Help & Support

Your Cbox embed code is available at your control panel. You need this code to install your Cbox on your website.

Also on that page is your Quick Link — a URL which you can use to access your Cbox directly in your browser or on your mobile device.

Once you have created your Cbox account, go to the Publish page of your control panel. The code and steps for embedding your Cbox are provided there for a number of common platforms.

If you install your Cbox and all you see is code, or nothing at all, your web host may be removing or otherwise interfering with the HTML iframe tags that Cbox uses. Your Cbox code needs to be pasted into an area of your site that accepts HTML without modification. This may mean switching your editor from "rich text" or "WYSIWYG" mode into HTML-editing or "raw" mode, or you may need to open your template files in a plain-text editor like Notepad.

Remember that you always have the option of posting or sharing your Cbox Quick Link — this gives visitors direct access to your Cbox in a full-screen layout, so it's perfect as a mobile option or for stand-alone use.

Go to the Theme editor in your control panel. There you can specify the fonts and colours of your Cbox, using a point-and-click editor. You can always reset your theme to one of the preset defaults there, if you would like to start again.

If you have a Premium or Pro Cbox you can edit CSS, which gives you complete control over presentation.

If you have a Premium or Pro Cbox, you can create a moderator name for yourself at your Users page, and then log in on your Cbox using the "profile" link. You will see a delete icon [x] next to each message in your Cbox, and you will not have to log in at your control panel at all to delete messages.

Alternatively, visit your Messages page to delete messages individually or in bulk. Deleted messages are removed from your public Cbox history, but are preserved in your Archives.

Yes. In the Theme editor, simply delete the colour codes for the main and form background ("BG") elements. This will make the Cbox transparent, allowing whatever is behind the Cbox to show through.

Note that any pop-ups generated by a transparent Cbox will have the default background colour — usually white. If your font colour is light, it may be invisible in popups. You can fix this by editing the CSS to introduce a background-color rule for popups.

Cbox cannot identify your visitors, but we do record IP addresses. Your Messages page makes them available to you, and you can also ban people from posting in your Cbox from that page.

If you have a Premium or Pro Cbox, you can create a moderator account for yourself here, and then ban people with one click while logged in to your Cbox. You will see [x][o] links next to each message. Clicking the [o] will ban that user.

Alternatively, go to your Messages page, select a message from the user you want to ban, and click the "Ban" link.

Your Blocked users page lists the bans currently in force. To unban someone, select the ban and click "Unban". Bans that show as "expired" will be cleared within a few minutes.

Check out the control panel. Cbox is highly customizable, and the options are arranged in the control panel into sections. Some options are only available on paid plans. These will usually be greyed-out. Upgrading will unlock these options, but will not automatically enable them.

Most changes to settings will take effect immediately, but some will require that you refresh the page that your Cbox is on. If you have embedded your Cbox on your website, you will generally not need to reinstall it. Settings that change your embed code will notify you of this.

When boxcode is disabled in Posting options, it is only disabled for user messages. You will still be able to use it for your Sticky message and Custom filtering rules.

Cbox supports boxcode, which is a way to add markup to messages. You can also use it to style your Sticky message and Custom filtering replacement text.

The boxcodes supported by Cbox are:

• [color=#ff0000]hex colour[/color] or [color=forestgreen]named colour[/color]
• [color=#f00,#ff0]foreground and background[/color]
• [b]bold text[/b]
• [u]underlined text[/u]
• [i]italicized text[/i]
• [s]struck-out text[/s]
• [q]quoted text[/q]
• [sub]_subscript[/sub]
• [sup]^superscript[/sup]
• [center]centered text[/center]
• [br]
  (line break)
• [big]larger font[/big]
• [small]smaller font[/small]
• [class=custom]custom-styled text[/custom]
• [code]fixed-width text[/code]
• [url=https://address.com/hyperlink]link text[/url] or [url]https://address.com/hyperlink[/url]
• [img=https://address.com/image.jpg]image title[/img] or [img]https://address.com/image.jpg[/img]

Combining boxcode

Besides using boxcode in Custom filtering replacement text, you can also match boxcodes in filter rules. See more.

It's possible to combine boxcode by nesting it, with some caveats:

1. Tags must be nested in the correct order: [b][u]bold underline[/u][/b] is valid but [b][u]broken[/b][/u] is not.
2. The same tag cannot be nested. For example, [class=one][class=two]some text[/class][/class] will not work. To get the intended behaviour in this case, you could have a combined class instead: [class=onetwo]some text[/class].
3. The no-attribute form of [url] (e.g. without link text), and both forms of the [img] tag, must be the innermost element in any nested sequence.

Styling boxcode

Boxcode is translated internally to HTML. You can thus affect the presentation of boxcode by editing your CSS. For example, to change the presentation of the [s] tag:

s {
	text-decoration: none; /* reset default */
	opacity: 0.2;
}

[class] parameters must start with a letter, and are limited to 20 alphanumeric characters. [class=blink] is valid but [class=2] is not.

The [class] boxcode is intended for open-ended styling. It produces a span with no default CSS. You can create a corresponding class using a cc_ prefix. For example, for blurred text, copy this to your CSS:

.cc_blur {
	text-shadow: #000 0 0 0.5em;
	color: transparent;
}

Now users can blur the text in their messages: [class=blur]this will be blurred![/class].

Find out more about custom CSS.

If you have lost your username or password, visit this page, enter your email address, and you will be sent an email with a link that you can follow to reset your login.

If you do not receive the login details you expect via email, or if you have lost access to your email address, you can contact us. Under some circumstances we are able to recover a lost account.

Visit this page, and enter your email address to have your details sent to you. Alternatively, you can enter your Cbox account name or your embed code, and we will send a reset link to the email address we have on record.

If you do not receive the login details you expect via email, you can contact us. Under some circumstances we are able to recover a lost account.

If you have installed the Cbox HTML embed code on your site, delete the code there. Then, you can close your Cbox account in your control panel at this page. Note that your account name will remain reserved on our system. If you want to create a new account with the same name, change the name on the old one before deleting it.

Unfortunately deleted messages cannot be restored to your Cbox conversation history without re-posting them.

However, if you have a Premium or Pro Cbox, all your messages are archived, including messages that were deleted. You can generate a transcript from your archive at this page.

Creating a Cbox is quick, easy, and free. Simply visit this page, and fill in the form. Your Cbox will be created instantly, and you will be able to get started right away.

Yes, you can have as many as you like! Create a separate account for each Cbox. You will need a unique account name for each, but we recommend using the same email address.

If you need a large number of Cboxes, you might want to be on our Cbox Pro plan. Cbox Pro supports channels, which are independent conversation threads. Each channel can be embedded or linked as if it were a separate Cbox, and will host a separate conversation. Channels share the same theme, settings and users, and you only need one control panel login to manage them.

These links and all other ads are removed automatically when you upgrade your Cbox to a paid plan.

This can be caused by Internet security software or other plugins or extensions installed in your browser.

For example, if you have Norton Internet Security, the Chrome browser extension that is installed with this software has been known to cause this issue. Disabling the extension will fix it. To do so, enter chrome://extensions in the browser address bar, locate the Norton extension, and disable it.

If you have McAfee Internet Security installed, your Privacy Service may be interfering with the loading of Cboxes. Try the following steps to resolve the problem:

1. Right click the McAfee icon in your system tray.
2. Select Privacy Service | Options.
3. Click on "Block Ads".
4. Uncheck "Block ads on this computer".

You can move your Cbox embed code around in your HTML to make your Cbox show up in a different place. You can also make it align to the centre or right side of the page, by editing the code a little.

Your code may include something like this:

position: relative; margin: 0 auto;

Remove margin: 0 auto; to eliminate the centering. You can replace it with float: left; or float: right; to make your Cbox move to the left or right, respectively.

To move it up or down on your page, you'll need to move the code to a different part of your layout. If you have access to the HTML of your page but don't know HTML, test different places to see which works best.

Other code variations may have different position methods, but can usually be edited in CSS. For example, the "fixed button" code includes inline CSS which controls its position on the page.

You can change your Cbox's size on the Layout page of your control panel. Simply change the values for width and height, and then save your changes. You will then be informed that your code has been updated — go to your Publish page to get your new code, to reinstall your Cbox on your website.

If the message input area in your Cbox looks wrong, or cut off, you may need to increase the "Form height" setting, also at your Layout page.

Your Cbox does not in fact have to be a fixed size. You can edit your embed code directly to introduce relative widths and heights.

Moderation is available on paid Cboxes. Messages on a free Cbox can only be deleted via the control panel only.

You can create a mod or admin name at your Users page, either by selecting one of the existing registered names and clicking the "Mod" button, or by creating a new registered user with Moderator or Administrator status using the form on that page.

To log in with a mod/admin name on your Cbox, enter the name in the "name" box, click the "profile" link at the bottom-right, and then enter the password.

After successfully logging in, you should see [x] and [o] icons next to each message in your Cbox. Clicking the [x] deletes a message, while clicking [o] bans the user that posted the message.

This can happen when you are using the same ISP as a user who was banned on your Cbox — either you are sharing an IP address, or you are being assigned dynamic IP addresses. To unban yourself, go to your Bans page and unban the most recent bans one by one until you are able to post again.

In the Date options in your control panel, there is a "Zone" setting. Click the [reset] link to have Cbox attempt to figure out the correct time zone based on your current clock time. If it's still not correct according to the example shown on that page, add or subtract 1 from the Zone number until the example time shown is correct. Your time zone may be negative or positive.

You can also change the "Date display" option to show relative timestamps — this way the clock time is not shown on your Cbox at all, but rather a relative time, such as "2 minutes ago".

We have a free plan, which will always be free, but it does not offer the full complement of features available with Cbox. Our paid plans come with plenty of good reasons to upgrade.

This may be caused by the Google toolbar's AutoFill feature. You can turn this feature off. First open the toolbar options page (click the "G" icon in the search bar and select "Manage..." from the drop-down list).

For older versions, click the More tab, and then under "Extras", untick the "Automatically highlight fields that AutoFill can fill" option. Newer versions just require that you untick the Autofill box on the Browsing tab, and still newer versions have the AutoFill option on the Features tab.

Cbox supports custom emoticons. You can add and delete emoticons at this page in your control panel.

You can control the size and other layout properties of emoticon images using CSS.

To add a new emoticon, simply click the Upload button and then select the image file, either from your device, or by pasting in a URL. Formats supported are GIF (including animated GIF), JPG, and PNG.

Each emoticon needs a shortcut code, so that users can simply type the code to insert the emoticon. This code can be anything you like, but it's recommended to use a common prefix/suffix to avoid conflicts with ordinary words in conversation. For example, :hello: will not conflict with "hello world". After clicking Save, your new emoticon(s) will be available immediately in your Cbox.

Advertising offsets the cost of providing the free version of Cbox. You may upgrade your Cbox at any time to a paid plan, which removes all the ads and the Cbox branding, and also unlocks lots of other useful features.

The user's IP address is probably changing. Cbox has a feature that allows you to strengthen bans so that certain kinds of changing (dynamic) IPs are blocked by a single ban. Cbox Pro has additional features that can pre-emptively ban users of proxies.

Go to your bans page, and select the ban(s) that are not effective. Then click the "Strengthen" button in the top-right. This will "widen the net" on the selected bans. You can click Strengthen again to widen the net even further.

Note that strengthened bans are more likely to affect other people, especially other customers of the same ISP, because they constitute a range of IP addresses. A doubly-strengthened ban covers about 65 000 IP addresses.

If you have a paid Cbox, you have access control features you should enable, including the option to require users to register their names before posting. You can also control whether your users are able to register their own names. You can disable this second option to take control over registration; simply deleting a registered user will then prevent that person from posting, regardless of IP, because they cannot register a new name.

With a Pro Cbox, you can enable "Auto-ban proxies" at your Settings page. Your Cbox will detect proxies, VPNs and Tor exit nodes and will automatically and temporarily ban users who attempt to post from behind such services.

Your Cbox is not at its full potential unless you upgrade to a paid plan.

Upgrading unlocks features like user registration and moderation, private messaging, and priority support: things essential for getting the most out of your Cbox. See our product comparison.

We offer a 30-day money-back guarantee on all purchases, so if you aren't sure it'll be worth it, you have nothing to lose by finding out.

You can also upgrade for a friend – simply enter their Cbox account name on the upgrade page instead of your own.

The most likely reason for this is that it was delayed, or trapped by a spam filter. Check your spam folder in your email client. If emails from Cbox are repeatedly being marked as spam, try adding our addresses to your email client's address book.

It's also possible the email address we have on record for you is wrong. If you know your account details, log in and check your email address is correctly spelled.

Finally, you may want to contact us from another email address for further assistance.

You need to have cookies enabled in your browser in order to use the control panel. Your browser may be configured not to accept cookies, or it may be in a "private browsing" mode, or you may have a plugin or extension that is restricting them. Test in another browser if possible.

This is normal for Cboxes that do not have many messages. The scroll bar will appear when it's required. If you want to force it to appear always, you can edit CSS, adding the following:

body {overflow: scroll;}

We accept payment via PayPal. PayPal accepts most credit and debit cards, and depending on your region, you may be able to check out without creating a PayPal account. In some regions it is also possible to pay via bank transfer ("eCheck") through PayPal.

If you have any difficulties making payment, please contact us, and we can assist.

This is usually caused by the Lock option in your Control panel. Click the "Unlock" button to return your Cbox to normal.

If your Cbox says it is expired, it will need to be renewed. After renewal it will be unlocked automatically.

The ActiveX prompt appears in very old versions of Internet Explorer if the security level setting is high. Cbox uses ActiveX in some versions of IE for refreshing and posting. However your Cbox will function fine without ActiveX if you choose to disable it. To disable the dialog, follow these steps:

1. Select Tools -> Internet Options from the menu.
2. Choose the Security tab.
3. If the Default Level button is not disabled, click it.
4. Set the Security level slider to Medium.

If that does not work, or you have set up a Custom Level, click the Custom Level button and ensure that "Run ActiveX controls and plugins" and "Script ActiveX controls marked safe for scripting" are both set to Enabled.

You can change your Cbox account control panel password at the Account details section of your control panel.

If you can't remember your current password you can request a new one at this page.

To change the password of a registered name on your Cbox, you will need to delete the registered name in question at the Users page of your control panel, and then re-register the user or allow the user to register again.

First decide whether the messages appear to be automated, or coming from an individual user.

Cbox works hard to prevent automated spam from reaching your Cbox. However if you are having trouble with such spam, you can require all users to solve a CAPTCHA before posting, by changing your CAPTCHA setting to "Strict" at your Settings page.

For spam from an individual user, first try banning the user. At your Messages page, select the unwanted messages and click "Ban". With a paid Cbox, you can ban the user from within your Cbox by logging in as a mod user.

Abusive users may attempt to evade bans by accessing your Cbox from behind an anonymizing proxy, via a VPN, Tor, or similar service. With a Pro Cbox, you can enable "Auto-ban proxies" at your Settings. You can also enable "Strong bans" there, which makes bans more resilient against changing IP addresses. However, it also increases the risk of bans affecting other users.

You can also strengthen individual bans by selecting them in your Blocked users list and clicking "Strengthen". This "widens the net" on an IP ban. Note that this can prevent other users of the same ISP from accessing your Cbox, so you should ensure the duration is short on such bans.

If you have a Premium or Pro Cbox, you have more access control options. It's recommended to always enable the option "Users must be registered to post". Normally, you would also enable "Users can password-protect their names" so that they can register themselves; for more control, you can disable this option and register users manually.

You can also choose to disable new registrations temporarily to "lock down" your Cbox. Existing users will still be able to log in and post.

Finally, if you disable the option "Users can password-protect their names" you can still enable "Users can authenticate via Facebook" — now new users can join your Cbox via Facebook, but if they are banned then their Facebook identity is also blocked.

Some other things you can do if you experience recurring abuse of your Cbox:

• Delegate moderator authority (Premium and Pro) to trusted users who are able to monitor your Cbox during times you are not.
• Use Moderated Chat mode (Pro) to prevent users posting directly to public chat. Their messages will need to be approved by a mod.
• Place your Cbox in a members-only or private area of your site, such that users must log in to your site before they can see your Cbox.
• Implement User Integration (Cbox Pro), which ensures that only users who are registered on your own site can post.
• Configure and enable the Site whitelist (Premium and Pro). This prevents your Cbox embed code from being displayed on any other site.
• Generate a new Security tag and republish your Cbox embed code. This revokes access for any user who may have a link to your Cbox but no longer has access to the page it is embedded on.
• Disable the Quick link. This will prevent users from being able to access your Cbox except via the page you have embedded it on.

Finally, if abuse continues, you should contact us. We want to keep all Cboxes free from spam and abuse, and will do what we can to assist.

The account name that you log in with at the Cbox control panel is also your Quick Link address. You can change your account name at the Account details page. This will change your Quick Link address at the same time.

If you have forgotten your account name and are unable to log in, you can reset your password at this page.

By default, Cboxes embedded on MyLeague.com are integrated with your MyLeague userbase. This disables the "name" and "email / url" boxes on your Cbox, and automatically assigns usernames and avatars to members who are signed in on MyLeague. Non-members and members who have not signed in are given the name "Guest."

If you would prefer to use Cbox's built-in user features, so that your visitors must specify their names themselves, you can do that by choosing a different Cbox code variation — choose "Inline (default)". Then a new embed code will appear, which you will need to copy-and-paste over your old Cbox code in your MyLeague page.

Then Save and refresh your page and you should see the "name" box on your Cbox. You will now have access to all User and Access Control features.

You can downgrade from Pro to Premium at your control panel. Your Pro features will be disabled automatically.

If you let your Premium plan lapse, it will not automatically revert to a Free Cbox. Your messages and settings will be saved but your Cbox will be locked. You will be able to renew at any time reactivate it. To get back on the Free plan, simply sign up for a new Cbox, using a new Cbox name.

If our service is not meeting your expectations on any plan, please contact us and we will do what we can to improve your experience.

First try recovering your password. If your account is not found or you do not receive the email, the account may have been closed.

Cbox reserves account names for some time after an account is closed. If you want to use the same account name, we can sometimes assist if you contact us.

Renewal is straightforward — it's the same process as for upgrading, at this page.

When you renew, your paid term is extended with the additional time that you purchase, and if you have any remaining credit, it is carried forward. So for example, if you have 20 days remaining, and you purchase an additional six months, you will have six months plus 20 days' credit after renewal.

This is the message that shows when your Cbox is accessed from an address other than the one specified at your Publish page, when you have the option "Allow access only at this address" enabled.

A common reason for this to happen is that you have entered an address that is more specific than it needs to be — for example, including the "www." at the beginning when your visitors don't need to include that to reach your website. Most of the time "mysite.com" works just as well as "www.mysite.com", but if you have specified "www.mysite.com" as the only address to allow access at, then Cbox will show an error when you arrive at your site via "mysite.com".

The solution is to simplify the address so it covers all the legitimate routes to your page, or turn off the option "Allow access only at this address."

The option "Enable site whitelist" at your Publish page will prevent other websites from displaying your Cbox to their visitors.

When using this option, ensure the web address we have on record (also on that page) is the simplest possible address for your site. For example you should generally not include the "www." part nor any trailing path, like "/index.html".

With a paid Cbox, you can enable the option "Users must be registered" at the Users page in your control panel.

If you are using Integration, then there are two ways to disable access for a particular user. The easiest is to register the "Guest" name, then immediately ban it.

You can also invalidate names in your Integration code. For example, use a conditional and clear the nme and nmekey parameters:

<?php
if ($nme == "Guest") {
  $nme = "";
  $nmekey = "";
}
// The rest of your Integration code goes here...
?>

The Sticky message accepts boxcode, even if you have not enabled boxcode for ordinary messages. So to post a link, enter the following:

[url=https://mysite.com]This is a link[/url]

You can post an image as well:

[img=https://mysite.com/path/to/image.jpg]Description[/img]

See this article for a complete boxcode reference.

You can enable avatars for your Cbox at your Posting options page (under "Message options").

Once enabled, your users can upload their chosen images to any image hosting provider, and then enter the link to them in the email / url input box of your Cbox. Any URL ending .gif, .jpg or .png will be accepted.

Note that if you are accessing your Cbox over HTTPS, then your users' avatars will need to be hosted at a provider that supports HTTPS; otherwise, the browser will not show them.

Avatars will be resized by the browser. You can change the size of avatars with Premium Cbox by editing the CSS. The class that controls avatars is called .pic. Edit the width and height properties to change the dimensions.

To integrate avatars with your user system, see Extended Integration at your User Integration page.

Yes. This will work if they are different Cboxes. If you want to show the same Cbox more than once on the page, you will need to make a small change to the embed code for each additional embed.

In your Cbox embed code you will see something like name="cboxmainA-123456" id="cboxmainA-123456" — this uniquely identifies the Cbox so that its frames can communicate with each other. The A-123456 part appears four times in total in the standard embed code. Edit it, simply adding a dash and a serial number, to make it A-123456-2, for example.

Cbox Premium and Pro allow you to customize the four built-in usergroup name colours at your Themes page. The group colours you can specify are Normal, Registered, Moderator, and Admin. These correspond to the user types at your Users page.

In addition, you can use Filtering rules to specify unique styles for selected names, including unregistered ones. To do this, add rules as follows, one per line:

jacob:[color=green]jacob[/color]

In the above example "jacob" is the name of the user. You can change the colour to any valid HTML colour name or hex code. You will need to have boxcode enabled in order for this to work.

Custom CSS-based rules

For registered users you can create custom CSS to target their names or messages by ID. For example:

.msg[data-uid="123456"] .nme {
    color: red;
}

The data-uid is the registered user's Cbox ID. The easiest way to get this is to click the user's name in your Cbox. An at-tag will appear in your message input box, e.g. <@123456|ExampleUser> where the number after the @ is the user ID.

When you ban a user in your Cbox by clicking the [o] ban button, or at your Messages page, Cbox will ban the name as well as the IP address.

You can also prevent a name from being used by reserving it. To reserve a name, register it at the Users page, without a password. Nobody will be able to log in with this name. If it is already registered, delete the name and re-register it with a blank password.

Check that your Quick Link is enabled at your Publish page, and confirm that you have the correct URL for it.

Check that sound notification is enabled at the Settings page of your Control Panel.

If it is enabled, then you should see a volume control button in your Cbox. Clicking this will toggle through three levels. It will also play the sound on each click to confirm the level.

If you are using a custom sound, ensure that you have uploaded both OGG and MP3 versions of the file. Cbox chooses which one to load based on the browser's capabilities.

If you still cannot hear the sound, then there may be a problem with your browser or system. Please contact us for further assistance.

You can register a bot user at your Users page. Bot users are like ordinary registered users, except that instead of a password they are issued an access token. You cannot log in via the normal profile dialog. Instead, you can use the token directly in HTTP requests to Cbox.

We do not currently support an official API, but to demonstrate how you might read and post to your Cbox using a bot, the proof-of-concept PHP script below takes a simple HTTP-based approach. Run this script on your own server, and your bot will post to your Cbox. After its initial message, it will poll for messages containing trigger words, to which it will respond.

You can run the script from a shell, or have it run automatically with a crontab entry. When it's running, test it by entering a message in your Cbox such as "hello bot", "time?", or "what is the weather in new york?"

#!/usr/bin/php
<?php
define('LISTEN', true);
define('PID_FILE', './cboxbot.pid');

// Edit these lines for your Cbox and bot user. 
$box = array('srv' => 7, 'id' => 1, 'tag' => 'bOxTag');
$bot = array('name' => 'mybot', 'token' => 'XJC-bottoken-asKC', 'url' => '');
$msg = 'Hello world!';


$callmap = array(
	'/\bhello bot\b/iu' => 'bot_greet',
	'/\btime\?/iu' => 'bot_time',
	'/\bweather in ([a-zA-Z-0-9 ,]+)/iu' => 'bot_weather',
);

// Basic reply
function bot_time ($msg) {
	return date("M d Y H:i:s");
}

// An example incorporating message data. 
function bot_greet ($msg) {
	return "Hello ".$msg['name'];
}

// An example calling an external API
function bot_weather ($msg, $matches) {
	$place = $matches[1];

	if (!$place) {
		return;
	}

	$query = 'select * from weather.forecast where woeid in (select woeid from geo.places(1) where text="'.addslashes($place).'")';

	$url = 'https://query.yahooapis.com/v1/public/yql?q='.urlencode($query).'&format=json&u=c&env=store%3A%2F%2Fdatatables.org%2Falltableswithkeys';

	$out = file_get_contents($url);

	if (!$out) {
		return;
	}

	$wobj = json_decode($out);

	if (!$wobj->query->results) {
		return;
	}

	$cond = $wobj->query->results->channel->item->condition;
	$desc = $wobj->query->results->channel->description;

	return "[b]".$cond->text." ".$cond->temp."F [/b] (".$desc." at ".$cond->date.")";
}


// Do not edit past this point. 

set_time_limit(0);


$id = cbox_post($msg, $bot, $box, $error);

if (!$id) {
	echo $error;
}
else {
	echo "Posted ID $id\n";
}

if (!LISTEN) {
	exit;
}

// Synchronization.
// PID file is not removed on exit, but it is unlocked. A locked file indicates a running process.
$fp = fopen(PID_FILE, 'a+');

if (!flock($fp, LOCK_EX | LOCK_NB)) {
	echo "Could not lock PID file. Process already running?\n"; 
	exit;
}

ftruncate($fp, 0);
fwrite($fp, posix_getpid()."\n");
fflush($fp);

do {

	$msgs = cbox_get_msgs($id, $bot, $box);

	if (!$msgs || !is_array($msgs)) {
		sleep(5);
		continue;
	}

	$id = (int)$msgs[0]['id'];

	for ($i = 0; $i < count($msgs); $i++) {
	
		if ($msgs[0]['name'] == $bot['name']) {
			continue;	// Ignore bot's own messages.
		}
	
		$msgtext = $msgs[$i]['message'];
		
		foreach ($callmap as $expr => $func) {
			$matches = array();
			
			if (preg_match($expr, $msgtext, $matches)) {
			
				$reply = call_user_func($func, $msgs[$i], $matches);
				
				if ($reply) {
					cbox_post($reply, $bot, $box, $error);
				}
			}
		}
	}
	
	sleep(2);
} while (true);


function cbox_get_msgs ($id, $user, $box, &$error = '') {
	$srv = $box['srv'];
	$boxid = $box['id'];
	$boxtag = $box['tag'];
	
	$host = "www$srv.cbox.ws";
	$path = "/box/?boxid=$boxid&boxtag=$boxtag&sec=archive";
	$port = 80;
	$timeout = 30;

	$get = array(
		'i' => (int)$id,
		'k' => $user['token'],
		'fwd' => 1,
		'aj' => 1
	);	

	$req = '';
	$res = '';
	
	foreach ($get as $k => $v) {
		$path .= "&$k=".urlencode($v);
	}
	
	$hdr  = "GET $path HTTP/1.1\r\n";
	$hdr .= "Host: $host\r\n\r\n";
	
	$fp = fsockopen ($host, $port, $errno, $errstr, $timeout);

	if (!$fp) {
		$error = "Could not open socket: $errno - $errstr\n";
		return;
	}

	fputs ($fp, $hdr);
	
	while (!feof($fp)) {
		$res .= fgets ($fp, 1024);
	}
	
	fclose ($fp);

	if (!$res || !strpos($res, "200 OK")) {
		$error = "Bad response:\r\n $res";
		return;
	}

	$matches = array();

	preg_match_all('/\n([^\t\n]*)\t([^\t]*)\t([^\t]*)\t([^\t]*)\t'
.'([^\t]*)\t([^\t]*)\t([^\t]*)\t([^\t]*)\t/', $res, $matches);

	$msgs = array();

	$map = array('id', 'time', 'date', 'name', 'group', 'url', 'message');

	for ($m = 0; $m < count($map); $m++) {
		for ($i = 0; $i < count($matches[$m+1]); $i++) {
			$msgs[$i][$map[$m]] = $matches[$m+1][$i];
		}
	}

	return $msgs;
}


function cbox_post ($msg, $user, $box, &$error = '') {
	$srv = $box['srv'];
	$boxid = $box['id'];
	$boxtag = $box['tag'];
	
	$host = "www$srv.cbox.ws";
	$path = "/box/?boxid=$boxid&boxtag=$boxtag&sec=submit";
	$port = 80;
	$timeout = 30;

	$post = array(
		'nme' => $user['name'],
		'key' => $user['token'],
		'eml' => $user['url'],
		'pst' => $msg,
		'aj' => '1'
	);	

	$req = '';
	$res = '';
	
	foreach ($post as $k => $v) {
		$req .= "$k=".urlencode($v)."&";
	}
	$req = substr($req, 0, -1);
	
	$hdr  = "POST $path HTTP/1.1\r\n";
	$hdr .= "Host: $host\r\n";
	$hdr .= "Content-Type: application/x-www-form-urlencoded\r\n";
	$hdr .= "Content-Length: ".strlen($req)."\r\n\r\n";
	
	$fp = fsockopen ($host, $port, $errno, $errstr, $timeout);

	if (!$fp) {
		$error = "Could not open socket: $errno - $errstr\n";
		return;
	}

	fputs ($fp, $hdr.$req);
	
	while (!feof($fp)) {
		$res .= fgets ($fp, 1024);
	}
	
	fclose ($fp);

	if (!$res || !strpos($res, "200 OK")) {
		$error = "Bad response:\r\n $res";
		return;
	}

	$matches = array();

	preg_match('/1(.*)\t(.*)\t(.*)\t(.*)\t(.*)\t(.*)/', $res, $matches);

	$err = $matches[1];
	$id = $matches[6];

	if ($err) {
		$error = "Got error from Cbox: $err";
		return;
	}

	return $id;
}
?>

At its simplest, the Custom filter is a list of words that you want hidden or replaced in your Cbox. Enter words, one per line, and if a user's name or message contains that word, it will be filtered out.

badword
badderword:betterword

When a message is applied to the above filter, "badword" will be turned into asterisks, and "badderword" will be replaced by "betterword". The ":" (colon) character separates the pattern text from the replacement text. If the colon is left out, the entire line is the word to match.

Filters can be useful for more interesting things too, however.

Styling and aliasing names

You can set colours for admins, mods and registered users on your Themes page, but you can create individualized filters for particular names or words you want to highlight.

jacob:[color=green]TheRealJacob[/color]

This user would still enter "jacob" as his name in your Cbox, but whenever he posts, or whenever someone mentions him in a message, the output will be TheRealJacob, in green.

If you want to apply style besides colour to names, you can use the [class] boxcode.

jacob:[class=vip]{$0}[/vip]

You will then need to define your custom CSS for this class.

Using and disabling boxcode

Boxcode itself can be customised, making the combination of filtering and formatting very powerful. See more.

Your custom filtering rules support boxcode, as seen in the example above, even if you have boxcode disabled for messages in your Settings. You can also match the boxcode that people use (or attempt to use) in their messages.

![br]:/
haiku:The moment two bubbles[br]are united, they both vanish.[br]A lotus blooms.

The first rule will match "[br]" appearing in messages, and replace it with a slash. But the [br]s that appear in the second rule will still work, creating line breaks, because each replacement string is boxcode-filtered independently.

If boxcode is enabled for messages, then you can create aliases and compound boxcode using partial (open) tags:

![red]:[color=#f00][b]
![/red]:[/b][/color]

When a user enters [red]this is red[/red], the filter translates this to [color=#f00][b]this is red[/b][/color], which is now valid boxcode, and will in turn become HTML.

Tip: If a rule isn't matching when it should, try putting ! at the start of the line. If a rule is matching when it shouldn't, try putting ~ at the start of the line.

Filter modes

By default, filter rules are matched anywhere that the search text is not surrounded by other letters. Starting a line with the prefix "!" (exclamation mark) makes the rule a simple substring filter instead. Such rules are stronger in the sense that they will match in more contexts. However, unintended substitution is also more likely.

By contrast, a rule that begins with "~" (tilde) is only matched when preceded by space and followed by space or punctuation. This is similar to how emoticon substitution works. Such rules are looser in the sense that they are only matched in this specific form. Unintended substitution is less likely, but the rule may not be triggered as easily as desired.

fred:Fred
!color:colour
~plane:✈

In this example, the first rule will match the "fred" in "@fred" and "(fred)", but not in "freddy" or "alfred". The second rule will match "color" as well as "colorful" (substituting "colour" and "colourful" respectively). The third rule matches only "plane" by itself or followed by punctuation.

Filter order

Names and messages are filtered first by your custom rules. Messages are then parsed for smilies, boxcode, and links, in that order, if you have these features enabled. Names do not have these built-in filters applied.

Within your custom filter itself, the order of rule-matching is from top to bottom.

hi:hello
hello:goodbye

If a user posts "hi!", then as the message passes through the above rules it will be translated first to "hello!", and then, because it now matches the second rule, it becomes "goodbye!". In general, whenever a rule matches something that appears in another rule's replacement text, the order matters, and earlier rules can influence the effect of later ones. It's not recommended to depend on this behaviour, however. To create internal shortcuts, use variables.

Variables

A line beginning with a "$" (dollar sign) defines a variable that you can use in subsequent replacement text:

$pre:[big][color=#ff0000]
$suf:[/big][/color]
jane:{$pre}Jane{$suf}
john:{$pre}{$0}{$suf}

The first two lines do not match any name or message text; they define variables representing the strings following the colon. Variables are written in to the replacement string by surrounding them with braces. Variables in replacement text are expanded before filtering itself is applied to messages. The variable $0 is special: it contains the text that matched.

Cbox supports private messaging to and from mod and admin users. You can enable PM for your Cbox at your Settings page.

You can also type out the PM command: enter //pm username message..., where username is the name of the person you want to send your message to. This method works if the username conforms to Cbox "strict name" or "ASCII name" policy, i.e. comprises alphanumeric characters only and includes no spaces. Otherwise, you will have to refer to the user by ID.

By default, ordinary users cannot send PMs to other ordinary users. One of the two participants in any private conversation must be a mod or admin.

Opting in and out

Registered users can opt in to sending and receiving private messages from other registered (non-mod) users, by entering //pm on. The command //pm off revokes this availability.

Errors on sending

Private messages can fail to send for a number of reasons. If you get an error, it will likely either be due to the target user not being online (see below) or due to policy regarding who can send and receive private messages (see above). If the target user is not online, you may need to wait just a few seconds before retrying. Refer to the onliners list to confirm whether Cbox recognizes the user as present.

Message delivery

Private messages are sent via the streaming interfaces. The target user must be viewing and connected. Users on old browsers or restricted networks may not be able to receive PMs. When your message has been accepted by our servers for relaying, you will see an indicator (by default, a tick symbol). When the message has been received by the target user, the indicator will change (double-tick symbol). If that doesn't happen, your message probably wasn't received. Note that Cbox does not know that a message has been read, only that it has been delivered.

Persistence

Cbox does not store private messages for future delivery. New messages are relayed only if the user has an active connection. If the user has gone offline or is otherwise unable to receive your message, it will not be sent again, and nor will it be seen by that user when he reconnects. If you do not see the two-tick "received" indicator within a few seconds of sending a message, you will need to re-send your message later.

There are a number of commands you can enter in your Cbox to perform actions that would otherwise require a tap or click, or that are not available through other means.

Note that commands are not formally supported by Cbox, and are liable to change, or not to function, at any time.

Enter commands as if they were messages in your Cbox:

• //debug [watch] — shows debugging information.
• //reload [clean] — refreshes the Cbox iframe. Enter //reload clean to clear local data. (This will log you out and reset preferences.)
• //ignore joe — ignore the user joe. Leave out the name to get a list of currently-ignored users. Repeat the command with an ignored name to un-ignore that person.
• //pm mary hello! — sends hello! to the user called mary. (Requires private messaging to be enabled.)
• //colors — open a colour palette to change your message text colour (requires boxcode to be enabled.)
• //tetris, //sudoku, //wordsearch game-id — for wordsearch, invite another user to enter the same command, with the same game-id, to join your game.

Yes – Cbox is delivered over HTTPS by default.

If you are using an older version of the embed code, you may need to modify it slightly to ensure your Cbox is delivered over HTTPS. Simply replace the instances of src="http://..." with src="https://...".

If you are using Cbox over SSL, it's possible to get mixed-content warnings if you have any third-party resources on your Cbox that are not delivered over HTTPS – for example, user avatars, emoticons, or notification sound effects. These URLs should start with https:// or // to avoid warnings. Warnings will generally not interfere with functionality, but they may cause your browser's security indicator (often a padlock icon) to change.

The "Welcome to Cbox" message appears if there are no other messages to display. You can disable or change it simply by posting a Sticky message.

Note however that the Sticky message differs from the Welcome message in that it remains visible on your Cbox even after other messages have been posted.

We've recently launched a new version of Cbox with an entirely new interface. By going back to the basics and building a modern UI, we have created a more flexible, accessible platform to support future development.

Some of the things that have been improved in the new Cbox:

1. Mobile responsiveness. We've enlarged the buttons and done away with popups; overlays keep all functions in the Cbox itself.
2. Message history. Simply scroll back to load older messages.
3. Registration and login. It's clearer and quicker to register a name and log in with it.
4. Avatars. Users can upload pictures from within Cbox. No need to copy-paste URLs.
5. Themes. The new Cbox supports more fonts and more colour options.
6. Embedding. The embed code has been simplified to support more platforms.

Migrating to V10

If you already have an older Cbox, you can get the latest version by creating a new Cbox on your account. While it's not possible to transfer your data and settings automatically, we can transfer any paid credit balance if you decide to switch over to your new Cbox: simply contact us to request a transfer.

Cbox Pro provides a very simple API for creating new channels on the fly.

At the Channels page in your control panel you will find your secret API URL. You can open this URL directly in your browser to test it, but it's intended to be called by back-end scripts running on your own site.

The return format for this call is a single line of tab-separated plain-text fields. If there was an error, the first field is "FAIL" and the second field is an error code. If a new thread was successfully generated, the first field is "OK", and the second and third fields are the thread ID and thread key, respectively.

By way of example, this very simple PHP script will generate threads for your Cbox. New threads created via the API will show up in your control panel, but you should store the thread ID and key in your own database as well.

<?php 
$cb_tid = null;
$cb_tkey = null;

$cb_rs = file_get_contents('YOUR_API_URL', 'r');

$cb_rp = explode("\t", $cb_rs);

if ($cb_rp[0] === 'FAIL') {
	// There was an error. 
	// $cb_rp[1] contains the error code
}
else if ($cb_rp[0] === 'OK') {
	// Success
	$cb_tid = $cb_rp[1];
	$cb_tkey = $cb_rp[2];
}
else {
	// Some other error occured.
}

if ($cb_tid && $cb_tkey) {
	// New key generated. Store $cb_tid and $cb_tkey in your database or user session.
	// And insert them into your Cbox HTML code iframe src URLs: 
	// ....&sec=main&tid=<?php echo $cb_tid;?>&tkey=<?php echo $cb_tkey;?>
	// ....&sec=form&tid=<?php echo $cb_tid;?>&tkey=<?php echo $cb_tkey;?>
}
?>

You need some development experience to make use of this feature, with the ability to edit your site's back-end code.

Cbox Pro supports Integration, which is a way to implement single sign-on. If users already log in or register with your site, Integration means they don't have to enter their name again on your Cbox.

Configure Integration at your control panel. Example code is available there. The rest of this article deals with general concerns.

How it works

Integration is implemented using query string parameters appended to the Cbox iframe URL. The final parameter is a signature generated from the rest of the URL. You don't need any external components or callbacks, just language support for HMAC-SHA256, base64-encoding, and url-encoding.

The signature is important to secure the generated URL against tampering by the user or any other intermediary. However, most back-end platforms have built-in support for the necessary functions.

Integrating avatars and profile links

The only required parameter is nme, for the user's name, and the signature, sig. But you can also pass lnk and pic parameters to Cbox, to take advantage of name links and avatars, respectively. These should be provided as absolute URLs. For example, https://yoursite.example.com/path/to/image.gif. Note that the respective display settings need to be enabled for name links or avatars to show up.

Integrating with mod/admin permissions

Integrated users' names will be registered with Cbox automatically, if they aren't already. This means you can confer mod/admin permissions at your Users page.

You can also use Integration with Moderated chat. With Moderated mode enabled, your Integrated users by default will not have voice permission. You will be able to review their messages as a mod or admin user in your Cbox and approve them accordingly.

Security

Note that if you have existing users registered before enabling Integration, they are authenticated by Integration regardless of their password. This means if you have an existing "admin" user registered with a password on your Cbox, and you then enable Integration, the corresponding user named "admin" on your site will get that name (and permission). This can be an advantage, but if it's a risk in your case, delete all registered users before enabling Integration.

The signature in the Integrated Cbox URL protects the name and other information in transit. However, if you are concerned about leaked URLs, you can limit URL validity by passing an additional (signed) query string parameter, valid_to, which should be set to a UNIX timestamp. The URL will stop working after the time specified.

You can also change the key used to generate the signature, by changing your security tag. This invalidates all your Cbox URLs, but requires that you change your published Cbox embed code accordingly.

Debugging

If you get an error in your Cbox saying that there's a problem with Integration, the most common cause is an invalid signature.

The first thing to do is right-click and inspect the Cbox iframe URL. You should have nme=...&sig=... parameters populated in the query string. If not, check that your embed code is in place and being parsed without errors.

If the sig parameter is present in the URL, confirm that it is being generated using the correct secret key. The key is available at your Integration page.

Ensure that you are url-encoding your query string parameters exactly once, and encoding before calculating the signature. The signature itself must then also be url-encoded, and appended to the URL. If you see the sequence %25XX in the URL, that's a sign that you might be applying url-encoding to already url-encoded strings.

If you are still getting errors, contact us including the code you are using and an example URL, and we should be able to assist.

Cbox provides a Theme editor that lets you adjust colours and font sizes. With a paid plan though, you get even more flexibility with our CSS editor.

Please note: Editing CSS is an advanced feature and requires some knowledge of the language. Improperly-formed CSS can make your Cbox unusable. You can find many useful CSS resources on the Web.

Some of the things you can do with custom CSS:

• Change colours and dimensions that aren't available in the theme editor.
• Add effects such as shadows, borders, and gradients.
• Change the layout of messages by adjusting positioning.
• Create custom classes for styling names and parts of messages, in conjunction with [class] boxcode and filtering.

Getting started

The class names and IDs that we use are relatively stable. However, while we always aim to minimize disruption, it is possible — due to new features or bugfixes, for example — that we have to change HTML in ways that require updating your CSS.

We recommend using your browser's built-in development tools to assist you in finding the names of elements and classes to edit. Generally, you can right-click on an element in your Cbox, and select "Inspect".

In the new version of Cbox, the CSS you enter in your editor is appended to the base CSS. This means you do not have to copy any classes or properties that you are not editing. For example, to make avatars round, simply use:

.pic {
    border-radius: 50%;
}

Notice that the other properties, such as width and height, are not affected by this CSS. Any properties that are bound to the basic theme editor can still be edited that way. We strongly recommend this approach — rather than copying the base CSS and then editing it — for both performance and maintainability reasons.

More examples

By default a star icon appears after mod/admin names. You can change or remove that:

.msg.Adm .nme:after, .usr.Adm .nme:after,
.msg.Mod .nme:after, .usr.Mod .nme:after {
    content: '';
}

You can use the :after pseudo-element to add text as well. This puts a colon after each name:

.msg .nme:after {
    content: ':';
}

You can also change the colour of mod/admin text or messages to distinguish them:

.msg.Adm {
    background: #FFEB3B;
    color: #000;
}

The following CSS will make the name and message run together without a line-break between them:

.msg .body {
    display: inline;
}

Certain buttons in the UI can safely be removed using CSS. For example, to remove the "pop out" button:

#btnPop {
    display: none;
}

You can use CSS to create a default profile picture:

.pic.Empty {
  background: url(https://cbox.im/i/zfqhv.c100.png) no-repeat center center;
  background-size: 100%;
}

You can take advantage of CSS's cascading nature to target different rules at the same element in different contexts. For example, to show rounded avatars in the users list, but hide them completely in messages, you could use a pair of rules:

.msg .pic {
    display: none;
}
.usr .pic {
    border-radius: 50%;
}

To change or remove the maximum height that Cbox restricts your emoticons to, you can use a rule like this:

.msg .emote {
    max-height: none;
}

The following rule makes message background colours alternate:

.msg:nth-of-type(2n) {
    background: #03A9F4;
}

With CSS you can influence browser functionality as well. The following CSS prevents users from being able to select text in messages:

.msg {
    user-select: none;
}

Custom classes

You can define your own classes to be used in conjunction with filters. Filters support boxcode, so you can apply colour that way. But for more flexibility, there's a special [class] boxcode that lets you use any CSS you want.

For example, this CSS rule targets a class called cc_glow.

.cc_glow {
    text-shadow: 0px 0px 3px #E91E63;
    font-size: 120%;
}

With the above CSS, the corresponding boxcode is [class=glow][/class].

So to use your CSS, you could add a filter rule like this:

hello:[class=glow]hello[/class]

With both the CSS and the filtering rule in place, simply typing hello in your Cbox should show glowing text.

You can also override existing boxcode rather than defining your own classes:

.msg .body s {
    text-decoration: none;
    opacity: 0.5;
}

The above modifies the [s][/s] boxcode which would normally produce a strikethrough. Instead it will produce translucent text. The .msg .body selectors are there to ensure only markup in messages is targeted.

Specificity

Sometimes you might find your edits don't appear to be overriding Cbox's base CSS. This can be due to CSS Specificity rules. You may need to add specificity by including more parts in your selectors. For example, to change the colour of the smilies/emoticons button, you can use:

form#frmMain button#btnSmilies {
    color: red;
}

Notice that while the form#frmMain part might seem redundant, it increases specificity sufficiently to override Cbox's base CSS. Alternatively, you can use the !important rule to achieve the same outcome.

While !important can make customization easier, we don't recommend using it, as it increases the likelihood of unintended side-effects.

button#btnSmilies {
    color: red !important;
}

Cbox has traditionally supported HTML in filters and sticky messages for paid accounts. For security reasons this option is not enabled by default. Furthermore, in HTML mode, some other features of Cbox may be limited or disabled.

If HTML mode is disabled on your Cbox, then you can add markup and colour to your filters and stickies using boxcode, which supports a range of HTML-like tags.

If you are currently using HTML mode, we strongly recommend disabling it and using boxcode instead — this will help to ensure that your Cbox is as secure as possible and compatible with all features.

Getting started

This feature requires some familiarity with hosting your own scripts on the Web. Our code examples are in PHP, but you can use any platform and programming language you like, providing you can access HTTP POST data.

The Cbox webhook is an HTTP POST callback mechanism for getting a copy of new messages as they are posted to your Cbox. A couple of lines of PHP are sufficient to get started:

<?php
$input = @file_get_contents("php://input");
$json = json_decode($input);

// $json contains array of messages

error_log(print_r($json, true), 1, "your-email@example.com");

echo "OK";
?>

With the above code uploaded to your server, test that it works by opening the corresponding URL, e.g. https://yoursite.example.com/cbox.php, and confirming that you see "OK". You can then enter it as your callback URL in your Cbox settings.

When a user posts a message, Cbox will issue an HTTP POST request to your callback URL, with Content-Type application/json. The request body will look something like this:

[{"type":"message","box":802140,"channel":0,"time":1488526982,"uid":0,"name":"test","text":"this is a test","link":"","ip":"0.0.0.0"}]

The object is an array of messages. There can be multiple messages in a single POST. Your code can do whatever you like with the messages; it just needs to return an HTTP OK status to Cbox. Any response body is ignored.

Message contents

The message webhook is located after the message-accepted stage and before filtering. This means your endpoint will only receive messages that are being published on your Cbox (i.e. not messages from banned users). They will be "raw", having none of the built-in or custom filters applied (i.e. no boxcode expansion). Important to note is that messages can contain any UTF-8 character, and so should be escaped as appropriate before storage or display.

Message properties:

• type — always set to "message"
• box — your Cbox ID.
• channel — The channel ID to which the message was posted.
• id — The message ID.
• time — Unix times when the message was received.
• uid — Registered user ID. Guest IDs are undefined or zero.
• name — The user's name, as entered.
• text — The text of the message, as entered.
• link — Link associated with the message; the profile URL.
• ip — IP address of the user.

Errors and retry

Your endpoint needs to return an HTTP success header (status codes in the 2XX range) in response to the POST. If it returns any other status, or times out, Cbox will consider the delivery to have failed. On failure, Cbox will buffer messages for retry. Cbox will retry the POST at increasingly long intervals, even in the absence of further new messages.

Cbox buffers are not unlimited; if your endpoint is down for an extended time, the oldest messages may be dropped.

Notes

• Cbox ignores the body sent in response to the POST, and does not wait for it to complete.
• Return a 200 OK to Cbox as quickly as possible. Otherwise, there is a risk of a timeout, which will cause the same message(s) to be re-sent. If your message processing is slow, move it "offline", either by completing and flushing the HTTP response early and continuing to work, or by offloading incoming messages to another service.
• For forwards-compatibility, confirm that type == 'message' in your code; new event types may be supported in future.
• The box and channel properties mean you can multiplex several Cboxes to a single endpoint, and filter or switch based on channel.
• Message ID is a monotonically increasing number. Larger IDs are always newer messages.
• Although some properties are 32-bit integers, it's recommended that you treat all values as UTF-8 strings for storage or further processing.
• The POST request includes a custom HTTP header, X-Cbox-Time which contains the Unix timestamp at the moment the POST was sent. You can use this to calculate differential message times.

We're excited about this feature, but please note that the technology that supports it is relatively new; there are some limitations and there may be some disruptions as we work on it in future.

You will often want to know when a message has been posted on your Cbox while you have been away from the chat. Today on Android smartphones and tablets using Chrome browser, and for Chrome on the desktop, it's possible to subscribe for push notifications for Cbox messages.

This feature is only available to paid Cboxes, at your Quick Link, and for technical reasons it's only available when the page is loaded over SSL/TLS. Your browser address bar should start https://my.cbox.ws/[your_Cbox_name]

Note: If you accidentally click "deny" to the browser permission request, you will need to reset your browser's privacy settings: in Chrome, delete the Cbox entry at chrome://settings/content under "Notifications" -> "Manage exceptions..."

If you see the bell icon at the top right, you are all set: click or tap the bell to subscribe. The first time you do this, your browser will ask permission to send you notifications on behalf of Cbox. Once we have subscribed you, the bell icon will change — you can click it again to unsubscribe from this Cbox.

Once you are subscribed for notifications, you will receive messages in your device's notification bar whenever new messages are posted to your Cbox. This will work even if the tab is closed. On desktop, Chrome may need to be running but you will not need to have Cbox open in any window.

You can have multiple subscriptions for different Cboxes and you will receive notifications for each. We combine notifications for channels and also rate-limit them to minimize potential disruption.

We are looking forward rolling this important feature out to more browsers and devices in future. Your feedback is invaluable during this process — let us know what you think.

If you are a paid customer with a recurring payment profile (or subscription) at PayPal, then you can cancel it at any time. Your Cbox will not automatically be closed and if you have remaining credit it will continue to work. You will be able to upgrade or renew again manually — this is useful if you want to switch to a longer term.

Cancel an active payment profile with the following steps:

1. Go to PayPal.com and sign in.
2. Go to "Activity" for your transaction history.
3. Search for the email address "paypal@cbox.ws".
4. You should see your latest payment to Cbox. Click to view its details.
5. Locate the link to the profile or subscription on the payment details page.
6. From the recurring profile details, you will be able to cancel your subscription.

If you do not see a link to the profile or subscription from the payment details page, then it may have been a one-off payment with no associated automatic billing.

We don't automatically throttle or curtail access to Cboxes that go over their hits or messages per day limits.

However, our resources are shared between all customers. During high demand, Cboxes which have high concurrency (users online) may experience temporary interruptions or unavailability.

For this reason, we advise that if your Cbox consistently exceeds the daily views/messages thresholds, you upgrade to a plan with higher capacity, or contact us if you are unsure of your requirements.

Your Cbox is also limited in the total number of messages it can store. When you reach this limit, the oldest messages are removed from the public history. If you have a paid plan, you can still retrieve messages up to three months old via your archive page.

A Moderated Cbox requires that messages be manually approved before they are published.

Normally, all users can post to your public Cbox, and everyone can see their messages. If you enable Moderated chat, then only voiced users can post directly. Unvoiced users' messages are redirected to a special channel where moderators can view and approve them.

This setting enables proactive moderation. It's important if you are concerned about your platform's brand but still want your Cbox to be publicly-accessible. It's also useful if you host live chats where you may want to control the volume and relevance of published messages by accepting only the ones you want, and at the appropriate time.

Using Moderated chat

For testing, it's helpful to open another instance of your Cbox in an incognito/private tab. This allows you to log in as a guest in one tab and as a Mod in the other.

When you enable this setting, a shadow channel is created. Regular users cannot access it, but a Mod or Admin user on the public Cbox will see a "mod channel" link or "thumbs up" button. Clicking this button opens the shadow channel, and shows any messages that are awaiting approval. These messages can be published (i.e. re-posted) to the public Cbox by clicking the [a]/"tick" button in the mod tools next to each message.

Voice permission

Note that when users register they do not automatically get voice. So, if you have existing registered users, before you enable Moderated chat, you might first want to voice them.

Mods and admins always have voice. This means they can always post directly to your public Cbox. Registered users (other than mods and admins) can be voiced and unvoiced from within your Cbox by clicking the [v]/"plus" button in the mod tools next to their messages. Unregistered guest users cannot be granted this permission, however.

Voice permission grants a user direct publication access to your Cbox, without any of the special permissions of mods or admins. It is useful in cases where the user is trusted and/or conversation established.

Moderated channels

Moderation works in conjunction with channels, too. The global setting controls whether new channels are created in Moderated mode or not. The per-channel setting is maintained even if the global setting is later changed.

You can hide the email/url box at your control panel. Note that this input is required if you have avatars enabled, but otherwise, you can disable it.

Because emoticons and filtering rules require additional message processing time, we have a limit on the number that can be defined per Cbox. The limits vary by plan and you can upgrade if you need to increase them.

If you later downgrade your plan, your limits will be reduced but we will not automatically delete any of your data.

If Cbox does not remember your user name between visits, your browser's privacy settings may be preventing Cbox from storing this information.

Some browsers have a setting specifically to block third-party cookies or site data. When Cbox is embedded on a site, it is considered a third-party content source from the visitor's perspective, and this preference will apply.

You can usually configure an exception for Cbox in your browser's privacy settings. Use *.cbox.ws as the address.

If you have set up an exception for Cbox or configured your browser to allow third-party storage, and Cbox still forgets your name, then the problem may be a browser extension instead. To test this, disable all extensions in your browser, and if that fixes the problem, re-enable them one by one until the problem returns. This last extension will need to be configured with an exception for Cbox, as above.

There are a number of factors that can account for a difference in the number of users shown as online, even if your tracker code is placed on exactly the same pages as your Cbox.

One reason for count inaccuracy is that it's often impossible to get positive confirmation that a visitor has left the page. Cbox applies a fixed timeout of three minutes to each session, after which the user is considered offline. A tracker with a longer timeout may show a larger number of visitors online. Cbox also does not require a user to keep interacting to be considered online (they will be marked as idle instead). A tracker that shows only active users may have a lower count.

Cbox counts users differently depending depending on whether they are named or not. A named user in general is one who has previously interacted with your Cbox, for example by posting a message in it. All other visitors are considered to be anonymous guests. To maximize the privacy of your visitors, Cbox does not send cookies or other tracking information to anonymous visitors' browsers, and instead uses a passive IP-based method to count them. This can cause inaccuracy in the anonymous-guest component of your total. If multiple anonymous visitors share an IP address behind the same NAT device, for example, then they will be undercounted; if their IP address is changing frequently, they may be overcounted.

Recognized, named users are tracked more precisely, and will only be counted once, regardless of how many tabs or devices they are using your Cbox in.

Paid Cboxes support Facebook authentication for user registration. You can enable this option at your Users page.

Facebook authentication makes it easy for users to register their names with your Cbox, because they do not have to enter or remember a separate password for Cbox. They tap the "profile" link and then the "Log in with Facebook" button. If they are already logged in with Facebook and have previously accepted the Cbox app connection, then they will be logged in without any further prompt.

Facebook authentication also makes it easier for you to control access to your Cbox, because bans against Facebook users will apply to their Facebook identity, not just their name or IP on your Cbox.

Cbox does not use its Facebook integration to post to users' feeds; we only ask permission to retrieve the user's name and email address, as well as basic public information that all Facebook apps receive. We may set the user's avatar on your Cbox to their Facebook profile picture by default, but they are free to change this.

Cbox can display a status message showing who is currently typing a message in your Cbox. This feature is available to Premium and Pro Cboxes. Enable it in settings from the display users online drop-down.

Microphone brings voice notes to your Cbox. Users will see a microphone symbol below the message input box, which they can press and hold to record a note. The note is then posted into their message using regular boxcode.

On the first tap of the button, the browser will request permission to use the device microphone. The user must Accept this request the first time. On future visits, the permission should be preserved.

Compatibility

This feature makes use of recent browser technologies. As such it requires a modern browser such as Chrome. It will work on Android smartphones as well as desktops.

Importantly, you must have SSL (HTTPS) enabled both in your Cbox and your site. If your site does not support HTTPS, then you will still be able to use this feature at your Quick Link, but you will receive an error from it on your embedded Cbox.

Security

We recommend using this feature in conjunction with a Moderated Cbox. This way, you or a moderator has to give explicit voice permission to users before they are able to post messages (and also therefore, voice notes.) In other respects, voice notes are just like other messages with media in them.

Installation

After enabling the feature, you may need to increase your Cbox form height. Otherwise, the button might be cut off and not be fully visible in your Cbox.

When you renew your service with us, your paid term is extended by the additional time that you purchase, regardless of the remaining credit. This means you never lose any time. For example, if your term ends on 21 September, but you renew early, purchasing 12 months in July, then your term is extended to 21 September next year.

Upgrading Premium to Pro

When you upgrade from Premium to Pro, your credit is reset for the new plan. Remaining Premium credit is however held on your account, and if you have sufficient credit, you can contact us to request a pro-rated conversion after your upgrade.

You can generate message archives at your control panel. These are records of the conversation in your Cbox including messages that were subsequently deleted or purged.

The format is tab-separated CSV, so you will be able to import the file into a spreadsheet or database system.

It's not currently possible to import message archives back into Cbox.

When you ban a user, they are not able to post to your Cbox for the duration of the ban. They will also not be able to use any other features, such as private messaging. The default ban duration is one day.

Kicking a user, by contrast, simply disconnects them from your Cbox. Their view of your Cbox will go blank, and they won't be able to see any new messages, nor post.

Unlike a ban however, a kick is not continuously enforced. A kicked user can re-load your Cbox to re-join and resume viewing and posting. For this reason, kicking can be useful as a deterrent or warning — or simply to drop idle users — but it cannot prevent a user from returning to your Cbox.

You can set your preferred language at your control panel. This will change the language that your Cbox is displayed in, providing that we have a translation for that language. The Cbox website and control panel is only available in English.

If you would like to provide a translation for Cbox for your language, please contact us.

Your security online is important to us. Please consider these guidelines for choosing a secure password:

• Avoid words which appear in the dictionary.
• A longer password is generally better.
• Mix uppercase letters, numbers, and other special characters into your password.
• Your password should not easily be associated with you – don't use your name or birthdate in your password.

Cbox will send you a password reset email if you ever forget your password here. This means that your email account must be at least as secure as your Cbox account. Do not use the same password for Cbox that you use for your email account. This is good practice generally: it is common for Internet services to send password reset emails to your email address. If any one of them is compromised, the risk is limited to that account only if your passwords are different.

A good tip for choosing a strong password: start with a memorable sentence. Then take the first letter from each word in the sentence to make your password. Use a mix of upper- and lower-case letters and use a number or other non-alphabetic character as a substitute for at least one letter.

The error message "L-connection" usually means that your network or internet connectivity is down.

However it may also be due to browser security policy relating to third-party iframes. In this case you may need to change your embed code to use HTTPS / SSL: locate your Cbox embed code in your site source, and where you find src="http://wwwX.cbox.ws..., substitute src="https://wwwX.cbox.ws....

Firefox from version 72 includes an Enhanced Tracking Protection feature that is now enabled by default. This feature misidentifies Cbox as a "fingerprinter" or "tracker" service and blocks it on third party sites, including your own site if you have embedded your Cbox there.

You can disable ETP or add an exception to allow Cbox to load on your site. You should also still be able to use your Quick Link to access your Cbox.

Cbox has notified the list provider and has requested removal, and we are awaiting resolution. We are unfortunately not able to provide a timeline for when this will happen.

If you are a Cbox administrator or owner then you can delete users' data via the control panel. In particular, you can delete messages permanently at here and remove registered user names here.

If you are a Cbox user then you can request the owner or administrator of the Cbox that you have participated in to remove your data.

You can also request a manual data deletion by contacting us, including a reference to your account. We may require that you provide additional information to authenticate you as the account owner.