Changelogs

Core Forms 4.6.3 improves validation, licensing reliability, headless submissions, and the Core Forms admin experience.

• Renames the Forms dashboard to Core Forms, adds the installed version badge, and renames Products & Licensing to Core Commerce.
• Fixes schema and legacy-form validation, same-name choice groups, empty select placeholders, and invalid-submission rate-limit accounting.
• Fixes headless REST error statuses, nonce-enforced submissions, array-field normalization, and canonical field descriptions.
• Fixes Emailit v2 sends and contact subscriptions being marked failed after a valid HTTP 200 response.
• Makes activation records self-healing, retries transient license requests, and preserves the local key when remote deactivation fails.
• Removes the redundant one-page Core Commerce footer and misplaced card treatment.

What's Changed

• New: Geolocation targeting. Any link can route visitors to a different destination based on their country, with rules evaluated in order and the first country match winning.
• New: Country detection with zero dependencies. The country is read from request variables your CDN or web server already provides — Cloudflare (CF-IPCountry), CloudFront, Vercel, Google App Engine, nginx GeoIP2, Apache mod_geoip, mod_maxminddb, or a custom header you name. No GeoIP database file, no third-party API, no outbound request.
• New: EU country group expands to all 27 member states in a single rule; extendable via gtlm_geo_country_groups.
• New: Per-rule status codes, and a "show a 404" fallback for visitors matching no rule.
• New: Geolocation settings section with a live "Detected Now" readout showing which country and source resolved for the current request — the fastest way to confirm your CDN is forwarding a country header.
• New: "Check Detection" button. Lists every country header present on the request with its raw value, and runs a loopback self-test — it sends the site a request carrying a country header and reports what the plugin detected at the other end. That proves detection works even on a local or staging install with no CDN in front, where "no country on this request" is correct rather than a fault. Also validates a country code you type before you use it in a rule.
• New: The detection readout distinguishes "nothing is proxying this site, so no country is expected" from "your CDN is in front but sent no country header" — only the second is a misconfiguration, and it now says how to fix it.
• New: Rule builder in the link editor. Numbered rows show match precedence, rules can be reordered, one-click picks cover common markets (US + CA, EU, UK, India, AU + NZ), the long country list is filterable, selections show as removable chips, and the "Everyone else" fallback reads as the final row. It warns when a country is listed twice (only the highest rule can ever match) or when a rule has countries but no URL.
• New: Rule preview. Pick a country and see exactly which rule wins and where it sends — evaluated in the browser against your unsaved edits, with no request made.
• New: Privacy disclosure. The plugin registers a suggested privacy-policy section under Settings → Privacy → Policy Guide, and states inline that country detection reads only a CDN-provided header — never the visitor's IP address, never an external service, and the country is never stored or logged.
• Fixed: a partial REST update (PATCH) of one field silently reset every field that was not included, because each write argument declared a schema default that WP_REST_Request materialises into the request. Sending only geo_rules would reset redirect_type to 301 — which quietly breaks geo targeting — and blank tags, notes, and rel. Omitted fields now keep their stored values. Create defaults are unchanged.
• New: Optional X-GTLM-Country debug response header showing the detected country, its source, and whether a rule matched.
• New: Geo rules are exposed in the REST API on /links (create, read, update) with a self-describing schema, so links can be geo-targeted programmatically. Posting geo_rules without geo_mode opts the link in automatically.
• New: Geo rules round-trip through CSV import and export; a malformed rules cell is dropped without failing the row.
• New: Geo column in the links list table, and geolocation status in Diagnostics.
• Performance: geolocation costs nothing on links that do not use it — the check is a single array read, and country detection is never invoked unless a matched link opts in. Detection and settings are resolved once per request.
• Note: geo-targeted links should use 302, not 301. A 301 is cached by the browser permanently, which pins a visitor to whichever country they were in on their first click. The link editor warns when a geo link is set to 301.
• Note: a country header can be forged on requests that reach your site without passing through your CDN, so the 404 fallback is not a security control. Behind Cloudflare, CF-IPCountry is rewritten at the edge and cannot be spoofed; the "Cloudflare only" detection method is the strictest setting.

= 1.6.1 = = 1.7.0 = Adds geolocation targeting: route each link by visitor country using the header your CDN already sends — no GeoIP database, no external API, no added latency. Two columns are added to the links table automatically on upgrade; existing links are untouched and keep redirecting exactly as before. Enable it under GT Links → Settings → Geolocation Targeting.

Commits

• Deploy the bare version to WordPress.org, not the tag name (03e7b9f)
• Add geolocation targeting, bump to 1.7.0 (d45326c)
• Add Playground blueprint for wp.org Live Preview (6ea77f0)

A public Storefront API for headless storefronts, plus a block editor and builder preview that finally look like the real form.

Added

• Added a public, read-only Storefront REST API for static sites and external product embeds, exposing active-only product and plan data with resolved icons, hosted checkout URLs, filters, pagination, CORS, caching, and ETags.
• The form skeleton (forms.css) and default theme (form-theme.css) now load inside the Block Editor canvas, so the Core Form block preview matches the published page instead of rendering unstyled.

Changed

• The License Issuing Server no longer takes over an existing /checkout/ page it does not own. When that slug is already taken it provisions /core-checkout/ instead, leaving WooCommerce and hand-built checkout pages untouched.
• Replaced every DOING_AJAX constant check with wp_doing_ajax(), which is filterable and the supported API.
• Removed the orphaned AllSubmissionsTable::forms_dropdown() and ::date_filters() methods.

Fixed

• Fixed the form builder preview pane painting unstyled before restyling itself. Its stylesheets were enqueued from a wp_head callback at priority 10, after core prints styles at priority 8, so they only ever reached the footer's late-style pass.
• Fixed the form builder preview request not being recognised as containing a form, which let the unused-asset cleanup dequeue the preview's own stylesheets.
• Corrected several inaccurate PHPDoc return types reported to callers and tooling, and declared Form::$id as the read-only alias __get() already served.
• The licensing maintenance cron callback no longer returns its summary array to do_action().

Note: 4.6.1 was prepared but never published, so its changes are folded into this release and no v4.6.1 tag exists.

Requires: WordPress 6.4+ · PHP 8.1+ · Tested up to WordPress 6.8

What's new

• Add External Product with per-product URL, button text, link target, nofollow, sponsored, and price-visibility controls.
• Replace storefront purchase controls across product pages, cards, and standalone FluentCart purchase blocks.
• Redirect legacy instant-checkout links and reject external products in local cart and checkout validation.
• Remove the bundled FluentCart Core and Pro source; FluentCart is now an independently installed dependency.

Requirements

• WordPress 6.0 or newer
• PHP 7.4 or newer
• FluentCart 1.5.5 or newer for External Product and Multi-Currency Checkout

What's Changed

• Improved: SVG Icon block now uses block metadata, lazy paginated icon loading, native block supports, px/em/rem sizing, original-color and monochrome modes, accessible labels, missing-icon recovery, and keyboard-friendly selection.
• Security: SVG sanitization now requires a real SVG root, restricts styles and local references, blocks external href values, and prefixes definition IDs to prevent collisions.
• Fixed: Fresh PWA settings now register rewrite endpoints immediately, and the offline application shell returns a cacheable success response so service-worker precaching can complete.
• Added: True lazy module registry. A frontend request with all modules disabled loads no feature class files; enabling one module loads only that feature and shared dependencies.
• Added: Versioned settings export/import with dry-run differences, module validation, default custom-code redaction, and an explicit code opt-in.
• Added: Privacy-conscious diagnostics download with software versions, enabled modules, writable-path status, and rewrite-rule health. Task content, redirects, users, secrets, and site URLs are excluded.
• Added: Redirect CSV import/export with common column aliases, all-or-nothing dry runs, and duplicate, wildcard, loop, and chain validation.
• Added: Opt-in bounded 404 monitor with retention, row caps, path exclusions, bot/admin/API filtering, referrer-origin-only storage, purge, ignore, and redirect-prefill actions.
• Added: Assumption Detection Site Health status, configurable scheduled scans, stale/failed scan distinction, and opt-in deduplicated email summaries.
• Added: Content Integrity snapshot differences for links, headings, H1s, and word count, plus bounded audit metadata for baseline actions.
• Added: Pull-request CI across PHP 7.4 through 8.5, WordPress Coding Standards, PHPUnit coverage, JavaScript/shell checks, version consistency, and distribution assertions.
• Changed: Admin bootstrap is now a small router with dedicated module, portability, and Site Health controllers.
• Fixed: Task Manager and Redirect Manager JSON updates now use locking, verified same-directory temporary files, and atomic replacement to prevent lost concurrent writes.
• Fixed: Invalid JSON and storage failures preserve the last known file and surface an actionable admin error instead of silently appearing empty.
• Fixed: SVG Icons is disabled on fresh installs, matching the explicit-activation policy used by every module.

= 1.4.7 = = 1.4.8 = Adds the upgraded SVG Icon block, safe settings portability, CSV redirects, an opt-in 404 monitor, native Site Health signals, true lazy module loading, atomic file storage, and pull-request quality gates. Existing option names, block names, shortcode syntax, admin URLs, hooks, and JSON formats remain compatible.

Commits

• Improve SVG Icon block for 1.4.8 (9b797b8)
• Fix PWA offline precaching on fresh installs (#49) (7ec31cc)
• Ship Dynamic Functionalities 1.4.8 (#48) (85cc110)

Core Forms 4.6.0 connects forms, payments, digital products, and software licensing in one native WordPress workflow.

• Rebuilt Products & Licensing around searchable product, license, and order tables, product workspaces, setup checks, operational alerts, activity timelines, and validated plugin or theme release ZIPs.
• Added product icons, sample-product generation, and optional purchase and renewal form generation for every active plan.
• Added currency-to-gateway routing with multiple compatible gateways and a preferred gateway for each currency, plus native product checkout without a stored Core Form.
• Expanded purchase templates for Stripe, PayPal, Razorpay, and Polar with optional business, tax, billing, phone, website, and order-note fields.
• Added permissioned commerce REST endpoints and WordPress 6.9+ MCP-discoverable abilities for products, plans, releases, orders, licenses, subscriptions, downloads, gateways, and sample data.
• Added blocks and shortcodes for product catalogs, product lists, single products, prices, buy buttons, checkout, and the customer dashboard, grouped in the Core Forms block category.
• Removed customer emails and full license keys from newly generated renewal and package URLs, added enumeration-safe dashboard access requests, and recorded non-secret commerce activity events.
• Corrected the plugin and installation-documentation product URL to core-forms.com.

Requires WordPress 6.4+ and PHP 8.1+.

Core Forms 4.5.0 makes standalone forms easier to share and stops unrelated pages from paying the CSS cost of features they do not use.

Highlights

• Add clean, configurable standalone URLs such as /collect/form-slug/, while preserving legacy ?cf-form links.
• Load frontend assets from each rendered form’s actual capabilities; basic forms no longer load Smart Forms CSS.
• Support native Post/Redirect/Get submissions when AJAX is disabled.
• Add global and per-form analytics controls, explicit partial-entry capture, consent filtering, runtime diagnostics, and form-usage discovery.
• Fix SQLite activation migrations, poll-cookie scope, and AJAX validation responses.

Verification

• 190 PHPUnit tests / 386 assertions
• PHPStan and ESLint clean
• WordPress Studio clean activation and upgrade tests on WordPress 7.0.2, PHP 8.2, SQLite
• Playwright coverage for AJAX success/error, asset gating, calculations, native submissions, and no-form pages

The licensed updater serves the immutable 4.5.0 package with SHA-256 fc8759e85d4a841556311a2c670e1de7c4e4bd42dcc0e684449acc7cadd3f2d5.

Fixes currency switches that could change only the symbol while retaining the previous numeric amount.

• Binds currency REST reads and writes to the exact FluentCart checkout hash.
• Reprices stale cart amounts before updating symbols or gateway routing.
• Keeps catalog formatting from inheriting checkout-only currency symbols.
• Preserves currency-aware gateway validation for INR, USD, EUR, and GBP.

Complete local-currency support for FluentCart block checkouts.

• Resolves currency before WordPress constructs checkout inner blocks.
• Restores saved cart currency on every checkout request.
• Synchronizes FluentCart normalized formatting with cart currency.
• Keeps symbols, selector state, totals, and currency-based gateway routing aligned.

Checkout currency-context restoration patch.

• Restores the saved cart currency into FluentCart formatting on every checkout request.
• Prevents stale base-currency symbols and selector state after automatic repricing.
• Keeps totals and currency-based gateway routing synchronized.

Checkout rendering synchronization patch.

• Resolves local currency before WordPress pre-renders FluentCart checkout inner blocks.
• Keeps the first response currency symbol, selector, totals, and gateway routes synchronized.
• Retains shortcode and block-checkout compatibility from 2.1.1.

Patch release for FluentCart checkout-block compatibility.

• Resolves location currency before block checkout prices render.
• Shows the currency selector on block and shortcode checkouts.
• Synchronizes currency-aware payment gateway routing with block checkout totals.