Key facts
- Small API-based chatbots run on the £1 a day + VAT plan
- API key stored in a server environment variable, never in the browser
- PHP or Node.js backends supported in Plesk
- Rate limiting to protect your API budget
- Cloudflare in front to filter bots
- Document-search (RAG) and self-hosted model chatbots quoted
How a safe chatbot is put together
The chat window on your site is just the front end. The important part is a small backend script on your server:
- The visitor types a question in the chat widget.
- The widget sends it to your server, not straight to the AI provider.
- Your PHP or Node.js script adds your instructions and context, then calls the AI API using a key stored on the server.
- The answer comes back through your server to the visitor.
This keeps your API key secret, lets you control what the bot says, and means you can log and limit usage.
The mistake to avoid
Some quick tutorials put the API key straight into JavaScript in the page. Anyone can open the browser's developer tools, copy the key and use it for anything they like, on your bill. If you have a chatbot built like that, rotate the key now and move the call to the server. We can help.
What runs on the £1 a day plan
dijitul Complete Hosting suits chatbots that:
- Call a hosted model API from PHP (for example with Guzzle or cURL) or from Node.js.
- Use a modest system prompt and perhaps a short FAQ or price list as context.
- Have normal small-business traffic.
We'll store the key in an environment variable outside the web root, set PHP timeouts high enough for AI responses, and add Cloudflare rules to stop bots hammering the chat endpoint. A WordPress chatbot plugin that calls an API server-side works the same way. See WordPress hosting.
When a chatbot needs a quote
- It searches hundreds or thousands of your documents. That's RAG, which needs a vector database. See LLM app hosting.
- It runs its own open-weight model. See GPU servers.
- It connects to your CRM, booking or stock system through automation such as n8n.
- It handles high volumes of conversations.
Privacy and accuracy
Tell visitors they're talking to an AI, and say in your privacy notice what data is sent to the AI provider. Don't ask the bot to collect sensitive information it doesn't need. Give it a clear way to hand over to a human, such as your phone number or contact form. See UK GDPR and hosting. If you'd like dijitul's agency at dijitul.uk to build the chatbot too, call 01623 650333.
Frequently asked questions
How do I add an AI chatbot to my website?
Use a chat widget that sends messages to a small script on your own server, which calls an AI API with a key kept server-side. dijitul hosts chatbots like this on its £1 a day + VAT plan and its agency can build them.
Is it safe to put my OpenAI API key in JavaScript?
No. Anyone can read it from the page source and use it on your account. Keep the key on the server in an environment variable and call the API from PHP or Node.js. Rotate any key that has been exposed.
How much does it cost to run an AI chatbot on a website?
There are two costs: hosting and AI usage. Hosting a simple chatbot with dijitul is £1 a day + VAT. AI usage is billed by the provider per token, so it depends on traffic and model choice. Rate limits keep it predictable.
Can a chatbot answer questions from my own documents?
Yes, using retrieval-augmented generation. Your documents are indexed in a vector database and relevant passages are sent with each question. That needs more resources than basic hosting, so dijitul quotes RAG chatbots separately.
Do I need to tell visitors they are talking to an AI?
It's good practice and helps with trust and transparency obligations. Make it clear in the chat window, explain in your privacy notice what data goes to the AI provider, and offer a way to reach a person.
Can I host a Node.js chatbot backend on Plesk?
Yes. Plesk supports Node.js applications, and dijitul can set one up with environment variables for your API key. For small chatbots this runs on dijitul Complete Hosting at £1 a day + VAT.
Related
Set it up and forget about it
Managed hosting, Plesk, Cloudflare DNS, daily backups and your domain for £1 a day + VAT. We move your site for you.