Use Private Staff Notes

Dragwyb Click to Chat includes an Internal Notes area in the Support Center ticket workspace for staff-only coordination. Internal notes are separate from customer replies. Only use this feature for information intended for authorized support staff, and verify the customer-facing view before using it for sensitive workflows.

Add a private staff note

1. In WordPress admin, open Support Center → Tickets.
2. Open a test ticket assigned or available to your authorized staff account.
3. In the ticket workspace, open the Internal Notes tab or choose Add Note.
4. Enter the internal message and submit it. The plugin checks that the current user has the support permission for internal notes and can access the ticket.
5. Confirm the note appears in the staff workspace, then open the same test ticket as the customer to check that it is not shown in the customer conversation.

How the plugin protects internal notes

The note service stores internal notes separately from customer replies in ticket metadata. Adding a note requires the internal_note support permission and ticket access. Retrieving notes also checks the relevant support permission. The customer portal response filter removes internal-note collections and other staff-only fields before returning ticket data to the customer-facing portal.

These implementation checks are important, but they are not a replacement for testing the installed site. Custom code, integrations, or changes to the plugin can affect what a customer-facing endpoint returns. Never rely only on a hidden tab or a CSS rule to keep internal content private.

Verify note privacy with separate accounts

1. Create a disposable test ticket that contains no real customer information.
2. Add a note as an authorized support staff member.
3. View the ticket in the staff workspace and confirm the note is available to staff with the required permission.
4. Sign in as the ticket’s test customer and inspect the conversation. The internal note must not appear as a customer reply.
5. Sign in as an unrelated test account and verify it cannot open the ticket or retrieve its note.
6. If you suspect a leak, inspect the actual customer-facing response using authorized test data and review custom REST routes, filters, and integrations.

Common problems

• Add Note is unavailable or fails: verify that the staff user has the relevant internal-note permission and access to the ticket.
• The note does not appear after submission: check the response for an error, refresh the ticket details, and confirm that the note was saved.
• A customer can see internal content: treat this as a privacy issue. Reproduce it with a test ticket, avoid sharing sensitive data, and investigate the customer-facing API response and any custom code before continuing normal use.

For the broader access checks, read Guest Ticket Access and Privacy and Protect Customer Conversations.