Changelog

• Resolves location currency before block checkout prices render.
• Shows the currency selector on block and shortcode checkouts.
• Synchronizes currency-aware payment gateway routing with block checkout totals.

• Local currency at checkout
• Automatically selects an enabled local currency when checkout loads.
• Resolves location from billing country, shipping country, then Cloudflare visitor country.
• Reprices the full cart in the configured default currency when the local currency is disabled or cannot price every item.
• Preserves manual customer currency choices and refreshes automatic choices when checkout country changes.
• Keeps checkout display, gateway routing, REST hydration, cart state, and order currency synchronized.

Highlights:

Multi-currency checkout requires FluentCart 1.5.5 or newer. Version 2.0.0 is designed for two-decimal currencies; test zero-decimal currencies separately before production use.

• One authoritative currency per cart, order, transaction, and subscription.
• Exact per-variation price books with manual or Frankfurter exchange-rate fallback.
• Currency-to-payment-gateway routing with preferred gateways and server-side validation.
• Server-side cart repricing for items, fixed coupons, shipping, fees, and signup amounts.
• Storefront currency selector and [gtfc_currency_selector] shortcode.
• FluentCart product-editor controls for exact local prices.
• Redesigned responsive settings, diagnostics, rate markup, rounding, and missing-price behavior.

• Added
• Added automatic compatibility detection and JavaScript exclusions for Independent Analytics, Burst Statistics, Koko Analytics, Matomo Analytics, WP Statistics, Site Kit by Google, MonsterInsights, ExactMetrics, and PixelYourSite.

• Fixed
• Treated an empty or whitespace-only Authorization server variable as absent so compatible hosts can still cache anonymous requests, while preserving the cache bypass for real credentials.
• Normalized panel, field, action, report, and responsive spacing across the settings interface and removed typographic shifts from active navigation states.
• Added
• Added a separate origin-pull CDN module that rewrites same-site static URLs to an HTTPS CDN base only for explicitly selected file extensions; third-party URLs, HTML/API routes, data URLs, and unselected types remain untouched.
• Added cache invalidation when CDN settings change, plus controls for images, styles, scripts, fonts, media, and downloadable files.
• Added direct links to Cloudflare's official scoped-token, Global API Key, and Zone ID documentation next to the relevant fields.

• Fixed
• Deferred the public Cache-Control header until after response validation, so a Set-Cookie, a non-200 status, or DONOTCACHEPAGE introduced during rendering can no longer instruct a shared or edge cache to store a private page.
• Stopped deselected scheduled database-cleanup tasks (and other list settings such as bypass paths) from being silently restored on save; list settings are now replaced wholesale instead of merged index by index.
• Fixed commerce bypass-path matching so the canonical /checkout on no-trailing-slash permalink sites is protected exactly like /checkout/, at both the origin and in the compiled Cloudflare edge rule.
• Preserved inline <script> and JSON-LD content and removed the stray <?xml> node that the DOM-based CSS, font, and embed optimizers could ship — and cache — on every optimized page.
• Corrected root-relative url(/…) rebasing in collected stylesheets so background and font references resolve against the site origin.
• Accepted CSS.escape()d utility-class selectors (for example Tailwind md:flex, w-1/2) in CSS Training Mode so utility-class themes no longer publish empty safelists.
• Canonicalized the Cloudflare managed-rule fingerprint so key-order differences in Cloudflare's response are no longer misread as drift and no longer trigger a redundant sync on every run.
• Anchored the Cloudflare bypass query-parameter rule to a parameter boundary so a short parameter such as s no longer excludes unrelated parameters like utms.
• Sent Vary: User-Agent when a separate mobile cache variant is active, and honored the "stale if error" duration in the emitted Cache-Control.
• Bounded queue-table growth by pruning terminal jobs on the queue cron, and web-hardened the cache and log directories.
• Stamped the advanced-cache drop-in with the plugin version and regenerated it automatically after an update.
• Removed the non-functional "Cache logged-in users" control.
• Invalidated affected post, homepage, and archive caches when comments are inserted through the front end, REST API, WP-CLI, or lower-level WordPress APIs, and when they are edited, moderated, or deleted.
• Batched related URL purges into one edge notification and removed both desktop and mobile origin variants.
• Prevented the deferred cache-safety header from rejecting the plugin's own otherwise cacheable response.
• Renamed the WP-CLI target option to --page-url so it no longer collides with WP-CLI's reserved --url site selector.
• Preserved explicit URL ports in diagnostic and purge cache keys so local Studio sites target the same artifact as live requests.
• Applied the configured Cloudflare edge lifetime to the managed Cache Rule instead of always respecting the origin value.
• Restricted sitemap warming to same-origin, cache-eligible URLs and bounded sitemap response sizes.
• Discarded obsolete and foreign settings keys during merges, and removed non-functional Gravatar self-hosting and font-preload controls.
• Added
• Sitemap-driven cache warming: after a full purge, eligible URLs discovered from the WordPress sitemap are queued for background preloading (controlled by the new cache.preload toggle and bounded by cache.preload_max_urls), with a matching wp gt-performance cache warm command.
• Accessible brief tooltips and clearer labels for cache lifetimes, exceptions, Cloudflare, optimization, Akismet, and Redis controls.

• What's Changed
• Added Recurring, cache-aware Live Countdown block with leap-day handling and Block Bindings presets.
• Improved All date calculations now use the WordPress site timezone and calendar-day arithmetic across daylight-saving changes.
• Improved Searchable shortcode picker, block previews, toolbar accessibility, responsive editor controls and theme-neutral patterns.
• Improved Shortcode processing in titles, excerpts and supported integrations is limited to this plugin's tags.
• Fixed Countdown Interactivity API code now ships as a JavaScript module.
• Changed Minimum supported WordPress version is 6.5.
• Changed Removed duplicate legacy runtime files and consolidated rendering around one date engine.
• Commits
• Release 1.8.0 (1f27f44)
• Prepare 1.8.0-beta (47a2613)
• Fix WordPress.org release tag version (38662fe)

• Fixed
• Send Email, Auto-Responder, and Emailit action cards now show variables for the current form fields on the Actions tab.
• Field variables are rendered server-side instead of depending on Fields-tab JavaScript.
• Added regression coverage for named, array, duplicate, and internal field handling.

• What's Changed
• Performance
• Replaced request-time block and field-group discovery with a generated OPcache-friendly manifest.
• Consolidated editor styles into one cacheable bundle, with site-specific bundles that exclude blocks disabled through Block Manager.
• Removed the TOC block's full-post do_blocks() re-render and moved its runtime CSS/JavaScript to conditional assets.
• Moved external-image downloads and thumbnail generation out of post saves into a bounded WP-Cron queue.
• Changed migration and recovery scans from unbounded all-post queries to resumable keyset batches, including an optional background migration worker.
• Added request-level image attachment lookup caching, post cache priming, bounded URL-preview responses, and contextual module loading.
• Moved callout, feature-grid, post-display, checklist, changelog, and pros/cons variation styling into cacheable stylesheets or CSS custom properties.
• Added
• Block Manager for disabling unused block registrations and field groups.
• Asynchronous block usage inventory, job status, and performance diagnostics.
• Optional Server-Timing metrics in debug environments.
• Generated-artifact checks, PHP 7.4-8.5 compatibility CI, JSON validation, and PHPUnit coverage.
• Fixed
• Replaced PHP 8-only str_ends_with() calls while retaining the advertised PHP 7.4 minimum.
• Reworked public star ratings to use atomic database tables and a REST endpoint, preventing lost concurrent votes and transient-option growth.
• Made URL Preview editor code cacheable and limited remote HTML responses to 1 MB.
• Commits
• Release 2.9.0 performance overhaul (5503112)
• Stats
• Commits: 1
• Changes 48 files changed, 12640 insertions(+), 1356 deletions(-)
• Plugin Info
• Blocks included: 29
• Requires WordPress: 6.0+
• Requires PHP: 7.4+
• Requires: ACF Pro 6.0+ or Secure Custom Fields
• Installation
• Download acf-blocks-plugin-*.zip from the assets below
• Go to Plugins → Add New → Upload Plugin in WordPress admin
• Upload the zip file and activate

• Security
• Enforces the 254-character email limit and each field's declared maxlength on the server.
• Rejects nested form values and encoded submission metadata above 60 KiB before hooks, storage, or notifications.
• Keeps uploaded file bytes outside that metadata ceiling; upload size remains controlled by the field and PHP limits.
• Fixed
• Restores single and multiple multipart file uploads by normalizing PHP's $_FILES data into the submission pipeline.
• Prevents invalid and spam submissions from moving files or persisting temporary upload paths.
• Fixes per-form rate-limit settings, hourly expiry, and AJAX error visibility.

• Fixed
• Fixed the Gutenberg Core Form block preview taking about 60 seconds to load on busy editor screens by replacing the generic WordPress server-render request with a focused Core Forms preview endpoint, a summary-only form selector, and shared request caching.

• Added
• Added inline Stripe Payment Element checkout with server-owned product pricing, idempotent PaymentIntent creation, and signed webhook confirmation.
• Added first-class Razorpay hosted checkout with payment-link, captured-payment, failure, cancellation, and refund handling.
• Added one-click importers for Ninja Forms and Formidable Forms alongside the existing CF7, Gravity Forms, WPForms, and Fluent Forms migration tools.
• Added WP-CLI commands for form import/export/listing, submission maintenance, product and plan administration, license reporting, order reporting, and expiry maintenance.
• Added native actions for WooCommerce, Easy Digital Downloads, SureCart, WP Simple Pay, MemberPress, LearnDash, Paid Memberships Pro, Groundhogg, Jetpack CRM, WP-CRM System, and SureContact.
• Added AutomatorWP, Uncanny Automator, and OttoKit triggers and actions with form and submission payloads.
• Added signed inbound WhatsApp webhooks for Meta Cloud API and Twilio, including reply correlation and delivery-state history in submission conversations.
• Added a multi-product licensing and lightweight ecommerce system with products, plans, orders, subscriptions, customer accounts, activation limits, refunds, renewals, and audited signed downloads.
• Added a dedicated customer dashboard for orders, masked/revealable keys, product downloads, activated sites, and subscription controls.
• Added free, Stripe, Razorpay, and renewal license-form templates with complete payment and fulfillment actions.
• Added a default Sample Product with free, USD annual, and INR annual plans on new and upgraded sites.
• Added native Bricks and Elementor integrations plus a per-form WCAG 2.2 audit and conservative one-click repairs.
• Changed
• The form editor now renders only the active tab instead of executing every tab's PHP, JavaScript, analytics, and REST requests on every page load.
• The visual builder now boots from server-rendered form and schema data, removing its two blocking initial REST requests.
• Builder saves now persist markup and schema atomically through one endpoint with a bounded timeout and a standard form-post fallback.
• Tab-specific saves merge with existing form settings, preserving payment and action configuration when saving Fields, Messages, or other individual tabs.
• Licensing actions are always visible under a dedicated Commerce & Licensing category instead of disappearing when the public activation API is disabled.
• Product and plan slugs are generated automatically, normalized, and made unique; manually entered slugs remain supported.
• Plan prices are entered in customer-facing major units such as 49.00 instead of minor units such as 4900.
• Product packages use the WordPress Media Library picker and uploader instead of requiring an attachment ID.
• The licensing backend now includes catalog statistics, quick-start guidance, direct Add plan/Add package links, and file names instead of raw attachment IDs.
• The existing core-forms.com CF Licenser client, option keys, 32-character key format, six-hour heartbeat, and update hooks remain separate from and compatible with the new merchant licensing subsystem.
• Fixed
• Fixed the Fields builder remaining on an indefinite loading spinner when either initial REST request stalled.
• Fixed inactive Analytics requests and form-builder assets loading on unrelated form tabs.
• Fixed paid plans being fulfillable from a non-payment form or before verified payment confirmation.
• Fixed payment fulfillment accepting a mismatched paid amount or currency when validation is enabled.
• Fixed free plans being incorrectly coupled to a payment requirement.
• Fixed action-variable references showing a permanent Loading message when the Fields builder was not present.
• Fixed stale admin asset caches by versioning the main admin stylesheet and licensing script from their file modification times while keeping the plugin version at 4.4.0.
• Security
• License fulfillment is idempotent per submission and product selection, preventing duplicate orders or keys during webhook retries.
• Signed package links expire, verify the stored SHA-256 digest before streaming, and record downloads in an audit table.
• Verified refunds disable issued licenses and cancel related subscriptions.
• Inbound messaging and payment webhooks require provider signatures before they can change submission, payment, or fulfillment state.