Changelog

= 1.6.1 = = 1.7.0 = Adds geolocation targeting: route each link by visitor country using the header your CDN already sends — no GeoIP database, no external API, no added latency. Two columns are added to the links table automatically on upgrade; existing links are untouched and keep redirecting exactly as before. Enable it under GT Links → Settings → Geolocation Targeting.

• What's Changed
• New Geolocation targeting. Any link can route visitors to a different destination based on their country, with rules evaluated in order and the first country match winning.
• New Country detection with zero dependencies. The country is read from request variables your CDN or web server already provides — Cloudflare (CF-IPCountry), CloudFront, Vercel, Google App Engine, nginx GeoIP2, Apache mod_geoip, mod_maxminddb, or a custom header you name. No GeoIP database file, no third-party API, no outbound request.
• New EU country group expands to all 27 member states in a single rule; extendable via gtlm_geo_country_groups.
• New Per-rule status codes, and a "show a 404" fallback for visitors matching no rule.
• New Geolocation settings section with a live "Detected Now" readout showing which country and source resolved for the current request — the fastest way to confirm your CDN is forwarding a country header.
• New "Check Detection" button. Lists every country header present on the request with its raw value, and runs a loopback self-test — it sends the site a request carrying a country header and reports what the plugin detected at the other end. That proves detection works even on a local or staging install with no CDN in front, where "no country on this request" is correct rather than a fault. Also validates a country code you type before you use it in a rule.
• New The detection readout distinguishes "nothing is proxying this site, so no country is expected" from "your CDN is in front but sent no country header" — only the second is a misconfiguration, and it now says how to fix it.
• New Rule builder in the link editor. Numbered rows show match precedence, rules can be reordered, one-click picks cover common markets (US + CA, EU, UK, India, AU + NZ), the long country list is filterable, selections show as removable chips, and the "Everyone else" fallback reads as the final row. It warns when a country is listed twice (only the highest rule can ever match) or when a rule has countries but no URL.
• New Rule preview. Pick a country and see exactly which rule wins and where it sends — evaluated in the browser against your unsaved edits, with no request made.
• New Privacy disclosure. The plugin registers a suggested privacy-policy section under Settings → Privacy → Policy Guide, and states inline that country detection reads only a CDN-provided header — never the visitor's IP address, never an external service, and the country is never stored or logged.
• Fixed a partial REST update (PATCH) of one field silently reset every field that was not included, because each write argument declared a schema default that WP_REST_Request materialises into the request. Sending only geo_rules would reset redirect_type to 301 — which quietly breaks geo targeting — and blank tags, notes, and rel. Omitted fields now keep their stored values. Create defaults are unchanged.
• New Optional X-GTLM-Country debug response header showing the detected country, its source, and whether a rule matched.
• New Geo rules are exposed in the REST API on /links (create, read, update) with a self-describing schema, so links can be geo-targeted programmatically. Posting geo_rules without geo_mode opts the link in automatically.
• New Geo rules round-trip through CSV import and export; a malformed rules cell is dropped without failing the row.
• New Geo column in the links list table, and geolocation status in Diagnostics.
• Performance geolocation costs nothing on links that do not use it — the check is a single array read, and country detection is never invoked unless a matched link opts in. Detection and settings are resolved once per request.
• Note: geo-targeted links should use 302, not 301. A 301 is cached by the browser permanently, which pins a visitor to whichever country they were in on their first click. The link editor warns when a geo link is set to 301.
• Note: a country header can be forged on requests that reach your site without passing through your CDN, so the 404 fallback is not a security control. Behind Cloudflare, CF-IPCountry is rewritten at the edge and cannot be spoofed; the "Cloudflare only" detection method is the strictest setting.
• Commits
• Deploy the bare version to WordPress.org, not the tag name (03e7b9f)
• Add geolocation targeting, bump to 1.7.0 (d45326c)
• Add Playground blueprint for wp.org Live Preview (6ea77f0)

• Changed
• Moved the everyday operations — purge GT cache, Cloudflare sync, and the two drop-in installers — from the Tools tab onto the dashboard. Purging after a content change no longer takes a detour, and the installers are visible during setup, which is exactly when they are needed. Tools keeps runtime drop-in status and database maintenance. Each operation now remembers which screen it was run from and returns there instead of always landing on Tools.
• Fixed
• Stale pages are now rebuilt instead of being served indefinitely. Nothing regenerated an entry between fresh_ttl and stale_ttl: the drop-in served the stale body and exited, and a preload request received that same stale body, so the only escape from the stale window was stale_until expiring. A live site measured 1,011 of 1,023 cached pages stale, median age 14.3 hours. The queue now sweeps for stale entries on each scheduled run and enqueues preloads, and the drop-in treats a stale entry as a miss when the request carries X-GT-Preload, so those preloads actually rebuild the page. Batches are capped at 5 per run — matching what the queue drains per tick, since enqueue() does not deduplicate — and skipped entirely while a preload backlog is still pending, so the job table cannot grow faster than it clears. The cap is filterable via gt_performance_revalidate_batch.
• Fixed the Redis object cache silently flushing nothing. flush() and flush_group() build a SCAN MATCH pattern from the key prefix, which defaults to WP_CACHE_KEY_SALT — a random string that regularly contains [, ?, or *, all glob metacharacters. An unclosed [ makes the pattern match zero keys, so both calls deleted nothing and still returned true; a live site's wp cache flush reported success while the entries stayed in Redis. Literal prefixes are now escaped before use in a pattern.
• Re-arm the queue cron when the scheduled event is missing. Activator schedules it once at activation and nothing restored it if it was later lost, which stops the queue permanently: purges never preload, warms never run, stale pages are never rebuilt. A production site was found with the event absent and jobs pending for seven days.
• Invalidate a rebuilt page's metadata in the opcode cache. The drop-in reads metadata with include, so a refreshed entry could be read back with its previous timestamps until opcache revalidated — and never, on a host running opcache.validate_timestamps=0.
• Wrapped the Redis object cache's SCAN loop in the same error handling every other Redis call already had. It was the one unguarded call in the drop-in, so a mid-scan disconnect raised an uncaught RedisException through group flushes and took the request down with a fatal instead of degrading to a cache miss. The loop is now bounded as well, so a driver that returns without advancing the cursor cannot spin.

Note: 4.6.1 was prepared but never published, so its changes are folded into this release and no v4.6.1 tag exists.

Requires: WordPress 6.4+ · PHP 8.1+ · Tested up to WordPress 6.8

• Added
• Added a public, read-only Storefront REST API for static sites and external product embeds, exposing active-only product and plan data with resolved icons, hosted checkout URLs, filters, pagination, CORS, caching, and ETags.
• The form skeleton (forms.css) and default theme (form-theme.css) now load inside the Block Editor canvas, so the Core Form block preview matches the published page instead of rendering unstyled.
• Changed
• The License Issuing Server no longer takes over an existing /checkout/ page it does not own. When that slug is already taken it provisions /core-checkout/ instead, leaving WooCommerce and hand-built checkout pages untouched.
• Replaced every DOING_AJAX constant check with wp_doing_ajax(), which is filterable and the supported API.
• Removed the orphaned AllSubmissionsTable::forms_dropdown() and ::date_filters() methods.
• Fixed
• Fixed the form builder preview pane painting unstyled before restyling itself. Its stylesheets were enqueued from a wp_head callback at priority 10, after core prints styles at priority 8, so they only ever reached the footer's late-style pass.
• Fixed the form builder preview request not being recognised as containing a form, which let the unused-asset cleanup dequeue the preview's own stylesheets.
• Corrected several inaccurate PHPDoc return types reported to callers and tooling, and declared Form::$id as the read-only alias __get() already served.
• The licensing maintenance cron callback no longer returns its summary array to do_action().

= 1.4.7 = = 1.4.8 = Adds the upgraded SVG Icon block, safe settings portability, CSV redirects, an opt-in 404 monitor, native Site Health signals, true lazy module loading, atomic file storage, and pull-request quality gates. Existing option names, block names, shortcode syntax, admin URLs, hooks, and JSON formats remain compatible.

• What's Changed
• Improved SVG Icon block now uses block metadata, lazy paginated icon loading, native block supports, px/em/rem sizing, original-color and monochrome modes, accessible labels, missing-icon recovery, and keyboard-friendly selection.
• Security SVG sanitization now requires a real SVG root, restricts styles and local references, blocks external href values, and prefixes definition IDs to prevent collisions.
• Fixed Fresh PWA settings now register rewrite endpoints immediately, and the offline application shell returns a cacheable success response so service-worker precaching can complete.
• Added True lazy module registry. A frontend request with all modules disabled loads no feature class files; enabling one module loads only that feature and shared dependencies.
• Added Versioned settings export/import with dry-run differences, module validation, default custom-code redaction, and an explicit code opt-in.
• Added Privacy-conscious diagnostics download with software versions, enabled modules, writable-path status, and rewrite-rule health. Task content, redirects, users, secrets, and site URLs are excluded.
• Added Redirect CSV import/export with common column aliases, all-or-nothing dry runs, and duplicate, wildcard, loop, and chain validation.
• Added Opt-in bounded 404 monitor with retention, row caps, path exclusions, bot/admin/API filtering, referrer-origin-only storage, purge, ignore, and redirect-prefill actions.
• Added Assumption Detection Site Health status, configurable scheduled scans, stale/failed scan distinction, and opt-in deduplicated email summaries.
• Added Content Integrity snapshot differences for links, headings, H1s, and word count, plus bounded audit metadata for baseline actions.
• Added Pull-request CI across PHP 7.4 through 8.5, WordPress Coding Standards, PHPUnit coverage, JavaScript/shell checks, version consistency, and distribution assertions.
• Changed Admin bootstrap is now a small router with dedicated module, portability, and Site Health controllers.
• Fixed Task Manager and Redirect Manager JSON updates now use locking, verified same-directory temporary files, and atomic replacement to prevent lost concurrent writes.
• Fixed Invalid JSON and storage failures preserve the last known file and surface an actionable admin error instead of silently appearing empty.
• Fixed SVG Icons is disabled on fresh installs, matching the explicit-activation policy used by every module.
• Commits
• Improve SVG Icon block for 1.4.8 (9b797b8)
• Fix PWA offline precaching on fresh installs (#49) (7ec31cc)
• Ship Dynamic Functionalities 1.4.8 (#48) (85cc110)

• What's new
• Add External Product with per-product URL, button text, link target, nofollow, sponsored, and price-visibility controls.
• Replace storefront purchase controls across product pages, cards, and standalone FluentCart purchase blocks.
• Redirect legacy instant-checkout links and reject external products in local cart and checkout validation.
• Remove the bundled FluentCart Core and Pro source; FluentCart is now an independently installed dependency.
• Requirements
• WordPress 6.0 or newer
• PHP 7.4 or newer
• FluentCart 1.5.5 or newer for External Product and Multi-Currency Checkout

• Added
• Added configurable automatic cache clearing when public posts, pages, products, and custom post types are published or updated, with related-page, post-only, full page-and-edge cache, and disabled modes.
• Expanded the recommended related-page purge to cover author and public taxonomy archives in addition to the post, homepage, and post-type archive.
• Fixed
• Stopped WordPress revision cleanup from purging the homepage through the real-content deletion hook, so post-only and disabled publishing policies retain their intended scope.

Requires WordPress 6.4+ and PHP 8.1+.

• Rebuilt Products & Licensing around searchable product, license, and order tables, product workspaces, setup checks, operational alerts, activity timelines, and validated plugin or theme release ZIPs.
• Added product icons, sample-product generation, and optional purchase and renewal form generation for every active plan.
• Added currency-to-gateway routing with multiple compatible gateways and a preferred gateway for each currency, plus native product checkout without a stored Core Form.
• Expanded purchase templates for Stripe, PayPal, Razorpay, and Polar with optional business, tax, billing, phone, website, and order-note fields.
• Added permissioned commerce REST endpoints and WordPress 6.9+ MCP-discoverable abilities for products, plans, releases, orders, licenses, subscriptions, downloads, gateways, and sample data.
• Added blocks and shortcodes for product catalogs, product lists, single products, prices, buy buttons, checkout, and the customer dashboard, grouped in the Core Forms block category.
• Removed customer emails and full license keys from newly generated renewal and package URLs, added enumeration-safe dashboard access requests, and recorded non-secret commerce activity events.
• Corrected the plugin and installation-documentation product URL to core-forms.com.

The licensed updater serves the immutable 4.5.0 package with SHA-256 fc8759e85d4a841556311a2c670e1de7c4e4bd42dcc0e684449acc7cadd3f2d5.

• Highlights
• Add clean, configurable standalone URLs such as /collect/form-slug/, while preserving legacy ?cf-form links.
• Load frontend assets from each rendered form’s actual capabilities; basic forms no longer load Smart Forms CSS.
• Support native Post/Redirect/Get submissions when AJAX is disabled.
• Add global and per-form analytics controls, explicit partial-entry capture, consent filtering, runtime diagnostics, and form-usage discovery.
• Fix SQLite activation migrations, poll-cookie scope, and AJAX validation responses.
• Verification
• 190 PHPUnit tests / 386 assertions
• PHPStan and ESLint clean
• WordPress Studio clean activation and upgrade tests on WordPress 7.0.2, PHP 8.2, SQLite
• Playwright coverage for AJAX success/error, asset gating, calculations, native submissions, and no-form pages

• Binds currency REST reads and writes to the exact FluentCart checkout hash.
• Reprices stale cart amounts before updating symbols or gateway routing.
• Keeps catalog formatting from inheriting checkout-only currency symbols.
• Preserves currency-aware gateway validation for INR, USD, EUR, and GBP.

• Resolves currency before WordPress constructs checkout inner blocks.
• Restores saved cart currency on every checkout request.
• Synchronizes FluentCart normalized formatting with cart currency.
• Keeps symbols, selector state, totals, and currency-based gateway routing aligned.

• Restores the saved cart currency into FluentCart formatting on every checkout request.
• Prevents stale base-currency symbols and selector state after automatic repricing.
• Keeps totals and currency-based gateway routing synchronized.

• Resolves local currency before WordPress pre-renders FluentCart checkout inner blocks.
• Keeps the first response currency symbol, selector, totals, and gateway routes synchronized.
• Retains shortcode and block-checkout compatibility from 2.1.1.