limit, visitors read a plain message to try again later.
• A hidden field that people never see catches simple bots.
• Messages are kept to 4,000 characters, and everything visitors write is shown as text, never run as code.