Privacy, troubleshooting and developer hooks — WebMCP

Data and privacy

The module stores everything in your shop's database. Nothing is sent to PrestaChamps.

A visit from an assistant's link is remembered for 30 days in your shop's own cookie (no new cookie): only the channel, the assistant and the time. Ratings and reviews are read from your review module when an assistant asks, never copied.

Return and cancellation requests keep no record of their own in the module. A return request is a merchandise return of PrestaShop, as if the customer had used the return form of their order page. A cancellation request is a message on the order in PrestaShop's Customer Service, written from the customer's account; unlike the message form of the order page, it stores no IP address. Their daily limits are counters like the request limits above.

The module deletes expired records by itself, at most every 6 hours. Deleting a customer deletes their connections, tokens, prepared checkouts and tests; their log lines go after Days to keep the log. Prepared checkouts of an AI test (Test with an AI agent) are kept 30 days like any other. While the module is disabled, it deletes nothing, not even when a customer is deleted: uninstall it to delete its data.

What to mention in your privacy policy: that buyers can connect an AI assistant to their account, what the module keeps of these connections (above), and that the assistant's provider (OpenAI, Anthropic) governs what it keeps of the conversation; and, if you test as real customers in Test with an AI agent, that their orders and prices are sent to the AI provider you test with.

Uninstall. Uninstalling the module deletes its open test carts, then all of the above: every table and every setting of the module. robots.txt is left as it is (generate it again in Shop Parameters › Traffic & SEO to remove the module's group).

Pay links after disabling or uninstalling. Disabling or uninstalling the module ends every pay-link sign-in at once. A browser that opened such a link may still show the buyer's name, e-mail address and addresses in its page data until its shop cookie expires, because PrestaShop itself reads the customer from that cookie (reported to PrestaShop).

↑ Back to top

Troubleshooting

Start with Diagnostics: each line below is a check of its list, with what it means and how to fix it. While phone assistants are off, the five "Phone assistants" lines are information only.

• Module on for this shop – fails when the module is not enabled for this shop in the Module Manager (Open the Module Manager), is switched off in its settings (Open the settings), or when the shop is in maintenance mode (visitors and assistants then see the maintenance page; Open the maintenance settings).
• Tools offered – fails when no tool is switched on ("assistants find nothing to use on your storefront"), needs attention when only cart changes are on (assistants cannot search or read your catalogue to find what to add). Fix: Choose the tools.
• Secure pages (HTTPS) – fails without HTTPS: browsers offer WebMCP only on secure pages. "HTTPS is on for some pages only": turn on HTTPS on every page (Open the general settings). A shop on your own computer shows "Secure for development only".
• Connection to your storefront pages – "The module is not fully connected to your storefront pages, so they may not offer the tools." Fix: Repair the hooks on the same card.
• Origin-trial tokens – information without a token: "Without a token only browsers with the WebMCP testing flag see your tools." (Add a token). Warns when a token is for another address, is not the WebMCP trial, has expired or ends within 14 days.
• Search index – see The search index.
• The storefront answers – the module calls its own storefront address from your server. "Your server could not open its own storefront address (common behind firewalls and in Docker)": use Open the storefront check in your browser. "The storefront sends this address elsewhere instead of answering": check your shop address and redirect rules. "The storefront answers “unavailable”": usually maintenance mode. After a fix, Clear the cache.
• Shop search engine – information: which module answers your shop's searches ("Shop searches use PrestaShop's own search." or "Shop searches are answered by …"); "The search module ended the request instead of answering": its fallback redirects to the shop's search page; assistants then get PrestaShop's own search.
• Phone assistants: secure address (HTTPS) – fails without SSL: ChatGPT and Claude connect only to shops with HTTPS (Open the general settings). A shop on your own computer passes as "Development only".
• Phone assistants: friendly URLs – fails when friendly URLs are off (Open the SEO and URL settings).
• Phone assistants: discovery addresses – the shop fetches its own /.well-known/oauth-… documents, where assistants learn how buyers sign in. Needs attention when only the module's own copies answer (most assistants still connect); fails when none answers or when they name another address (check the shop's domain and SSL setting). Fix: your web server must send addresses starting with /.well-known/oauth- to PrestaShop; on Apache no .htaccess rule may stop /.well-known/ before PrestaShop's rules; on Nginx add a location for /.well-known/oauth- that passes to index.php. Behind a firewall the server may not reach its own address: use Open the document in your browser instead.
• Phone assistants: sign-in header – fails when your server drops the sign-in that connected assistants send (the Authorization header): they then cannot use the cart, orders or checkout. Fix: Apache with PHP as CGI or FastCGI: add CGIPassAuth On to the shop's .htaccess, or keep PrestaShop's line that copies the header into HTTP_AUTHORIZATION; Nginx: add fastcgi_param HTTP_AUTHORIZATION $http_authorization to the PHP location.
• Phone assistants: the same cart on the web – information when Re-display cart at login is off: a buyer who signs in on your website then gets a new, empty cart instead of the assistant's (the pay link still opens the assistant's cart). Fix: Open the customer settings and switch it on.
• AI agent directories – information while Describe this shop for AI agent directories is off; it needs attention if robots.txt still points directories to the description (open Settings › Advanced settings › AI agent directories and save). Fails when friendly URLs are off (Shop Parameters › Traffic & SEO), when the description or the guide for AI agents does not answer (check that the module is enabled for this shop, then clear the shop's cache) or when the description breaks the format (the details list each problem). Needs attention when your server could not open its own address (Open the description in your browser instead); when your server does not pass /.well-known/ard.json and /.well-known/ai-catalog.json to PrestaShop (Apache: no rule in .htaccess may stop /.well-known/ before PrestaShop's rules; Nginx: a location for these two addresses that passes to index.php); when /llms.txt does not answer with the module's summary (Nginx: let the location for .txt files fall back to index.php); when robots.txt has no Agentmap: line yet or an out-of-date one (open Settings › Advanced settings › AI agent directories and save); or when its Agentmap: line names another domain (remove that line if it is not yours). See AI agent directories and llms.txt.
• Forms for AI agents – information when Mark forms for AI agents is off ("Chrome Lighthouse lists your shop's forms as not marked for AI agents"; Open the settings) or Offer tools on this shop is off. Needs attention when storefront pages reported forms Chrome counts as WebMCP issues in the last 7 days (only with Diagnostic mode on): a form of the theme or another module with only one of the toolname and tooldescription attributes (give it both, or neither), a form that uses the name of one of the module's tools (rename it), two forms on one page with the same name, a marked form with a field without a name or a label, or radio buttons outside a fieldset (fix these in the theme), or forms marked as not for agents that the browser offered anyway (switch Mark forms for AI agents off and look for a module update). See Form tools on your pages.
• Ratings and reviews – which review module product answers read ("Product answers include the ratings and recent reviews of …"). Information when Show ratings and reviews to AI agents is off (Open the settings), when no review module this version can read is active, or when the active one keeps its reviews on its own servers, collects reviews of the shop rather than of products, or cannot be read by this version yet; needs attention when the module is active but its review tables cannot be read. See Ratings and reviews.
• Delivery to your main countries – needs attention when no carrier delivers to your default country or to one of the countries you received the most orders from in the last 90 days ("No carrier delivers to: …. Shoppers and assistants get no delivery option there."). Fix: Open the carriers and add the country's zone to a carrier.
• Verified AI agents – information while Recognise verified AI agents is off (Open the settings) or while no AI agent sent a signed request in the past week (few agents sign yet). Passes with the number of requests from verified agents. Needs attention when your PHP has no sodium extension (ask your host to enable it), or when most signatures of known agents did not check out: a proxy or CDN that changes the shop's address, or a wrong server clock, can cause this; Details list the reasons.
• Firewalls and AI agents – your server opens your shop like a browser, then as ChatGPT and other AI agents, and your MCP server as ChatGPT. Passes when the agents get your shop like a browser does. Fails when a firewall or bot rule refuses or challenges them, and names it with what to change: Cloudflare (AI bot policies: set Agent and Search to Allow; Bot Fight Mode cannot be bypassed with rules), Imunify360, ModSecurity, LiteSpeed, Sucuri, Akamai, BitNinja, or a hosting limit that answers "too many requests". Needs attention when your server cannot open its own address (common behind firewalls and in Docker) or is itself challenged, so it cannot tell from here.
• Return and cancellation requests – information while both tools are off (Open the tools). Needs attention when Request a return is on but your shop takes no merchandise returns, so every return request is refused: switch on returns in Customer Service › Merchandise Returns (Open the merchandise returns). It shows your return period.
• Product feed for ChatGPT – information when the separate module "OpenAI / ChatGPT Ads" is not installed. Needs attention when it is installed but not active in this shop, when its product feed is off, or when its delivery (hosted feed address or SFTP) is not chosen yet (Open its settings). Passes when it handles your feed.
• WebMCP in this browser – information about the browser you use now (see This browser and the storefront reports).

Other common questions:

• The assistant says the shop has no tools. Offer tools on this shop is off, no tool is on in Tools, or a page cache still serves pages from before: clear it.
• The assistant cannot add to the cart. Add to cart is off in Tools; on the phone, the buyer has not connected their account.
• A buyer cannot connect. Their account was made in a guest checkout (they create one with a password), or another app than ChatGPT or Claude tries to connect while Allow any assistant app is off.
• The pay link says it is no longer valid. It was used or expired: the buyer asks the assistant for a new one.
• An assistant says the shop has no answer about delivery or returns. Write the answer in FAQ for AI agents, or add a page about it in Design › Pages (see FAQ for AI agents). Search shop info must be on in Tools.
• A discount code is refused with "Too many failed attempts". Too many codes your shop does not know were tried from that session or address: the tries work again after a while (see Discount codes).
• Orders from AI assistants stays empty. Only valid orders count, and only those whose cart an assistant touched or that came from an assistant's link within 30 days; check that Count orders from AI assistants is on (Settings › Advanced settings › Logging). Behind a page cache, empty the cache once after an upgrade (see Visits from AI links behind a page cache).
• An assistant says it cannot send a return request. Request a return is off in Tools, the customer is not signed in, your shop takes no merchandise returns, the order is not delivered yet or its return period is over, or the customer already sent 5 requests today.
• A cart link opens an empty cart. Cart links for AI assistants is off, the products are not available or out of stock (the cart page names them). The link fills the cart of the browser that opens it, and the same link adds its products only once within 10 minutes.
• Products for AI agents shows old scores. The scores are those of the last check: choose Check again.
• Assistants do not mention your text for AI agents. Check that Give AI agents your product texts (Settings › Product answers) and the tool Get product details are on, and that the text exists in the shopper's language or in your default language.
• Assistants find fewer products than your search box. See The search index.
• Calls are refused with "too many requests" behind a CDN. Visitors arriving through one CDN edge share its limits: fill Trusted proxies with your CDN's published address ranges (Settings › Advanced settings › Limits).
• Test with an AI agent says "Add an AI key or choose the demo run." Add a key under AI keys, or choose the demo run. "Today's limit for AI tests is reached." Raise AI test budget per day or wait for tomorrow; the demo run still works. "… did not answer in time." / "The shop could not reach …." Your server cannot open HTTPS connections to the provider: ask your host to allow outgoing HTTPS connections to the AI provider you use (Anthropic, OpenAI or Google).
• The audit says "Your server could not open its own storefront pages." Use Check from this browser.
• The score did not change after a fix. The bars and answers are those of the last full run: run the full audit again.
• Chrome Lighthouse's "Agentic browsing" audit lists elements without a name. Run the full audit and open Accessibility for AI agents: its details name each element, its page and the template part that prints it (see Accessibility for AI agents). Elements built by scripts are seen only by Lighthouse.
• /llms.txt shows another text than the module's summary. A file named llms.txt at the root of the shop is served instead: delete or rename it to let the module's summary answer.
• A pay link opened on a phone answers "Page not found". On PrestaShop 8, Module Manager's Disable on mobiles is on for the module: pay links then do not open on phones (nothing is signed in). Switch it off for this module.

When you contact PrestaChamps support, say which Diagnostics lines need attention, and, if the log is on, the time and tool of a failed call.

↑ Back to top

For developers

Other modules can offer their own tools to assistants through the module's hook actionPchwebmcpRegisterTools: they then appear in Tools as "Added by another module", off until you switch them on, and are offered to phone assistants only when Offer tools of other modules to phone assistants is on. The developer guide (available from PrestaChamps) describes the hook, the tool format, the access levels, the storefront API and the MCP server.

↑ Back to top