ZChat 2.0.7 - Download

ZChat version 2.0.7

Updated At: 2026-09-26

Changes: ZChat 2.0.7 (September 2026): teams for organising conversations, with filters, saved views and reports per team; dashboard apps (your own web page as a tab beside every conversation); no lost live chat messages under load; a much faster conversation list on large databases; a returning visitor's new chat is now its own conversation. Premium adds the Linear integration, Shopify orders in the contact panel, and SMS and WhatsApp campaigns to a contact segment. Live chat stays free with unlimited agents.

ZChat version 2.0.1

Updated At: 2026-08-08

Changes: ZChat 2.0 - August 2026 feature release adds an opt-in AI assistant surface in the visitor widget with per-visitor answer budgets, per-IP rate limiting, and human-fallback on every failure path, first-response SLA tracking with business-hours-aware deadlines and an attainment dashboard, optional TOTP two-factor authentication for agents, an inbound email gateway endpoint that threads replies onto existing conversations and ignores auto-responders, proactive trigger targeting by referrer, browser language, and returning-visitor count, licensing improvements that normalize licensed-domain spellings, validate multi-domain licenses, and name the licensed domain in mismatch errors, per-step startup schema migration reporting on the readiness endpoint, version-stamped 2.0.0 assemblies, and upload filename hardening against invisible Unicode spoofing characters. ZChat 2.0 - July 2026 dashboard fix keeps the dashboard home session request inside the API's safe 366-day search window, preventing a 400 Bad Request after sign-in on fresh installs. July 2026 package fix widens SampleUsers.Password in fresh SQL installs before default PBKDF2 account seeding, so admin/admin123 and agent1/agent123 work after a clean database setup. July 2026 licensing refresh that emits current 710566 license files, accepts compatible signed legacy 20160520 licenses, accepts the official ASP.NET Core trial license, validates license host checks against the real request host, and ships the signed trial license from the license bundle. June 2026 package refresh with improved widget retry recovery, mobile layout polish, attachment validation, auth/API hardening, dashboard lifecycle checks, reconnect recovery, fresh SQL install scripts, and a rebuilt full install package. Latest polish preserves visitor pre-chat drafts during network failures, caps visitor pre-chat and offline-form fields before draft storage/submission, prevents runtime logs/uploads from shipping in the installer, caps memory during abandoned-session and spray attacks, validates uploaded image bytes, hardens CSV/privacy exports, ships safe generated runtime configuration, stores default seed-account passwords as hashes while preserving first-run admin/admin123 and agent1/agent123 login, redacts secret-bearing webhook URLs in admin/audit responses, sanitizes visitor page URLs and referrers before storage, scopes visitor IP metadata to admins, keeps dashboard copy encoding-safe across Audit Log, Knowledge Base, Profile, Canned Responses, and Chatbot management pages, audits privileged chat-trigger changes, department updates, missed-chat deletions, canned-response mutations, admin agent-account updates, and agent avatar uploads/removals without storing visitor message text, response body text, password values, session tag text, or server file paths, awaits knowledge-base delete audit persistence, validates webhook outbox status filters and keeps payload/signature fields out of outbox listings, treats abrupt SignalR agent disconnects as real offline events for presence and webhook notifications, observes and logs background session persistence failures, avoids duplicate department lookups during visitor live-chat routing, loads agent accept capacity limits asynchronously on the SignalR path, reduces EF tracking overhead on read-heavy dashboard and management queries, keeps dashboard daily session totals accurate beyond aggregate read caps, keeps long capped transcripts focused on the most recent messages while preserving chronological order, keeps chatbot chat/stream/handoff responses no-store/no-cache/nosniff, bounds webhook delivery attempts so slow receivers cannot stall outbox batches, bounds background auto-summary and transcript-email queues during end-session bursts, lets agents remove their own profile photo without admin-only moderation rights, lets admins clear optional chatbot API endpoints back to provider defaults, URL-encodes dashboard SignalR access tokens for more robust live-chat reconnects, keeps public widget status/triggers/departments reads, public offline-message/feedback POST responses, and attachment upload/download responses no-store/no-cache/nosniff for fresh availability, filters expired IP-block rows before visitor enforcement caches and duplicate checks, rate-limits public widget department reads, keeps public client config no-store and client-safe, makes widget REST throttle responses no-store/no-cache/nosniff, ensures documented install-source SQL scripts are included in the downloadable zip, sanitizes live-message HTML so only same-server attachment links render, redacts legacy/readiness failure details from public responses, and keeps AI knowledge-base retrieval limited to top-level safe article filenames, serializes session creation to prevent duplicate session rows during fast visitor/agent reconnects, and hardens the installer builder so it no longer deletes its Console asset when packaging in place, and bounds hub webhook notification enqueue work so chat bursts cannot flood the thread pool before durable outbox persistence, and bounds legacy ChatAjax routing and cookie fields before session routing and generates safe guest identities when legacy cookies omit a visitor name, and enforces session read authorization before AI suggested-reply generation so agents cannot request transcript-derived suggestions for another agent session, and bounds privacy export and erase email queries to prevent oversized administrative data-subject requests.

ZChat version 2.0

Updated At: 2026-07-14

Changes: ZChat 2.0 - July 2026 dashboard fix keeps the dashboard home session request inside the API's safe 366-day search window, preventing a 400 Bad Request after sign-in on fresh installs. July 2026 package fix widens SampleUsers.Password in fresh SQL installs before default PBKDF2 account seeding, so admin/admin123 and agent1/agent123 work after a clean database setup. July 2026 licensing refresh that emits current 710566 license files, accepts compatible signed legacy 20160520 licenses, accepts the official ASP.NET Core trial license, validates license host checks against the real request host, and ships the signed trial license from the license bundle. June 2026 package refresh with improved widget retry recovery, mobile layout polish, attachment validation, auth/API hardening, dashboard lifecycle checks, reconnect recovery, fresh SQL install scripts, and a rebuilt full install package. Latest polish preserves visitor pre-chat drafts during network failures, caps visitor pre-chat and offline-form fields before draft storage/submission, prevents runtime logs/uploads from shipping in the installer, caps memory during abandoned-session and spray attacks, validates uploaded image bytes, hardens CSV/privacy exports, ships safe generated runtime configuration, stores default seed-account passwords as hashes while preserving first-run admin/admin123 and agent1/agent123 login, redacts secret-bearing webhook URLs in admin/audit responses, sanitizes visitor page URLs and referrers before storage, scopes visitor IP metadata to admins, keeps dashboard copy encoding-safe across Audit Log, Knowledge Base, Profile, Canned Responses, and Chatbot management pages, audits privileged chat-trigger changes, department updates, missed-chat deletions, canned-response mutations, admin agent-account updates, and agent avatar uploads/removals without storing visitor message text, response body text, password values, session tag text, or server file paths, awaits knowledge-base delete audit persistence, validates webhook outbox status filters and keeps payload/signature fields out of outbox listings, treats abrupt SignalR agent disconnects as real offline events for presence and webhook notifications, observes and logs background session persistence failures, avoids duplicate department lookups during visitor live-chat routing, loads agent accept capacity limits asynchronously on the SignalR path, reduces EF tracking overhead on read-heavy dashboard and management queries, keeps dashboard daily session totals accurate beyond aggregate read caps, keeps long capped transcripts focused on the most recent messages while preserving chronological order, keeps chatbot chat/stream/handoff responses no-store/no-cache/nosniff, bounds webhook delivery attempts so slow receivers cannot stall outbox batches, bounds background auto-summary and transcript-email queues during end-session bursts, lets agents remove their own profile photo without admin-only moderation rights, lets admins clear optional chatbot API endpoints back to provider defaults, URL-encodes dashboard SignalR access tokens for more robust live-chat reconnects, keeps public widget status/triggers/departments reads, public offline-message/feedback POST responses, and attachment upload/download responses no-store/no-cache/nosniff for fresh availability, filters expired IP-block rows before visitor enforcement caches and duplicate checks, rate-limits public widget department reads, keeps public client config no-store and client-safe, makes widget REST throttle responses no-store/no-cache/nosniff, ensures documented install-source SQL scripts are included in the downloadable zip, sanitizes live-message HTML so only same-server attachment links render, redacts legacy/readiness failure details from public responses, and keeps AI knowledge-base retrieval limited to top-level safe article filenames, serializes session creation to prevent duplicate session rows during fast visitor/agent reconnects, and hardens the installer builder so it no longer deletes its Console asset when packaging in place, and bounds hub webhook notification enqueue work so chat bursts cannot flood the thread pool before durable outbox persistence, and bounds legacy ChatAjax routing and cookie fields before session routing and generates safe guest identities when legacy cookies omit a visitor name, and enforces session read authorization before AI suggested-reply generation so agents cannot request transcript-derived suggestions for another agent session, and bounds privacy export and erase email queries to prevent oversized administrative data-subject requests.

ZChat version 2.0

Updated At: 2026-07-02

Changes: ZChat 2.0 - June 2026 package refresh with improved widget retry recovery, mobile layout polish, attachment validation, auth/API hardening, dashboard lifecycle checks, reconnect recovery, fresh SQL install scripts, and a rebuilt full install package. Latest polish preserves visitor pre-chat drafts during network failures, caps visitor pre-chat and offline-form fields before draft storage/submission, prevents runtime logs/uploads from shipping in the installer, caps memory during abandoned-session and spray attacks, validates uploaded image bytes, hardens CSV/privacy exports, ships safe generated runtime configuration, stores default seed-account passwords as hashes while preserving first-run admin/admin123 and agent1/agent123 login, redacts secret-bearing webhook URLs in admin/audit responses, sanitizes visitor page URLs and referrers before storage, scopes visitor IP metadata to admins, keeps dashboard copy encoding-safe across Audit Log, Knowledge Base, Profile, Canned Responses, and Chatbot management pages, audits privileged chat-trigger changes, department updates, missed-chat deletions, canned-response mutations, admin agent-account updates, and agent avatar uploads/removals without storing visitor message text, response body text, password values, session tag text, or server file paths, awaits knowledge-base delete audit persistence, validates webhook outbox status filters and keeps payload/signature fields out of outbox listings, treats abrupt SignalR agent disconnects as real offline events for presence and webhook notifications, observes and logs background session persistence failures, avoids duplicate department lookups during visitor live-chat routing, loads agent accept capacity limits asynchronously on the SignalR path, reduces EF tracking overhead on read-heavy dashboard and management queries, keeps dashboard daily session totals accurate beyond aggregate read caps, keeps long capped transcripts focused on the most recent messages while preserving chronological order, keeps chatbot chat/stream/handoff responses no-store/no-cache/nosniff, bounds webhook delivery attempts so slow receivers cannot stall outbox batches, bounds background auto-summary and transcript-email queues during end-session bursts, lets agents remove their own profile photo without admin-only moderation rights, lets admins clear optional chatbot API endpoints back to provider defaults, URL-encodes dashboard SignalR access tokens for more robust live-chat reconnects, keeps public widget status/triggers/departments reads, public offline-message/feedback POST responses, and attachment upload/download responses no-store/no-cache/nosniff for fresh availability, filters expired IP-block rows before visitor enforcement caches and duplicate checks, rate-limits public widget department reads, keeps public client config no-store and client-safe, makes widget REST throttle responses no-store/no-cache/nosniff, ensures documented install-source SQL scripts are included in the downloadable zip, sanitizes live-message HTML so only same-server attachment links render, redacts legacy/readiness failure details from public responses, and keeps AI knowledge-base retrieval limited to top-level safe article filenames, serializes session creation to prevent duplicate session rows during fast visitor/agent reconnects, and hardens the installer builder so it no longer deletes its Console asset when packaging in place, and bounds hub webhook notification enqueue work so chat bursts cannot flood the thread pool before durable outbox persistence, and bounds legacy ChatAjax routing and cookie fields before session routing and generates safe guest identities when legacy cookies omit a visitor name, and enforces session read authorization before AI suggested-reply generation so agents cannot request transcript-derived suggestions for another agent session, and bounds privacy export and erase email queries to prevent oversized administrative data-subject requests.

ZChat version 1.0

Updated At: 2016-06-28

Changes: A New Release! ZChat Enterprise offers an on-premises Live Chat Solution. Protect customer data and other proprietary information by ensuring it never leaves your data-center