Guest Ticket Access and Privacy explains how Dragwyb Click to Chat handles support tickets created without a logged-in WordPress account, how guest sessions are stored in the browser, how guest notifications work, and how staff can keep internal notes separate from customer conversations. Use this overview with the focused guides below, and verify customer, guest, and staff behavior on your own site before launch.
How guest ticket access works
The Support Center can allow a visitor to submit a ticket as a guest. The ticket service generates or stores a guest access token for the ticket, and the portal sends that token with requests to view or interact with the ticket. For a specific ticket, the REST permission checks validate the requester against the ticket: an authorized staff member, a logged-in customer associated with the ticket, or a guest presenting the matching saved token.
A guest token is sensitive access information. Do not share ticket URLs or tokens publicly, and do not assume that knowing a ticket number or email address alone should grant access. The browser session timeout clears the guest session from the client; it should not be treated as proof that a token has been revoked server-side.
Review guest session and privacy settings
The Support Portal settings include controls for enabling the guest ticket form, showing login and registration buttons, configuring the guest session timeout, selecting session or local browser storage, showing an expiry countdown, showing an End Guest Session button, displaying a public-device notice, and preventing guest media uploads. The defaults in version 1.2.0 include a five-minute guest session timeout and session storage, but the saved settings on your site may differ.
- Review the guest form and login/register controls so the portal presents the access options you intend.
- Choose session storage or local storage deliberately. Session storage is intended for the browser session; local storage can retain guest-session data beyond the current tab.
- Keep the expiry timer and end-session control visible where appropriate, especially on shared devices.
- Test timeout, session clearing, and ticket access in a private browser and in a separate browser profile. Do not use a real customer ticket for these tests.
Guest ticket email notifications
The plugin has a guest ticket received email setting and a customizable confirmation prompt. The guest confirmation email is sent only when the ticket is a guest ticket with an email address and the relevant notification policies allow it. In particular, both the broader customer email notification policy and the guest-specific received-email setting can affect whether the confirmation is sent. A setting being enabled does not guarantee delivery; email configuration, scheduled processing, and the receiving mail system can still affect delivery.
Use a dedicated test email address to verify ticket creation and the expected notification. Confirm the address shown in the guest email confirmation prompt before submitting a ticket. For setup and troubleshooting, see Configure Guest Ticket Notifications.
Link guest tickets to a user account
The ticket service can associate an unlinked guest ticket with a registered WordPress account when the account’s registered email matches the ticket email. The implementation uses the registered account email for this linking operation; it does not rely only on an arbitrary email value supplied by the visitor. Account linking can occur on registration and during ticket retrieval flows. Test with a controlled guest ticket and a dedicated test account, and verify that only the expected tickets become associated with that account.
Read Link Guest Tickets to User Accounts for the account-linking workflow.
Protect customer conversations
Access to an individual portal ticket is checked separately from an empty initial ticket-list request. For ticket details and actions, the plugin checks whether the requester is authorized for that ticket. Keep the plugin updated, avoid exposing guest tokens, and test the actual customer portal with separate identities rather than assuming that the interface alone proves privacy.
- As the intended customer, verify that the account can access its own ticket.
- As a different customer account, try the same ticket and confirm access is denied.
- As a guest, verify that the matching guest token works only for the intended ticket and that an unrelated token does not.
- On a shared device, use the end-session control and verify that the next visitor cannot continue the previous guest session.
Use Configure Secure Guest Ticket Access and Protect Customer Conversations for focused checks.
Keep private staff notes internal
Private staff notes use a dedicated note service and require the relevant support permission. The customer portal also filters ticket data before returning it to customer-facing views. Still, verify the behavior on the installed version: add a test note as an authorized staff member, then view the same ticket as the customer and confirm that the note is not exposed in the customer conversation. Do not put customer-facing instructions or sensitive data in a note unless your staff policy permits it.
Recommended troubleshooting order
- Confirm that the Support Center is enabled and that the guest ticket form is available as intended.
- Review the guest session timeout and storage mode, then clear stale browser session data before retesting.
- Check that the guest is using the correct ticket token and that the ticket-specific authorization check succeeds.
- Review both the general customer email notification policy and the guest ticket received-email setting when confirmation mail is missing.
- When linking a ticket to an account, verify the registered WordPress email matches the guest ticket email.
- Test customer, unrelated-account, guest, and staff views separately, including private-note visibility.
These checks are a troubleshooting guide, not a claim that live tests have been performed on your site. Record the result of each test before treating a privacy workflow as verified.