When WordPress 7 shipped its native AI Connectors API, a lot of plugin makers rushed to integrate. We didn't. π’
Here's the honest reasoning behind that call, as makers of Fabio Chatbot (an AI chatbot plugin for WordPress):
The trade-off nobody talks about βοΈ Right now, our users set their own API keys directly inside Fabio Chatbot. We control exactly how those credentials are stored and handled β no middle layer, no surprises. Switching to the native connector means outsourcing that trust to a brand-new WordPress core system. Convenient? Sure. But it's new, unproven at scale, and touching user API keys is not where we want to be an early adopter. π
So we made the unsexy choice: wait and watch, rather than ship a shiny integration that could put our users' credentials at risk. We'll move when the security story is solid, not when it's trendy.
What we shipped instead: v3.6.9.2 π Instead of chasing the new connector, we doubled down on something our users actually asked for β better response tones.
Fabio Chatbot has always let site owners pick how their chatbot "speaks":
π¦ Professional β confident, sales-driven
π¨ Friendly β warm, casual, approachable
π₯ Serious β strictly factual, zero fluff
This release sharpens the prompt engineering behind all three, so responses stay consistently on-brand instead of occasionally drifting into generic-AI-speak.
The takeaway π‘ Sometimes the best move as an indie plugin maker isn't shipping the flashy new integration β it's saying "not yet" and putting that time into polishing what already works. Security debt is way more expensive to pay off later than a missed trend cycle now.
Curious what other makers here think β would you have made the same call, or moved fast on the native connector? π
The decision to delay the connector is interesting because itβs driven by trust rather than feature velocity. That makes the release choice more consequential than a typical integration decision.
In our actual system, the webmaster enters his own API key, which is stored on his server. The Wordpress connectors stores the API key somewhere, without visibility. For my part, I need more intel on how safe it is .
That makes the trust concern much more concrete. Iβm curious what you learn once you have more visibility into how the connector handles those credentials.