Release notes

v1.5.0 Improvement Oct 7, 2026

Requires Draft Forge Pro 1.4.0 or newer, unchanged since 1.4.0

• Requires Draft Forge Pro 1.4.0 or newer, unchanged since 1.4.0 — an older add-on is switched off whole rather than left running.
• A button that spends credits now warns you before the click when the balance the site knows about falls short: “Not enough credits for this: you have N, it costs about M”, with a Get credits link. It shows over Mine topics with AI, the topic list, the rewrite and patch tasks, the stale-post list, the voice profile and the Schedule screen's Run now. The button stays clickable, since the price is an estimate and the balance may be out of date; nothing is said while no balance is known.
• Approve & publish gets the same warning, held against the full price on its label: the Lang Forge translation into every language.
• The Schedule screen's price now includes what Lang Forge charges to translate the new posts hands-off publishing puts live, and says how much of the total that is. The Run now button, the “about N credits” sentence and the warning read the same number.
• When a spend is turned away, the message now says why: an empty balance gets “You're out of credits” with a Get credits link, and the monthly limit you set gets “You've reached the monthly limit you set” with a Change the limit link to the field that holds it. On the Schedule screen, a run that stopped early for either reason links to the same two places.
• Fixed: a “too many requests” answer from your host or a firewall was reported as your own monthly limit; it now gets the general error line.
• Fixed: on PHP 7.4 to 8.1 the page that shows a proposed rewrite beside the article put every heading in a paragraph row, with its tag name stuck to the text (“h2Heading”).
• The new lines are translated in all 15 shipped languages.

v1.4.2 Improvement Oct 5, 2026

Requires Draft Forge Pro 1.4.0 or newer, unchanged since 1.4.0

• Requires Draft Forge Pro 1.4.0 or newer, unchanged since 1.4.0 — an older add-on is switched off whole rather than left running.
• Deleting the plugin leaves the job queue the Forge plugins share in place while another Forge plugin or add-on is still on the site. The check used to miss add-ons, and Rank Forge installed from wordpress.org, so the queue could be dropped while a neighbour still had jobs in it.

v1.4.1 Improvement Sep 18, 2026

Requires Draft Forge Pro 1.4.0 or newer, unchanged from 1.4.0

• Requires Draft Forge Pro 1.4.0 or newer, unchanged from 1.4.0 — an older add-on is switched off whole rather than left running.
• Credit prices are fetched from api.avakode.com only once the site is connected to an Avakode account or has spent a credit; opening a screen no longer reaches the network.
• Admin script globals and data attributes carry the full draftforge prefix instead of cnf.
• The Forge Suite dashboard links Guard Forge, Velocity Forge and Flow Forge to their sites: guardforge.app, velocityforge.app and flowforgewp.app.

v1.4.0 Improvement Sep 10, 2026

Requires Draft Forge Pro 1.4.0 or newer, unchanged from 1.3.0

• Requires Draft Forge Pro 1.4.0 or newer, unchanged from 1.3.0 — an older add-on is switched off whole rather than left running.
• New: what the queue produced now appears on the Forge Suite dashboard's first screen, beside every other Forge tool's results — published, scheduled, waiting for review, stopped, one line per kind of work with how many and over what period. A post is reported as verified only while it is actually public on the site; anything still waiting on you keeps its next step and stays in "needs attention". No traffic or revenue figures: this tool knows what it wrote, not what the writing earned, and nothing leaves your site.

v1.3.1 Improvement Sep 9, 2026

Brand: new product icon and admin logo

• Brand: new product icon and admin logo.
• Requires Draft Forge Pro 1.4.0 or newer, unchanged from 1.3.0.

v1.3.0 Improvement Sep 9, 2026

The quality gate has a fifth check, and it is the only one that reads

• The quality gate has a fifth check, and it is the only one that reads. The other four measure a draft — length, internal links, an image direction, distance from what you already published. This one is the objection a reader would make: stock phrases counted as a density rather than spotted once, sentences and openings repeated, an introduction that only restates the title, a rhythm too even to have been written by a person, dates and figures that cannot be true, and text laid out as a list where it should be prose. It answers with the sentence and the reason beside it instead of a number, at one of three strictness settings, and it runs on a refresh exactly as it runs on a new draft — of the two bodies, the one being rewritten is the one that already has readers. Free, and it costs nothing to run.
• The author generates and the editor approves. A queued draft can be sent for review to whoever holds the new draftforge_review_drafts capability — Administrator and Editor by default — who can approve and publish, approve as a draft, or send it back with a note. Both ends are recorded on the row, a reviewer is e-mailed at most once an hour however many drafts arrive in it, and a draft still waiting on that answer is never published by an automatic run.
• The Queue tab now opens for publish_posts instead of manage_options, so an author can reach their own work — and the administrator-only buttons on it are drawn only for an administrator, rather than rendering for everybody and answering 403 on the click. A Contributor is still kept out: the tab carries every draft on the site with its cost and its report.
• Draft Forge can read how you write. "Analyse my voice" takes up to five posts you actually published, describes your tone, sentence length and person, offers the summary for the Brand voice field rather than applying it, and folds the profile you keep into every later outline and draft (~2 credits per run). Saving the Settings form no longer throws that profile away.
• The whole pipeline is available from the command line: wp draftforge mine, generate, refresh, gate, queue and credits. Every command prints what the run will cost before it runs, the ones that spend refuse to without --yes, and every refusal exits non-zero — gate spends nothing and exits non-zero on a body the gate would hold, which makes it usable in a build.
• With the Pro add-on, the autopilot now stops itself instead of running until you notice: a weekly publish cap (1–14, 3 by default) that a scheduled run never exceeds no matter how many new posts per run you have configured, and a checkpoint after every 10 hands-off publications (configurable) that pauses further automatic publishing of new drafts until you confirm on the Schedule tab. Drafting and refreshes already live keep going while paused — the pause is on new posts going live on their own, nothing else.
• The Schedule tab shows the pause, the reason, a confirm button, and the calendar's forecast now draws the weekly cap as its own line and marks a week where the plan would cross it.
• An e-mail goes out once when the checkpoint engages, not again while it stays paused.
• Requires Draft Forge Pro 1.4.0 or newer. An older add-on has no checkpoint, cap or "Stop all" to read; this release is the first core to call for them, so a pre-1.4.0 add-on is now reported the same way a too-old one always has been — absent, not fatal.
• A Collection tab: choose which published posts you actually want kept current, up to 100 at a time, with an owner and a next-review date on each. That list is the scope of every maintenance task below — nothing outside it is read, fetched or rewritten. Adding, removing, and assigning an owner or a date are open to Administrator and Editor; the 100-post ceiling keeps the list readable and applies the same way with or without the Pro add-on.
• Allowed sources per tracked post: up to five URLs — a documentation page, a changelog, a feed — that a post is maintained against. Draft Forge reads them on a schedule, at most once every 12 hours each, over plain http/https only, never following a redirect into a private address, with a one-megabyte and fifteen-second limit and the text cached so a change can be described. A source that cannot be read says why — source unavailable, paywall, removed, or asks not to be read — with the date its current state began, beside the post and again in a list of its own. Text read from a source is quoted DATA when it reaches the model, inside a fence, behind an instruction not to obey anything written in it. Free.
• Maintenance tasks, and the end of "old means rewrite". Three things now put work on the Queue tab: a source that changed, a review date that arrived, and a decline report you imported (paste a CSV of URLs with clicks over two periods). Each task says what changed, where that is known from, which blocks of the post mention something out of the change — a word match offered as possibly affected, not a verdict — and how many blocks it did not touch. Two answers: rewrite with AI, or no change needed. The age of an article raises no task at all, and with the Pro add-on the autopilot's refresh half now takes only these tasks instead of scanning for the oldest posts on the site. Free.
• Behaviour change with the Pro add-on: scheduled runs used to refresh the oldest published posts on the site. From this release they refresh the maintenance tasks above, oldest task first, and only for posts in your collection. A site with an empty collection gets no refreshes from a scheduled run — add the posts you want kept current, and the "Consider posts stale after" setting on the Schedule tab is gone with the behaviour it configured. The Topics tab's own "Scan stale posts" button is unchanged and still lists old posts as a hint.

v1.0.1 Fix Sep 3, 2026

Fixed a fatal on the Schedule screen for sites without the Pro add-on

• Fixed a fatal on the Schedule screen for sites without the Pro add-on — it now shows what Pro adds instead of dying.

v1.0.0 Improvement Sep 3, 2026

Initial public release

• Initial public release. Topic mining, AI draft generation, stale-content refresh, queue, and quality filter.

v1.2.9 Improvement Oct 13, 2026

Fixed: when the Rank Forge Pro add-on is active but its licence does not cover Search

• Needs Rank Forge Pro 1.2.5 or newer if you run the add-on, as before.
• Fixed: when the Rank Forge Pro add-on is active but its licence does not cover Search Console, Performance and Content Decay told you to connect Google Search Console, which could not load any data. They now say that the licence is missing and link to the add-on's licence page, whether or not Google is connected. This needs Rank Forge Pro 1.2.13 or newer.
• Content Decay: when no Search Console data has been loaded yet and none is waiting to load, the screen now says so and offers a "Load Search Console data now" button, instead of sending you to Performance. This needs Rank Forge Pro 1.2.13 or newer; with an older add-on the previous text stays.

v1.2.8 Improvement Oct 12, 2026

Content Decay and Performance: when the Pro add-on does not load Search Console data

• Needs Rank Forge Pro 1.2.5 or newer if you run the add-on, as before.
• Content Decay and Performance: when the Pro add-on does not load Search Console data on the site, the screen says so, gives the reason and links to the add-on's licence page, instead of telling you to click a Refresh button that starts nothing. Performance hides its Refresh button then. The message needs Rank Forge Pro 1.2.13.
• Fixed: in the edition distributed through avakode.com, with debug logging on, wp-admin no longer writes "_load_textdomain_just_in_time was called incorrectly" notices for this plugin on every request.
• Fixed: on PHP 8.1 and later the plugin no longer writes "trim(): Passing null to parameter" deprecations to debug.log on every front-end request of a site installed at the root, or on a request for an address with no path (such as //).
• Fixed: deleting the plugin now also removes the end date and the saved Search Console comparison that A/B tests keep on posts (not when you chose to keep the data).

v1.2.7 Improvement Oct 12, 2026

Product markup: a product's brand now comes from its own brand

• Needs Rank Forge Pro 1.2.5 or newer if you run the add-on, as before.
• Product markup: a product's brand now comes from its own brand (WooCommerce Brands, Perfect Brands for WooCommerce or YITH WooCommerce Brands), a "brand" product attribute, or the new Default brand field under Settings, Search Appearance. The name of your site is no longer printed as the brand, so a shop that has not set a brand now prints no brand property.
• Product markup: the GTIN set on the product in WooCommerce is printed as gtin8, gtin12, gtin13 or gtin14, by its length; a number of any other length is not printed.
• Product markup: new MPN field next to the SKU on the product's Inventory tab (a product attribute named "mpn" works too), printed as mpn.
• Product markup: every offer with a price now says until when the price holds: the end of a running sale, otherwise 31 December of next year.
• Product markup: new Product Markup card under Settings, Search Appearance with shipping details (country, cost or free shipping, handling and delivery days). They are printed only when every field is filled in, and not for virtual or external products.
• Product markup: the same card holds the return policy (country, days, method, who pays for return shipping), printed only when every field is filled in, and not for virtual or external products.
• A/B test (Rank Forge Pro): the meta title, Open Graph title and Twitter title now come from one place, so a Variant B title can reach all of them. A title typed by hand for Open Graph or Twitter still wins.
• Content Decay: the empty-state text and button now send you to Performance, the screen that exists, instead of Rankings.
• Performance and Content Decay show when Search Console data is loading, why a load failed (with a Try again button), or that a property still has to be chosen.
• Hints about connecting Google open the screen that has the Connect Google button; the dashboard card appears only when the connection is available.
• Site Audit: WooCommerce products show their type in the list; the AI works out a product's focus keyword from its name, short description and description.
• Site Audit: the AI never rewrites the description of a product; a fix that would write it says so and changes nothing. The AI can write a product's meta title, meta description and focus keyword.
• Fixed: bulk fixes no longer strip backslashes from the content they save, and an applied meta title, description or focus keyword keeps its backslashes.

v1.2.6 Improvement Oct 12, 2026

Video SEO: a Thumbnail URL or Description typed in the Video SEO box is no longer replaced

• Needs Rank Forge Pro 1.2.5 or newer if you run the add-on, as before.
• Video SEO: a Thumbnail URL or Description typed in the Video SEO box is no longer replaced by an automatic one when the Video URL field is empty and the post has a video in it. A field left empty still takes the automatic value.
• Redirects: saving a redirect with a type that is not supported now shows an error instead of storing a rule that visitors got as a 301. Rules saved earlier are not changed.
• Schema Builder: choosing a schema type (Event, Review, WebPage, VideoObject and so on) without filling in a form no longer replaces the automatic schema of the page with an empty type. A chosen Review, Event, VideoObject or Product now prints only when the post has what it needs (a rating from 1 to 5, a start date, a video address, a price), and a Review no longer gets a rating of 5 that nobody gave.

v1.2.5 Improvement Oct 11, 2026

Auto-Link (Pro add-on): when no internal link could be added

• Needs Rank Forge Pro 1.2.5 or newer if you run the add-on, as before.
• Auto-Link (Pro add-on): when no internal link could be added, the button no longer says "Linked!" and reloads the page; it shows why nothing was added and leaves the post as it was.
• Redirects: a rule of type 410 (Gone), for example one imported from SEOPress, now answers "410 Gone" with your theme's 404 page. Before, the visitor saw a WordPress error page.
• Settings: saving the Settings screen no longer deletes settings that have no field on it, such as the switch that turns off the cleaning of image file names.
• Local SEO: the Veterinarian and Locksmith business types now use the real schema.org types (VeterinaryCare and Locksmith); the old names are not schema.org types, so search engines skipped them. A type saved earlier is carried over by itself.
• Local SEO: saving the form no longer drops the business image address that an import or code had set, so "image" stays in the markup.
• Content Brief (Pro add-on): the heading structure and the target word count of a brief now show on the screen, in new briefs and in saved ones.
• Video schema: embedUrl now belongs to the same video as contentUrl, not to another video on the page.

v1.2.4 Improvement Oct 9, 2026

The AI buttons on the Local SEO and Schema screens

• Needs Rank Forge Pro 1.2.5 or newer if you run the add-on, as before.
• The AI buttons on the Local SEO and Schema screens, the Fix buttons in the SEO box and its "AI-Powered" mark show only while Rank Forge Pro reports its AI features running, so no button leads to "Pro add-on is not running".

v1.2.3 Improvement Oct 9, 2026

Fix: the Dashboard screen shows its header and styles again

• Fix: the Dashboard screen shows its header and styles again.
• Deleting the plugin now cleans up on every site of a network, not only the main one. When it is the last Forge product on the site, everything the Forge plugins keep in common goes too; while another Forge product is still installed, that shared data stays for it.

v1.2.2 Improvement Oct 8, 2026

robots.txt: the physical /robots.txt file is now written only through WordPress's own file

• robots.txt: the physical /robots.txt file is now written only through WordPress's own file API, and only where WordPress can write to the site root directly. On a host that would ask for FTP details nothing is written and no credentials are requested; the screen then says WordPress is not allowed to write there and what to do (delete the file over FTP or in the hosting control panel, and Rank Forge serves the robots.txt built from your settings).
• The Google Search Console card (Settings, Integrations) no longer carries a sentence about where the sign-in runs, and this package draws no sign-in button on it: with the Rank Forge Pro add-on active the card points to the add-on's Analytics & Traffic screen, where Google is connected; without the add-on it names the add-on and links to its page, as before.
• Two admin messages (the status line of the AI features and the hint for a robots.txt that visitors get from somewhere else) and the code comments are reworded to say what happens for you. Nothing the plugin does has changed.

v1.2.1 Improvement Oct 7, 2026

When a shortcode in an FAQ answer or in a HowTo or Recipe step throws while Rank Forge

• When a shortcode in an FAQ answer or in a HowTo or Recipe step throws while Rank Forge builds the schema markup, the fragment still goes in with its shortcodes stripped, as before, and the new action rankforge_schema_shortcode_failed now tells your site, with what was thrown, the post and the fragment. Nothing is written to a log by default: hook your own logging onto the action if you want to know. What a handler prints stays out of the page head, and an error it throws goes no further.

v1.2.0 Improvement Oct 7, 2026

The Dashboard's first card runs the site-wide analysis on the card itself

• The Dashboard's first card runs the site-wide analysis on the card itself, with its progress, and then names your weakest post, its main issue and a link to its editor, instead of sending you to Settings. While only some of your posts have a score it shows “N of M analyzed” rather than “No urgent fixes”, and “Analyze the remaining” finishes an interrupted run without starting over.
• The site-wide analysis, from that card and from Settings → Automation, now covers every type of post Rank Forge analyzes (pages, products and other public types, not only posts) and any number of them, instead of the first 100 posts. It no longer fails on a site in a sub-directory or with plain permalinks. Posts that cannot be analyzed are counted with a link to the first one, and failed requests get a “Try again” button.
• The Dashboard's “posts without description” and “posts without keyword” counts cover the same post types as the analysis (products and other custom types included, not only posts and pages), and a post you cannot edit is listed without a link.
• The Dashboard cards “Add missing meta descriptions” and “Set focus keywords” open the posts they counted: the list of the post type with the most of them, with a line saying what is shown and a “Show all” link, and the other types that have such posts as links with their counts. The list stays narrowed when you search or filter it.
• “Most common issues” on the Dashboard counts each check once, in your language: the same check with other numbers in its text used to be several lines, and a site analyzed in two languages showed every check twice.
• The XML sitemap writes every <lastmod> in UTC. On a site set to a time zone behind UTC the dates ran ahead of the real time, and search engines can ignore a date in the future. A post without a valid modified date has no <lastmod>.
• The “AI Search Readiness” report that the Pro add-on runs from the post editor now lists its strengths and suggestions under the score (only the score showed until now), and shows them as plain text.
• The automatic FAQ markup and the HowTo and Recipe steps now contain what the page shows: shortcodes in a question, answer or step are rendered before the tags are removed, and words in separate blocks no longer run together. The answer to the last question now has an end: it stops at a form, aside, navigation or footer and keeps its first 150 words. A shortcode that throws or prints can no longer break the page head. The rankforge_schema_render_shortcodes filter turns the rendering off.
• The Indexing tab of the Analytics section no longer opens “Sorry, you are not allowed to access this page.” when the Pro add-on is active without a licence; the screen that names the add-on is shown instead.
• New filter rankforge_canonical_url: another plugin can change a post's custom canonical URL, or withdraw it by returning an empty string, in which case Rank Forge prints no canonical tag for that post.

v1.1.13 Improvement Oct 5, 2026

Deleting the plugin leaves the job queue the Forge plugins share in place while another

• Deleting the plugin leaves the job queue the Forge plugins share in place while another Forge plugin or add-on is still on the site. The check used to miss add-ons, and Rank Forge installed from wordpress.org, so the queue could be dropped while a neighbour still had jobs in it.
• The readme no longer says the XML sitemap is hreflang-aware when Lang Forge is active: the sitemap lists no language alternates, with or without Lang Forge.

v1.1.12 Improvement Oct 1, 2026

This release needs Rank Forge Pro 1.2.5 or newer if you run the add-on

• This release needs Rank Forge Pro 1.2.5 or newer if you run the add-on. The licence screen, the upgrade prompt and the upgrade banner moved into the separate Rank Forge Pro add-on; this plugin only notes which features the add-on provides, with a link to its product page. An older add-on stays switched off until it is updated, and an admin notice names both versions. Nothing already saved is changed.
• The post editor shows no AI buttons unless the add-on runs them — no locked "AI" buttons and no upsell dialog. One line under the SEO title and description says where the AI suggestions come from.
• Settings no longer link to an upgrade: the AI, auto internal linking and Google Search Console sections say that they come with the add-on.
• The screens the add-on provides (Google Search Console, Site Audit, Content Brief) name it, with a link, instead of showing a locked page.

v1.1.11 Improvement Sep 30, 2026

The PRO badge in the menu and in the section tabs marks a screen the Rank Forge Pro add-on

• The PRO badge in the menu and in the section tabs marks a screen the Rank Forge Pro add-on provides and this site does not have. It follows whether the add-on is installed, not the licence.
• The screens the add-on provides check for it themselves before they open, not only through the menu entry that leads to them. No visible change.
• The wordpress.org package no longer loads bundled translation files it does not carry: its translations arrive as language packs, which WordPress loads by itself.

v1.1.10 Improvement Sep 18, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.1.8 Improvement Sep 10, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.1.7 Improvement Sep 9, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.1.6 Improvement Sep 3, 2026

Smaller package and one less admin surface: the SDK’s own menu

• Smaller package and one less admin surface: the SDK’s own menu, opt-in screen and promotional notices are gone.

v1.1.5 Improvement Sep 2, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.1.4 Improvement Sep 2, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.1.2 Improvement Aug 25, 2026

The custom canonical tag is now printed directly at its hook

• The custom canonical tag is now printed directly at its hook. The plugin used to buffer the entire head output between two hooks so competing canonical tags could be stripped from it; that buffer is gone. WordPress core's canonical is still suppressed while a per-post custom canonical is set, and Yoast's through its filter, so the URL you set is still the one that ships.
• Every value handed from PHP to inline JavaScript is JSON-encoded with hex escaping for the characters that could end a script block, so translations and settings can never terminate the tag they sit in.
• The bulk AI-fix endpoint no longer raises the PHP memory limit — its capped, sequential work never needed the headroom.
• Removed an unused helper that assigned window globals.

v1.2.11 Improvement Oct 13, 2026

Alt text and caption of a picture can be translated

• Alt text and caption of a picture can be translated. The Media Translations box on the full Edit Media screen of a picture (pictures only, not PDF or video files) now saves what you type for each language; before, the fields were shown and nothing was kept. A page in that language shows them: pictures in posts and pages, the WooCommerce product gallery in a classic theme (main picture, thumbnails, lightbox, the picture of a chosen variation) and the Product Gallery block of a block theme (alt text of the main picture, thumbnails and lightbox). A language left empty shows the text of the main language. The alt text and the caption of the media library and of the original language stay as they are.
• Fixed: the text WooCommerce saves with a variation (for example "Color: Red" or "Color: Rojo") could take the attribute value in the wrong language when a plugin or the theme works on a copy of the value while it is read. It keeps the language of the product now.
• Fixed: on a site where a language has its own subdomain or its own domain, the summary of a translated variation showed the original name ("Red", or "Crimson" after you renamed the value) instead of "Rojo" when you saved the variation or renamed an attribute value in the admin of that language. It stays in the language of the variation.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.10 Improvement Oct 13, 2026

Strings that differ only in letter case or accent

• Strings that differ only in letter case or accent ("Size" and "size", "Resume" and "Résumé") are now separate strings on the String Translation screen, each with its own translation on the translated page. Before, the second one was never listed and the page showed the translation of the first. The first admin page you open after the update changes the strings table; your strings and translations are kept. On a store with more than 500,000 strings run wp langforge strings-key --yes (see the FAQ).
• The "Find WooCommerce strings" button goes on from where it stopped after you close the tab or the connection drops, says "Continuing the last search from where it stopped." and does not count a string twice. A new "Start over" link searches from the beginning.
• WooCommerce refund emails go out in the language of the order, with the subject, heading and text you saved or translated, also when two refunds are sent in one request. Fixed: the second email of such a request could go out with the default WooCommerce text.
• Fixed: saving the WooCommerce email settings from a page in a translated language, or through the REST API, could store the translated texts as the texts of the original.
• The summary WooCommerce saves with a variation of a translated product (for example "Color: Red") is written in the language of that product, whichever language the page is in when the variation is saved. The variation of the original product keeps the original language.
• The hint above the values of an attribute without Enable archives? now says that each value you save is listed on the String Translation screen and that "Find WooCommerce strings" lists the values saved before. Before, it sent you to Add New String.
• New WP-CLI command wp langforge strings-key: it shows the state of the strings table and, with --yes, rebuilds its key on a store with a very large strings table.
• wp langforge import now lists, one line each, the rows of the file that the import did not take as written (a row the page has no place for, tags that were mended, a block that was rebuilt), the same notes the import screen shows. It needs Lang Forge Pro 1.3.5, which reports them; with an older Pro the command prints only the count.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.9 Improvement Oct 13, 2026

The String Translation screen now lists the texts of your WooCommerce emails

• The String Translation screen now lists the texts of your WooCommerce emails (subject, heading, additional content and the footer), and a new "Find WooCommerce strings" button looks through the shop in small steps and adds the texts, attribute names and attribute values that were saved before. A translation typed there is used in the email sent in the language of the order, the partial refund email included; a text without a translation stays as you wrote it. Links in a translated email text are kept, scripts are removed.
• Translated posts now open under the language folder with every permalink structure, for example "Month and name", "Numeric", with a category, an author or a /blog/ base, and so do custom post types under a base such as /blog/. The next pages of a post or a page (/es/my-post/2/) and its comment pages open too, and the links of "Pages: 1 2 3" keep the language folder. Fixed: with these structures the address of a translated post led to the language home page.
• The names of the values of a variable product's attributes on a translated page are in the language of the page also on a store with a persistent object cache (Redis, Memcached). Fixed: they could come out in the language of the visitor who opened the product first.
• The screen of the values of an attribute without Enable archives? now explains how to translate its values.
• After you remove a language, the "Orphaned translations" notice (Leave published, Move to Draft, Delete permanently) shows also on a store with a persistent object cache, and its buttons work on every admin screen. Fixed: the notice could be lost, and on screens such as the Dashboard its buttons did nothing.
• The new post addresses start to work with the first page view after the update: you do not need to save Permalinks again.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.8 Improvement Oct 13, 2026

Feeds under a language folder now work: the feed of the site (/es/feed/), of a category

• Feeds under a language folder now work: the feed of the site (/es/feed/), of a category, tag, author or search, the comments feed of a post, and the comments feed of the language (/es/comments/feed/), which lists only the comments on posts in that language. The feed links in the head of a translated page point at them. Fixed: these addresses led to a page or to the feed of the default language.
• Archive pages under a language folder (category, tag, date, author, search results, the shop and a product category) now list their posts and products on a site with a static front page, and their page 2, author, search and date addresses open. Fixed: such a page could come out as the front page without posts, and some addresses sent the visitor to the language home page.
• A variable WooCommerce product on a translated page now shows the values of its attributes: a global attribute (for example Color) shows the name of its translated term, a custom attribute its translated values, and the name of the variation in the cart, the order and the emails is in the language of the product. A value that is not translated yet is shown in the language of the original. Fixed: the choices of a variable product could come out empty.
• The language of the page is kept by the login, registration, lost password and password reset forms (for example wp-login.php?lang=es): the screen after you send the form, the email and the link in it stay in that language when its language pack is installed.
• WordPress emails to the admin address in Settings, General (new user, password changed, comment waiting for moderation) are written in the language of the site also when no user has that address. Before, they followed the language of the page.
• The new feed and archive addresses start to work with the first page view after the update: you do not need to save Permalinks again.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.7 Improvement Oct 12, 2026

Variations of a variable WooCommerce product are now created for each translation

• Variations of a variable WooCommerce product are now created for each translation and follow the product in the default language: price, SKU, GTIN, image, attributes and shipping class. Translations made before get their variations the next time the original or the translation is saved.
• Stock changes (orders, refunds, edits) on a product or variation in any language now update the same product in the other languages, also a stock status set by hand (for example Out of stock) on a product that does not track its quantity.
• The price, SKU and stock of a product in the default language are copied to its translations by the save that changed them. Before, the translations received the values of the save before, and a price changed through the REST API, an import or another plugin could miss them.
• A translated product may share its SKU or GTIN with the original without blocking the original's save.
• Saving a translated product no longer overwrites the original's price or stock status.
• The AI Translate button also translates variation descriptions.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.6 Improvement Oct 12, 2026

WooCommerce and WordPress texts on a translated page

• WooCommerce and WordPress texts on a translated page (cart, checkout, My account, login, field labels) are now shown in the language of that page when its language pack is installed. Before, they were in the language of the site.
• WooCommerce emails to the shop staff stay in the language of the site, also when they are sent from a translated page.
• WordPress emails to the site staff who have no language of their own in their profile (password changed, comment waiting for moderation, new user) are written in the language of the site; emails to customers in the language of the page.
• The texts of Lang Forge Pro on a translated page are now in the language of that page too.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.5 Improvement Oct 12, 2026

WooCommerce emails to the customer about an order

• WooCommerce emails to the customer about an order (order confirmation, status changes, customer notes, refunds, invoices) are now written in the language the order was placed in, also when they are sent from wp-admin, in bulk, by a scheduled task or through the REST API: subject, heading and text. A subject, heading or additional text saved in the email settings is sent as saved. Emails to the shop staff stay in the language of the site. Before, customer emails went out in the language of the screen or task that sent them. With WPML active, for a language that is not enabled in Lang Forge, or for a language whose WordPress language pack is not installed, emails go out as before.
• Orders placed through the Checkout block are saved in the language of the cart or checkout page the customer saw last. Before, on a site that uses language folders or ?lang= in the address, such an order could be saved in the default language.
• With the Checkout block on a translated page, the customer is now sent to the thank-you page in the language of the order. Before, the address had no language folder.
• WooCommerce pages under a language folder (for example /es/my-account/orders/ and the thank-you page /es/checkout/order-received/123/) now open. Before, the visitor saw "page not found", or was sent to the language home page when "Use fallback languages" is on. The same applied to pages of other plugins that add their own page endpoint.
• Translated Cart, Checkout and My account pages now tell page caches not to store them, the same way the original pages do.
• The Plain language switcher now shows the language name (for example "Deutsch") instead of the language code ("de") when the Display field of a language in Languages is empty or holds just the code. Before, saving the Languages form put the code into an empty Display field, and Plain printed it. A label you typed yourself (for example "eng" or "DE") is kept as it is.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.4 Improvement Oct 12, 2026

Custom fields are now copied to a new translation exactly as they are stored

• Custom fields are now copied to a new translation exactly as they are stored. Before, a custom field with several values kept only the last one, and a field that holds a list of settings or text with backslashes (page builder data, custom CSS) could come out changed in the translation.
• The copies made for Divi, Elementor, Yoast SEO and WooCommerce no longer drop the backslashes of a value, for example in custom CSS.
• The TranslatePress migration copies custom fields the same way. Before, it removed backslashes from page builder data and could stop with an error on a field that holds an object.
• Translations that were made before this update are not changed.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.3 Improvement Oct 12, 2026

The "Link" button next to a translation now refuses a post that is the original itself

• The "Link" button next to a translation now refuses a post that is the original itself, that does not exist, that is of another type (a page for a post, for example) or that is in the Trash, and it says why. Before, it accepted the original itself, a post of another type and a post in the Trash, and a missing post got only the word "Forbidden".
• After a failed "Link" attempt the button keeps its own label. Before, it changed to "Link existing".
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.2 Improvement Oct 11, 2026

The dropdown language switcher can now be opened without a mouse

• The dropdown language switcher can now be opened without a mouse. It opens when you reach it with the keyboard or tap it on a touch screen, and the language you are on shows a visible outline. Before, the list opened only on mouse hover, so keyboard and touch users could not pick a language.
• The Language Switcher box on the settings page no longer suggests a menu item as a placement. It names the placements that exist: widget, shortcode and template function.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.1 Improvement Oct 11, 2026

Fixed a fatal error on sites that run WooCommerce

• Fixed a fatal error on sites that run WooCommerce. The 1.2.0 package from WordPress.org called a function that was not in the package, so a page with an Add to cart button, a product attribute label or WooCommerce breadcrumbs could stop with an error. If you run WooCommerce, update now.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.2.0 Improvement Oct 9, 2026

With Lang Forge Pro 1.3.0 or newer, AI translation no longer fills a part that did

• With Lang Forge Pro 1.3.0 or newer, AI translation no longer fills a part that did not come back with the source text: the whole request fails with its own message and nothing is written. The parts that did come back are kept for an hour, so a second try pays only for the parts that failed, and a post with no content (or no title and excerpt) sends no empty request.
• With Lang Forge Pro 1.3.0 or newer, a kept draft with a failure record has a Retry AI translation button on its language row (post box and posts column), and a second click on an AI button while its request is out does nothing.
• The record of a failed translation is kept per language, so two jobs of one post can no longer drop each other's record. A record written by an older version is still read and moved.
• WP-CLI export: --output must be a plain file name with one dot and an export extension (csv, xliff or xlf) and --lang a plain language code; a refused call stops before any query is run or any folder is made.
• Deleting the last Forge plugin or add-on on a site now removes everything Forge stored on the site, on every site of a network: the statistics settings and the install ID, the shared job queue with its scheduled events, and the other settings and caches the Forge plugins share. While another Forge product stays, only this plugin's own share goes.
• Needs Lang Forge Pro 1.1.4 or newer if you run the add-on, as before.

v1.1.0 Improvement Oct 7, 2026

The functions that WPML-style theme code calls — icl_object_id()

• The functions that WPML-style theme code calls — icl_object_id(), the wpml_object_id filter and langforge_get_translation() (and langforge_get_post_translations()) — treat a translation that is not published (a draft, pending, scheduled or private one) as “no translation” when a visitor loads the page: they return the original page when your code asks for it, or nothing, so the address of an unpublished page never reaches the theme. This differs from WPML, which does not hold a draft translation back. In WP-CLI, for a signed-in user who can edit that translation (in the admin, over REST or AJAX) and for an editor previewing the draft they answer as before; a signed-in user who cannot edit it, such as a subscriber, gets the visitor’s answer there too.
• The hreflang sitemap now gives each language the same code as the page head, written the way hreflang wants it: de instead of de-de, en-US instead of en-us, and es-MX instead of es-mx for a language with a region of its own; the page head now says es-MX for such a language too, where it said es_mx.
• With Rank Math, Yoast SEO, All in One SEO, SEOPress or The SEO Framework active, a page has one canonical link instead of two, and the SEO plugin's own og:locale tag alone instead of two (none where it prints none, as with its Open Graph switched off). The canonical is the page's own language address unless one was typed into the SEO plugin for that page, and the og:locale:alternate tags are printed only where the SEO plugin prints its og:locale.
• A new translation no longer takes over the canonical URL typed in for its source page, and a translation that already holds the same canonical as its source is treated as having none (Rank Math, Yoast SEO, All in One SEO, SEOPress, The SEO Framework, and Rank Forge in a version that asks Lang Forge about it), so its canonical link names its own address. With The SEO Framework this needs version 5.0 or later, and with SEOPress its current versions: an older release does not offer the hook Lang Forge uses for the link, and there the translation keeps the canonical it holds.
• With Yoast SEO, such a translation also names its own address in og:url and in the schema data (the page's url and the ids built on it), where it used to name the source page there.
• A new translation no longer takes over the redirect SEOPress holds for its source page.
• With Lang Forge Pro 1.2.0 or newer, AI translation keeps the shortcodes of your content whole. Before a text goes to the AI, the tag of every shortcode on your site ([contact-form-7 id="12"], [gallery ids="1,2"], [button]…[/button]) is swapped for a placeholder, and the answer gets the tags back exactly as they were. If the AI changes or drops one, the translation is not saved and you are told so, instead of a broken form or gallery going into the translated page. Text inside a shortcode's attributes, such as the label of [button text="Buy"], is not translated and stays in the source language; the words between an opening and a closing tag are translated. A shortcode that a plugin registers only on the front end is not known during an AI translation in the admin: add its name with the langforge_ai_shortcode_tags filter to protect it too. The AI translation itself is part of Lang Forge Pro; without it, or with an older version, nothing changes.
• “Create + AI Translate” (Lang Forge Pro): when the AI does not translate the page it has just created, the edit screen of that page now says so, and why (out of credits, or another failure; with Lang Forge Pro 1.2.0 or newer also a shortcode the AI could not keep), where the message used to vanish with the screen you left.

v1.0.41 Improvement Oct 5, 2026

Deleting the plugin leaves the job queue the Forge plugins share in place while another

• Deleting the plugin leaves the job queue the Forge plugins share in place while another Forge plugin or add-on is still on the site. The check used to miss add-ons, and Rank Forge installed from wordpress.org, so the queue could be dropped while a neighbour still had jobs in it.
• Settings no longer shows the Translation Model card: this package has no AI translation, so the card had nothing to describe.

v1.0.40 Improvement Oct 1, 2026

This release needs Lang Forge Pro 1.1.4 or newer if you run the add-on

• This release needs Lang Forge Pro 1.1.4 or newer if you run the add-on. The licence screen, the upgrade prompt and the upgrade banner moved into the separate Lang Forge Pro add-on; this plugin only notes which features the add-on provides, with a link to its product page. An older add-on stays switched off until it is updated, and an admin notice names both versions and where to download the add-on. Translations already saved are untouched.
• String Translation shows no AI Translate button unless the add-on runs AI translation — no locked button. One line says where AI translation comes from.
• Settings and Tools no longer link to an upgrade: AI translation, Translation Memory and one-click site duplication say that they come with the add-on.
• The screens the add-on provides (Visual Editor, Analytics, Translation Memory, Import / Export) name it, with a link, instead of showing a locked page.

v1.0.39 Improvement Sep 30, 2026

Glossary opens with no licence check

• Glossary opens with no licence check. It has always been part of this plugin, and the menu no longer puts it behind a gate that could only answer yes.
• The PRO badge in the menu and in the section tabs marks a screen the Lang Forge Pro add-on provides and this site does not have. It follows whether the add-on is installed, not the licence.
• The String Translation help shows the [langforge_string] shortcode. The old [lf_string] form keeps working in existing content.

v1.0.38 Fix Sep 23, 2026

Fixed: on a site without WPML or Polylang, the first activation made Russian the default

• Fixed: on a site without WPML or Polylang, the first activation made Russian the default language and added English under /en/, whatever language the site was written in. A fresh install now starts with the site's own language (Settings → General → Site Language) as its only language, so an English site stays English; add more languages under Lang Forge → Languages.

v1.0.37 Improvement Sep 18, 2026

This release needs Lang Forge Pro 1.1.0 or newer

• This release needs Lang Forge Pro 1.1.0 or newer. An older add-on is switched off whole rather than left running, because beside this core it would be present and wrong rather than absent. Until you update it AI translation, bulk AI translation, translation memory, translation QA and the frontend editor are unavailable. Translations already saved are untouched, an admin notice names both versions and what stopped, and installing the current add-on brings all of it back.
• Deleting the last Forge product on a site now clears the job queue the Forge plugins share — its table, its two scheduled events and its version marker. While any other Forge product is still installed, deleting this one leaves the queue exactly as it is, because the pending jobs in those rows are that product's too.
• Fixed: Lang Forge → Tools stopped with a fatal error on a site whose licence includes bulk duplication while the Pro add-on is not loaded. The card shows the Pro teaser instead.

v1.0.36 Improvement Sep 10, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.0.35 Improvement Sep 9, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.2.6 Improvement Oct 13, 2026

If WP-Cron does not start a Fillin Forge task on time

• If WP-Cron does not start a Fillin Forge task on time (a retry that adds a booking to your calendar, a row for Google Sheets, a payment check) and the task is more than 15 minutes late, the Fillin Forge screens now tell administrators, and the notice can be hidden for a day. The button "Run them now" starts up to 10 such tasks per press.
• Tasks that Fillin Forge Pro handles are neither run nor removed while Pro is off or too old, and the notice says so.
• On a site with DISABLE_WP_CRON the notice advises a system cron job and links to how to set one up.
• The payment number in e-mails, Slack messages and webhooks is now labelled "Payment ID", as on the submission screen. Before, it said "Payment intent".
• Deactivating Fillin Forge now removes its scheduled retries for calendar events and Google Sheets rows. Before, retries that carried data stayed in the queue.
• The new texts are translated into the 15 languages the plugin ships in.
• Needs Fillin Forge Pro 1.3.0 or newer if you run the add-on, as before.

v1.2.5 Improvement Oct 13, 2026

If you take bookings into Google Calendar, update Fillin Forge Pro to 1.3.6 as well

• If you take bookings into Google Calendar, update Fillin Forge Pro to 1.3.6 as well. With an older add-on the link below already works, but a booking whose event could not be created is neither marked nor reported.
• Submissions: a booking whose calendar event could not be created (Fillin Forge Pro 1.3.6 marks it) shows its own sentence next to "Time not confirmed", in the list and in the submission window: check your calendar, add the event if it is not there, and confirm the time with the visitor.
• The e-mail "Time not confirmed in the calendar" has its own wording for an event that could not be created: its subject ends with "the event could not be created", and the text says to check the calendar and add the event if it is missing.
• The link in that e-mail now opens the Submissions list on the page that holds the submission and scrolls to its row. Before, it opened the first page of the list, and an older submission could be pages away.
• The new texts are translated into the 15 languages the plugin ships in.
• Needs Fillin Forge Pro 1.3.0 or newer if you run the add-on, as before.

v1.2.4 Improvement Oct 13, 2026

If you take bookings into Google Calendar, update Fillin Forge Pro to 1.3.5 as well

• If you take bookings into Google Calendar, update Fillin Forge Pro to 1.3.5 as well. With an older add-on the time picker below already works, but a booking whose time could not be confirmed is neither marked nor reported.
• Time picker: on a form that books into Google Calendar (Fillin Forge Pro), when the free times cannot be loaded, the picker now says "Could not load free times. Please try again later." and offers no time, where it used to show every time of the day as free. Without Pro, or after the Pro trial has ended, nothing changes here.
• Time picker: the same message shows when the request for the free times fails altogether or its answer cannot be read. The browser used to offer every time of the day unchecked.
• Time picker: when the date is changed quickly, a late answer for an earlier date no longer replaces the times of the date shown now, and no longer clears the time already picked.
• Submissions: a booking whose time was not put in the calendar shows "Time not confirmed" in the list and in the submission window, with a sentence on what to do. Fillin Forge Pro 1.3.5 sets the mark.
• A short e-mail "Time not confirmed in the calendar" goes to the form's notification address for such a booking. Fillin Forge Pro 1.3.5 asks for it; a form with its admin notification switched off gets none.
• The new texts are translated into the 15 languages the plugin ships in.
• Needs Fillin Forge Pro 1.3.0 or newer if you run the add-on, as before.

v1.2.3 Improvement Oct 12, 2026

If you take card payments, update Fillin Forge Pro to 1.3.4 as well, and Pro first

• If you take card payments, update Fillin Forge Pro to 1.3.4 as well, and Pro first. The add-on now confirms every payment with Stripe. With an older Pro a notice asks you to update it, and every paid submission is saved as "Payment not confirmed" until you do (they are checked again by themselves afterwards).
• Payments: a card payment is no longer saved as paid just because a payment id came with the form. Fillin Forge asks Fillin Forge Pro to confirm the payment with Stripe, and the amount saved with the submission is the one Stripe holds, not the one the browser reported.
• Payments: a payment that does not exist, belongs to another form, was not paid or already belongs to another submission is refused, and the visitor is told that the payment could not be verified.
• Payment statuses in words: a submission paid for another amount than its values come to is kept as "Paid amount differs", a payment nobody could confirm yet as "Payment not confirmed", and one Stripe holds no completed payment for as "Not paid". The notification, the list, the submission, the PDF and the export say so, with a sentence on what to check.
• The submission shows a "Check payment in Stripe" button (from Fillin Forge Pro 1.3.4) for a payment that is not confirmed yet.
• Saving a form tells you when a payment amount comes from a calculation the server cannot repeat.
• Payment field: the editor opened an old fixed payment amount in a currency without hundredths (JPY, for example) divided by 100, so 1000 yen showed as 10.00 and was saved as 10. It now shows the amount as it was typed.
• Needs Fillin Forge Pro 1.3.0 or newer if you run the add-on, as before.

v1.2.2 Improvement Oct 11, 2026

If you take payments in a currency without hundredths

• If you take payments in a currency without hundredths (JPY, KRW, VND, CLP, or another one Stripe counts in whole units: BIF, DJF, GNF, KMF, MGA, PYG, RWF, VUV, XAF, XOF, XPF) and got around the old mistake below by typing a price 100 times smaller, put the real price back as soon as Fillin Forge Pro 1.3.3 is installed, because the fix for the charge is in the add-on. After that a price is charged exactly as typed, so the small price would be charged as the small price.
• Payment amounts: every currency was counted in hundredths, so a price of 1000 JPY in the payment field was charged as 100,000 JPY. Amounts are now counted in the currency's own unit (whole yen for JPY, cents for USD), and the amount saved with a submission is shown the same way, for example JPY 1,000 or USD 10.00. The payment field itself is in Fillin Forge Pro, so if you run the add-on, update it to 1.3.3 as well.
• Rating field: clicking a star now tells conditional logic and calculations, so a field that shows, hides or adds up depending on the rating changes straight away.
• Templates: Market Research and General Survey no longer bring a page break field, which only works with Fillin Forge Pro. Without it, saving turned that field into a text input labelled "(Requires Pro)"; now the form is a single page. In Internship Application the graduation year list starts at the current year, and in Service Appointment the vehicle year goes up to next year, instead of years fixed in advance.
• The rule for which fields of a form hold a value is now kept in one place, so the Google Sheets rows of Fillin Forge Pro keep their columns in the form's order.
• Needs Fillin Forge Pro 1.3.0 or newer if you run the add-on, as before.

v1.2.1 Improvement Oct 9, 2026

A Forge plugin deleted a moment earlier in the same bulk delete is no longer counted

• Deleting the last Forge plugin or add-on on a site now removes everything Forge stored on the site, on every site of a network: the statistics settings and the install ID, the shared job queue with its scheduled events, and the other settings and caches the Forge plugins share. While another Forge product stays, only this plugin's own share goes.
• A Forge plugin deleted a moment earlier in the same bulk delete is no longer counted as still installed, and a Forge plugin for WooCommerce no longer keeps the shared data on the site for good.
• Needs Fillin Forge Pro 1.3.0 or newer if you run the add-on, as before.

v1.2.0 Improvement Oct 8, 2026

Fixed: the form editor's preview ended in an error

• This release needs Fillin Forge Pro 1.3.0 or newer if you run the add-on. The licence layer is the add-on's alone now: the free plugin no longer loads any licence code (the wordpress.org package has none at all), and its Settings screen asks the add-on, not a licence key, whether Mailchimp, HubSpot and Google can be connected. An older add-on is kept from starting. A notice, shown only to a user who can update plugins, names the version it needs and links to the downloads page of your Avakode account.
• Fixed: the form editor's preview ended in an error, because the preview request called a check that had been renamed. It now runs the same checks as saving a form.
• Fixed: with an out-of-date Fillin Forge Pro add-on installed, saving a form no longer turns its Pro fields into text or switches its Pro settings off, so the add-on's update finds them as they were. The cards of the form editor that ask for the add-on say to update it, with a link to the download, instead of offering it for sale.
• Wording: the Maps (Address Picker) card no longer says the map field needs Pro, and the integration cards drop the repeated “Requires Pro” sentences. The Mailchimp and HubSpot notes say the key is stored on the Avakode server. The Post Submission and User Registration cards of the form editor show the invitation to Fillin Forge Pro and none of the add-on's inputs when the add-on is not installed.
• With the add-on active, an AI generation error that needs your Avakode account opens the Fillin Forge Pro settings instead of a dashboard screen that this plugin does not have.
• The changed lines are translated in all 15 shipped languages.

v1.1.0 Improvement Oct 7, 2026

New: a “Send a test submission” button in the form editor

• New: a “Send a test submission” button in the form editor. It sends one sample submission through the saved form by the same code a visitor's submission goes through (validation, the saved record, the notification email), so you can check a form without filling it in. The record is marked Test; the notification email starts with “[Test]” and says it is a test; any email field gets your own address, so the auto-reply comes to you. reCAPTCHA is not asked for, and nothing goes on to webhooks, integrations, post or user actions or analytics.
• When a form cannot be tested, the button says why in plain words: a required file upload, a payment field, a required field whose pattern or length limit no sample value can meet, or an admin page opened at a different address from the site's.
• Test submissions are left out of the counts, the exports and the analytics, and out of the REST submissions list unless it is asked for status=test.
• A star rating must be a whole number from 1 up to the field's number of stars. A rating of 0 counts as “not rated”: an optional field accepts it and a required field asks for a rating.
• Fixed: every Fillin Forge admin screen raised a PHP warning, and the builder preview linked a stylesheet the free plugin no longer ships. The conversational layout's stylesheet now comes from the Pro add-on.
• The new lines are translated in all 15 shipped languages.

v1.0.41 Improvement Oct 5, 2026

Deleting the plugin leaves the job queue the Forge plugins share in place while another

• Deleting the plugin leaves the job queue the Forge plugins share in place while another Forge plugin or add-on is still on the site. The check used to miss add-ons, and Rank Forge installed from wordpress.org, so the queue could be dropped while a neighbour still had jobs in it.

v1.0.40 Improvement Sep 30, 2026

Internal clean-up in the documentation of a shared helper; no change in behaviour

• Internal clean-up in the documentation of a shared helper; no change in behaviour.

v1.0.39 Improvement Sep 25, 2026

The free plugin no longer loads anything from Google or Stripe on its own screens

• This release needs Fillin Forge Pro 1.2.0 or newer if you run the add-on. The free plugin no longer checks licences at all: the Pro features — the Stripe payment field, Google Sheets, WhatsApp, HubSpot, conversational forms, analytics and AI generation — now carry their own code and their own licence check inside the add-on. An older add-on is switched off whole rather than left half-working.
• The free plugin no longer loads anything from Google or Stripe on its own screens; those scripts come with the add-on.
• Request input is sanitised where it is read, and admin output is escaped.

v1.0.38 Improvement Sep 18, 2026

This release needs Fillin Forge Pro 1.1.0 or newer if you run the add-on

• This release needs Fillin Forge Pro 1.1.0 or newer if you run the add-on. An older add-on is switched off whole rather than left running, because beside this core it would be present and wrong rather than absent. Until you update it Post Submission, User Registration, multi-step and conversational forms, payment, repeater and calculation fields, AI form generation and the analytics screens are unavailable. Forms already saved and the submissions already collected are untouched, an admin notice names both versions and what stopped, and installing the current add-on brings all of it back.
• Deleting the last Forge product on a site now clears the job queue the Forge plugins share — its table, its two scheduled events and its version marker. While any other Forge product is still installed, deleting this one leaves the queue exactly as it is, because the pending jobs in those rows are that product's too.
• The Conditional Logic section no longer shows a PRO badge — conditional logic is part of the free plugin.
• Admin screens load their scripts and styles through WordPress instead of inline tags, and file writes go through the WordPress filesystem API.

v1.0.37 Improvement Sep 10, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.0.36 Improvement Sep 9, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.0.35 Improvement Sep 3, 2026

Smaller package and one less admin surface: the SDK’s own menu

• Smaller package and one less admin surface: the SDK’s own menu, opt-in screen and promotional notices are gone.

v1.0.34 Improvement Sep 2, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.0.33 Improvement Sep 2, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.0.32 Improvement Sep 2, 2026

The inline assets of the docs link are emitted as a literal nowdoc block instead of being

• The inline assets of the docs link are emitted as a literal nowdoc block instead of being assembled in an output buffer.

v1.0.30 Improvement Jul 17, 2026

Security hardening: all dynamic output is now escaped late at the output site

• Security hardening: all dynamic output is now escaped late at the output site with the context-appropriate function (esc_html/esc_attr/esc_url, esc_html__ for translated strings used as format strings, and wp_kses for trusted pre-built admin/field markup). No behavioural changes.

v1.0.29 Improvement Jul 11, 2026

Pro-only features (Post Submission, User Registration, multi-step forms, conversational

• Pro-only features (Post Submission, User Registration, multi-step forms, conversational mode, repeater and calculation fields) are now provided entirely by the Fillin Forge Pro add-on and are no longer bundled in the free plugin — the free download contains only fully-functional free features.
• Removed the leftover form-count limit scaffolding; the free plugin has always supported unlimited forms.

v1.1.6 Improvement Oct 12, 2026

Text and Textarea fields get a Character limit setting: the box stops at the limit

• Text and Textarea fields get a Character limit setting: the box stops at the limit, and a text over it is not saved. The field keeps its previous value and you see a notice. With Field Forge Pro 1.1.14 the limit also holds inside Repeater, Group and Flexible Content fields and on options pages.
• Character limits already stored in your field groups (an ACF import, the SEO Settings template) now take effect. A saved text that is already longer is kept, with a note under the field.
• Checkbox and Radio fields get a Layout setting: vertical or horizontal.
• The Post Template location rule offers a list of your theme's templates instead of a text box.

v1.1.5 Improvement Oct 12, 2026

Field group editor: location rules can now be set by Post Category and Post Taxonomy term

• Field group editor: location rules can now be set by Post Category and Post Taxonomy term. Categories with the same name under different parents are listed as "Parent › Name".
• Fixed: Post Category and Post Taxonomy rules imported from ACF now apply to the right posts. A rule on a term that no longer exists matches no post.
• Fixed: a rule on a term with a non-Latin slug is no longer broken when the group is saved in the editor.
• On the new-post screen, a field group with a Post Category or Post Taxonomy rule is shown only when the new post fits the rule (a new post counts as being in the default category). Before, such a group was shown on every new post of its post type when it also had a Post Type rule, and was not shown at all when it had none.

v1.1.4 Improvement Oct 12, 2026

With the Field Forge Pro add-on: the sub-fields of a Repeater

• With the Field Forge Pro add-on: the sub-fields of a Repeater, Group or Flexible Content field now have Choices, Instructions and Placeholder settings in the group editor, and the edit screen shows them. Choices work for Select, Checkbox, Radio and Button Group, Placeholder for Text, Textarea, Number, Email, URL and Password. Before, a Select, Checkbox or Radio sub-field was drawn as a plain text box and had nowhere to enter its choices. A sub-field of a choice type with no choices entered is still a text box.
• Button Group is now in the sub-field type list. In a Button Group sub-field only the picked button looks pressed, and "Add Row" starts the new row with nothing picked in Radio, Checkbox and Button Group sub-fields.
• A value a row already holds that is not one of the sub-field's choices (for example text saved while the sub-field was still a text box) is shown as one more picked choice, and Update keeps it. A stored list is shown as text in a Textarea sub-field and as a picked choice in a Radio or Select sub-field.
• Dragging a Repeater or Flexible Content row no longer clears the picked Radio or Button Group choice in the other rows.
• ACF import: Clone fields keep their settings and targets; a target that was not imported is left out and named in the result.
• ACF import with Field Forge Pro (licence active): settings pages made in ACF 6.2+ or registered in code while ACF is active are created, and the values step copies their values for regular, Group and Repeater fields. Values already saved in Field Forge, including a Repeater's row count, are kept. A page that could not be created is named in the result.
• ACF import without Field Forge Pro: Repeater, Group, Flexible Content and Clone fields are no longer created; the rest of the group is imported and the result lists what was left out. A group made only of such fields is not imported.
• Fixed: a Clone field whose target field sits in a later field group, or lower in its own group, no longer breaks field lookups.
• Fixed (with the Field Forge Pro add-on): a Group in a Flexible Content row added with "Add Layout" lost the values typed into it on the first Update.

v1.1.3 Improvement Oct 12, 2026

After you rename a field and save the group, the saved values on your posts now show

• After you rename a field and save the group, the saved values on your posts now show under the new name right away. Before, they could keep showing under the old name for up to five minutes, until the short-lived cache expired. On a site with more than 2000 affected posts it can still take up to five minutes.
• A True/False field whose Default is no, false or off (capitals and spaces around the word do not matter) is no longer shown switched on before its first save. Before, any text in Default switched it on, including "no". An empty Default or 0 still means off; any other text still means on.

v1.1.2 Improvement Oct 12, 2026

Importing values from ACF now converts a Date Picker value from the format ACF stores

• Importing values from ACF now converts a Date Picker value from the format ACF stores (20261011) to the format Field Forge shows and saves (2026-10-11). Before, an imported date showed as an empty date box. Dates imported earlier are not changed.
• With the Field Forge Pro add-on (1.1.10 or newer): a Repeater inside a Flexible Content layout you have just added now appears at once with its Add Row button. Before, it was only a label, and rows could not be added to it in the editor. A Flexible Content field inside the new layout is drawn the same way.
• Changing the Label of a field that is already saved no longer changes its Name. Before, the Name followed the Label, and saving the group renamed the field. A field you have just added still takes its Name from its Label until you type a Name yourself, and typing a new Name in a saved field still renames it.
• A Date Picker value saved without dashes, such as 20261011 (the way ACF stores dates), is now saved as 2026-10-11 and shown in the date box. Before, the date box looked empty, and updating the post erased the date.

v1.1.1 Improvement Oct 11, 2026

The Cmd/Ctrl + Shift + F shortcut for Add Field in the field group editor now opens

• The Cmd/Ctrl + Shift + F shortcut for Add Field in the field group editor now opens the Add Field window. With Shift held the browser reports the key as a capital F, and the shortcut only recognised a small f, so nothing happened.

v1.1.0 Improvement Oct 9, 2026

Local JSON Sync writes field group files only inside the uploads folder

• Local JSON Sync writes field group files only inside the uploads folder (uploads/fieldforge-json by default) and no longer reads <theme>/fieldforge-json on its own. Groups saved from the site are in the database and are not affected. Groups that exist only as JSON in the theme folder stay on disk but are not listed until you add the folder with the fieldforge/local_json/load_paths filter and sync. A save path outside uploads falls back to the default; files already there are not moved.
• The ACF importer asks ACF where its Local JSON folders are, instead of working out the theme folder itself.
• Adding a Flexible Content row (a field type of the Field Forge Pro add-on) no longer leaves an output buffer open when one of its field renderers fails.

v1.0.41 Improvement Oct 7, 2026

The empty Field Groups list now says how many ACF field groups it found on the site

• The empty Field Groups list now says how many ACF field groups it found on the site and links to the migration screen. Only that screen, and only while the list is empty, looks for them, and only administrators see the note.

v1.0.40 Improvement Oct 5, 2026

Deleting the plugin leaves the job queue the Forge plugins share in place while another

• Deleting the plugin leaves the job queue the Forge plugins share in place while another Forge plugin or add-on is still on the site. The check used to miss add-ons, and Rank Forge installed from wordpress.org, so the queue could be dropped while a neighbour still had jobs in it.

v1.0.39 Improvement Oct 1, 2026

This release needs Field Forge Pro 1.1.5 or newer if you run the add-on

• This release needs Field Forge Pro 1.1.5 or newer if you run the add-on. The licence screen, the upgrade prompt and the upgrade banner moved into the separate Field Forge Pro add-on; this plugin only notes which screens the add-on provides, with a link to its product page. An older add-on stays switched off until it is updated: the Pro field types, Options Pages, the REST and GraphQL exposure and the AI actions stop, nothing already saved is changed, and an admin notice names both versions.
• The Options Pages screen and the JSON export and import on the Tools screen say that they belong to the add-on instead of showing a locked page.

v1.0.38 Improvement Sep 30, 2026

The "matches pattern" condition no longer changes PHP's regular-expression limits while it

• The "matches pattern" condition no longer changes PHP's regular-expression limits while it runs. A pattern that would run away is still stopped by PHP and treated as not matching.
• Options Pages management and the clone field check for the Field Forge Pro add-on at every place they use it. Nothing changes on a site with or without it.

v1.0.37 Improvement Sep 18, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.0.36 Improvement Sep 10, 2026

This release needs Field Forge Pro 1.1.0 or newer

• This release needs Field Forge Pro 1.1.0 or newer. An older add-on is switched off whole rather than left running, because beside this core it would be present and wrong rather than absent. Until you update it the Pro field types Repeater, Group, Flexible Content and Clone, Options Pages, the REST and GraphQL exposure and the AI actions are unavailable. Nothing already saved is changed, an admin notice names both versions and what stopped, and installing the current add-on brings all of it back.
• Deleting the last Forge product on a site now clears the job queue the Forge plugins share — its table, its two scheduled events and its version marker. While any other Forge product is still installed, deleting this one leaves the queue exactly as it is, because the pending jobs in those rows are that product's too.
• Fixed: in a group laid out in columns, the buttons under an image field ran past the column and the "Remove" button was cut in half. They wrap now, and the preview never outgrows the column it sits in.

v1.0.35 Fix Sep 10, 2026

Fixed: posts saved by 1.0.25–1.0.33 could hold a nested Group

• Fixed: posts saved by 1.0.25–1.0.33 could hold a nested Group, Repeater or Flexible Content as a separate top-level field, which left it out of its parent group in the editor. Updating moves those records back where they belong, in the background. The repair only moves a record whose parent is unambiguous and already on the post; anything it cannot prove it leaves exactly as it is.

v1.0.34 Fix Sep 10, 2026

Fixed: on a site migrated from ACF the post editor drew every custom field empty

• Fixed: on a site migrated from ACF the post editor drew every custom field empty while the site itself still rendered the values, and pressing Update then blanked the page. The editor now reads the same values the site reads, and the first save moves them into Field Forge's own storage.
• Fixed: a Repeater, Group or Flexible Content nested inside a group could be saved as a separate top-level field, so it disappeared from its parent.

v1.0.33 Fix Sep 9, 2026

Fixed: values in a Group, Repeater or Flexible Content field were dropped when a post

• Fixed: values in a Group, Repeater or Flexible Content field were dropped when a post was saved from the editor — an image picked into a group showed its preview and was empty again after Update. Simple fields were never affected. Introduced in 1.0.25; if you saved compound fields since then, re-enter and save those values once.

v1.0.32 Improvement Sep 9, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.0.31 Improvement Sep 3, 2026

Smaller package and one less admin surface: the SDK’s own menu

• Smaller package and one less admin surface: the SDK’s own menu, opt-in screen and promotional notices are gone.

v1.0.30 Improvement Sep 2, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.0.29 Improvement Sep 2, 2026

No change in this package: the release updated parts that ship only in the edition

• No change in this package: the release updated parts that ship only in the edition distributed through avakode.com.

v1.6.2 Improvement Oct 9, 2026

Needs GuardForge Pro 1.4.0 or newer if you run the add-on, as before

• Needs GuardForge Pro 1.4.0 or newer if you run the add-on, as before.

v1.6.1 Improvement Oct 9, 2026

Deleting the last Forge plugin or add-on on a site now removes everything Forge stored

• Deleting the last Forge plugin or add-on on a site now removes everything Forge stored on the site, on every site of a network: the statistics settings and the install ID, the shared job queue with its scheduled events, and the other settings and caches the Forge plugins share. While another Forge product stays, only this plugin's own share goes.
• A Forge plugin deleted a moment earlier in the same bulk delete is no longer counted as still installed, and a Forge plugin for WooCommerce no longer keeps the shared data on the site for good.
• Needs GuardForge Pro 1.4.0 or newer if you run the add-on, as before.

v1.6.0 Improvement Oct 8, 2026

This release needs GuardForge Pro 1.4.0 or newer if you run the add-on

• This release needs GuardForge Pro 1.4.0 or newer if you run the add-on. The licence class, the License screen, the upgrade prompt and the badge and credit count in the screen header moved out of this plugin into the GuardForge Pro add-on, and so did the Alerts screen. This plugin no longer carries any licence code: it asks only whether the add-on and its features are available. The License and Alerts items in the GuardForge menu now come from the add-on, so a site without it has neither.
• An add-on older than 1.4.0 is not started beside this version, because it would look here for code that has moved. A notice on the GuardForge screens, the plugin list and the dashboard asks for the update and says where to get the package; only users who can update plugins see it. Your logs, baselines and settings are kept.
• On a site without the add-on, the Lockdown, Geo-IP, Malware scanner and Cloudflare screens say that they are part of GuardForge Pro, a separate plugin, and link to its page. Nothing on them is locked or greyed out.
• The Vulnerabilities screen says the same: this package carries no advisory source of its own, and the advisory database is served by the add-on.
• The .htaccess protection is written and removed through WordPress's own insert_with_markers(), between the same BEGIN GuardForge and END GuardForge lines as before, so the block an earlier version wrote is replaced where it stands. If a BEGIN line has no END, the plugin leaves the file alone. The empty pair of lines that deactivation leaves no longer counts as protection in the hardening score.

v1.5.0 Improvement Oct 7, 2026

Settings: a check that has not run yet, such as the file-integrity scan on a new site

• Settings: a check that has not run yet, such as the file-integrity scan on a new site, is listed as “Not run yet” with a “Run first scan” button instead of under “Not working”. The “Not working” tile counts only what stopped working: a protection that ships off and that nobody has switched on counts under “Needs a decision”.
• A file-integrity monitor that is switched on but has completed no scan after a day is reported as not working, with a “Run scan now” button that returns to Settings and a note on WP-Cron. A monitor switched on outside Settings (WP-CLI, a deploy script, a database edit) is dated from the moment it is found on, so it can be reported too.
• A finished integrity scan refreshes the hardening score at once, so the “Not working” tile no longer stays red until the next daily capture, and a failure while the score is recalculated no longer breaks “Run scan now” or the Settings save.
• Reactivating the plugin puts the daily integrity scan back on the schedule when the monitor is switched on, and switching the monitor on or off outside Settings moves its schedule with it. A new install still schedules nothing.
• The sentences of the four checks on the first screen are translated into the plugin's fifteen languages instead of showing English.
• Rows that tie on the column they are sorted by now always show in the same order: the Cases list and the first screen, the Login log and Audit log pages (a row could land on two pages or on none), the Unblock IP list, the hardening checklist and the evidence of a login burst.
• With GuardForge Pro 1.3.1 or newer, the notice after “Fetch now” on the Vulnerabilities screen tells a failed download from a refresh and gives the reason.
• Next to the licensed Pro add-on, the first screen reports the add-on's vulnerability feed instead of saying the feed is not part of this version.

v1.4.0 Improvement Oct 5, 2026

With the Pro add-on's vulnerability database, the refresh card no longer says the database

• With the Pro add-on's vulnerability database, the refresh card no longer says the database updates every day when the add-on's own daily update is switched off, and it asks for a newer add-on when the installed one has no daily update of its own.
• New option vulndb_pro_updates, on by default: the add-on's new “Keep the vulnerability database up to date” switch is saved through it.
• Deleting the plugin leaves the job queue the Forge plugins share in place while another Forge plugin or add-on is still on the site. The check used to miss add-ons, and Rank Forge installed from wordpress.org, so the queue could be dropped while a neighbour still had jobs in it.

v1.3.6 Improvement Sep 30, 2026

The new-administrator alert fires however a user becomes an administrator

• The new-administrator alert fires however a user becomes an administrator: the profile screen, the Users list, the REST API, WP-CLI, wp_update_user(), set_role(), add_role(), add_cap() or a direct write to the user's capabilities. A promotion through the REST API, add_role() (which is what wp user add-role calls), add_cap() or a direct write used to send no e-mail and no alert. Saving an administrator with the role they already had is not reported as a new one.
• Role changes made through the REST API are written to the audit log as one entry with the roles the user now has and the roles they had, instead of an entry with an empty role. Several roles, and a role taken away, are written in full.

v1.3.5 Improvement Sep 24, 2026

No change in this package

• No change in this package.

v1.3.4 Improvement Sep 23, 2026

The file-integrity monitor is off until you switch it on

• The file-integrity monitor is off until you switch it on, and activation no longer schedules its daily lookup: the comparison asks api.wordpress.org for the official checksums, and no request goes out before you ask for one. "Run scan now" still runs a single scan whenever you press it.
• The Geo-IP screen names the path it actually reads the MaxMind database from, instead of assuming the default uploads folder.
• Generated admin markup — the log pagers, the enrolment QR code, the header logo and the alert channel cards — is escaped against an allowlist where it is printed.

v1.3.3 Improvement Sep 20, 2026

This plugin no longer writes into WordPress's own directories

• This plugin no longer writes into WordPress's own directories. A modified or missing core file is reported exactly as before, and the screen now links to Dashboard → Updates: re-installing WordPress is what puts core files back.
• The alerts screen loads its script through WordPress instead of printing it into the page.
• Two standing notices — the warning about an add-on too old for this core, and the staging banner — appear on GuardForge screens, the plugin list and the dashboard instead of on every screen in the admin.

v1.3.2 Improvement Sep 18, 2026

No change in this package

• No change in this package.

v1.3.1 Improvement Sep 18, 2026

Request input is unslashed and sanitised on every read

• Request input is unslashed and sanitised on every read, queries on the plugin's own tables are prepared, and admin screens escape their output.
• Two-factor and login CAPTCHA keys carry the full guardforge_ prefix. A challenge started before the update still completes, and uninstall now also removes the CAPTCHA transients.
• The plugin's site is now guardforge.app, and the plugin header links there.

v1.3.0 Improvement Sep 10, 2026

This release needs GuardForge Pro 1.2.0 or newer

• This release needs GuardForge Pro 1.2.0 or newer. An older add-on is switched off whole rather than left running, and here that is the safer half: an add-on from before 1.2.0 has never heard of staging mode, so on a copy of your site it would go on mailing alerts and pushing to Cloudflare while the banner promised silence. Until you update it alerts to Telegram, Slack or a webhook, the Cloudflare firewall push, automatic lockdown, patch by update, the WAF, malware scanning, AI threat analysis, required 2FA and audit export are unavailable. Your logs, baselines and settings are kept. An admin notice names both versions.
• Deleting the last Forge product on a site now clears the job queue the Forge plugins share — its table, its two scheduled events and its version marker. While any other Forge product is still installed, deleting this one leaves the queue exactly as it is, because the pending jobs in those rows are that product's too.

v1.2.1 Improvement Sep 9, 2026

Brand: new product icon and admin logo

• Brand: new product icon and admin logo.

v1.2.0 Improvement Sep 9, 2026

New in Pro, off until you switch it on: patch by update

• New in Pro, off until you switch it on: patch by update. When an advisory matching an installed plugin names the version that fixes it, and WordPress is offering an update that reaches that version, GuardForge installs it — on cron, one plugin per run, never during a page request — then e-mails you and writes it to the audit log. An allow list and a deny list decide what it may touch; a staging copy, a plugin directory that is a symbolic link, and anything that failed in the last twenty-four hours are all left alone. An update that is merely newer is never enough: without a named fixed version the rule does nothing.
• Cloudflare's published edge addresses are now refreshed daily instead of being a snapshot compiled into the plugin, and IPv6 edges are covered for the first time. A stale list is why a site behind a newer Cloudflare edge would log, count and geo-locate every visitor as the edge itself. If the refresh fails the previous list stays in use, and the Cloudflare screen says when it last changed.
• New: the audit log is hash-chained. Every row now carries the hash of the row before it and a hash of its own contents, and a "Verify chain" button walks the table. Edit one field on one row and that row stops matching its own hash; delete a row and the gap shows, because the next row points at a hash nothing in the table produces. Neither was visible before, and an audit log that can be tidied up after the fact is the one piece of evidence an intruder has a reason to touch. Rows written before this release have no hashes and are read as unhashed rather than as a break. Writes are serialised with a real database-level lock, so two events at the same instant cannot fork the chain and have it read afterwards as tampering.
• New in Pro, off until you switch it on: lockdown can throw itself. Twenty different addresses crossing the brute-force threshold inside ten minutes, or — separately, and off by default — a single finding from the malware scanner, and GuardForge closes registration, comments, XML-RPC and anonymous REST writes without waiting for you to read an e-mail. It lifts itself after an hour by default, both ends go into the audit log, you are e-mailed, and it never fires on a copy of your site. The ten-minute window is measured against your site's own clock rather than the database server's, which on a host where the two disagree is the difference between a trigger that fires on the first lockout and one that never fires at all.
• Pro alerts are configurable by a person. The screen was a textarea of raw JSON that printed your bot tokens and HMAC secrets back in clear text; it is now a card per channel — Telegram, Slack or a signed webhook — with an enabled toggle, a minimum severity of its own, and a "Send test" that really sends through the same dispatcher and saves nothing. Secrets are encrypted at rest and shown only as their last four characters; leaving the field empty keeps what is there, so the first save through the new form migrates an old clear-text secret without you touching it. Added with them: a digest you can set to immediate, hourly or daily, and quiet hours in your site's own timezone — which a lockdown or a malware finding bypasses, because those are the two you wanted waking up for.
• New: file integrity against the official checksums. Every core file, and every plugin hosted on wordpress.org, is now compared against the hashes wordpress.org publishes for that exact release, so the screen can say what a scan-to-scan comparison never could: this file is not part of the official build. That is the shape a backdoor has, and it is invisible to a snapshot diff — a shell that was already on disk when the baseline was taken looks exactly like an unchanged core file.
• Each file gets one of five verdicts: official, modified, not in the official build, missing, or no reference. A premium or custom plugin has no published hashes anywhere, and neither does any theme; those files keep the scan-to-scan comparison and are never counted as clean. wordpress.org answers 404 for everything it does not host, and reading that as a pass would put a tick beside the files an attacker is likeliest to be living in.
• The scan asks wordpress.org at most ten times per run and caches every answer, so a site with sixty plugins is covered over a few days rather than in one burst that a cron tick cannot survive. What it could not reach is queued for the next run and the screen names it.
• The hardening score no longer calls a baseline fresh on a site whose own scan found a file nobody published. "File integrity has a fresh baseline — Done" over a web shell located an hour ago was the worst line this plugin could print.
• New: staging / development mode. GuardForge works out whether it is running on a copy — from WP_ENVIRONMENT_TYPE, from a GUARDFORGE_STAGING_MODE constant in wp-config.php, or from a list of staging host names you keep — and then stops acting on the outside world. Lockouts are counted and logged as "soft-locked" but nobody is shut out, the lockout, new-administrator and file-integrity e-mails stop, and with Pro installed the alerts, the Cloudflare firewall push and the credit-spending AI analysis stop too.
• Nothing that can switch staging mode ON is kept in the database. The host list is matched against the address the site is actually served on, so copying a staging database onto your live site stops it matching the instant the domain changes; the only manual on-switch is a wp-config.php constant, which no database dump can carry. Two independent ways to force production exist for the case where a real site is mistaken for a copy.
• While the mode is on it says so on every admin screen and in the admin bar on the front end, names the signal that decided it, and counts what it has held back. The transition on and off is written to the audit log.
• New: a hardening score. Twenty-one checks of your own site, one number out of a hundred, and a checklist where every row states what it is worth and links to the screen that changes it. The weights are published in the readme so the number can be argued with — a score nobody can audit is a score nobody should believe.
• A check that cannot apply to your server leaves the sum instead of scoring zero, so an nginx site is no longer marked down for not having an Apache file, and can still reach 100.
• The score is recorded once a day and kept for a year, so the screen can show whether the site is getting better or quietly drifting.
• New, and off until you ask for it: a public badge. It publishes a letter grade and the month it was checked, worked out only from the eleven things a stranger could already determine by loading your site. Your score and every private check stay private. The link carries an unguessable token, can be reissued or revoked, logs nothing, and does not exist at all until you switch it on.
• Anyone who can log in can now enrol in 2FA. The screen was registered for administrators only, so on a site with one admin and twenty editors, twenty people had no way to switch on a second factor — while the plugin's own handlers had been willing to enrol them the whole time. GuardForge → 2FA is now open to every logged-in role, exactly like WordPress's own profile screen; every other GuardForge page, and the site-wide "require 2FA for administrators" policy, stay administrators-only.
• Staging mode names only the channels the installed add-on actually holds back. The alert and Cloudflare guards live in GuardForge Pro 1.2.0; beside an older add-on the banner and the settings panel stay quiet about them rather than promising a suppression that is not on the disk.

v1.0.1 Improvement Sep 3, 2026

Audit log export (CSV, streamed) — the Pro feature the licence already listed

• Audit log export (CSV, streamed) — the Pro feature the licence already listed.
• Removed two licence entries with no implementation behind them (multisite admin, daily PDF report); they return when built.

v1.0.0 Improvement Sep 3, 2026

Initial public release

• Initial public release. WordPress.org Free core; Pro features delivered by the separate GuardForge Pro add-on.

v1.3.1 Improvement Oct 9, 2026

With the VelocityForge Pro add-on installed, Settings → Privacy & uninstall has a second

• With the VelocityForge Pro add-on installed, Settings → Privacy & uninstall has a second box, "Also include sanitised error context", under "Share anonymous usage signals". It cannot be ticked while the usage box is empty.
• Turning the usage box off now also deletes the statistics queued and not yet sent and the stored error-context choice; the second box is empty when usage is ticked again. A save that does not carry the usage box (another setting saved on its own) no longer switches the choice off.

v1.3.0 Improvement Oct 7, 2026

New: when you have not named any pages to watch, the Monitoring screen offers

• New: when you have not named any pages to watch, the Monitoring screen offers “Suggested pages”: your home page, then the pages with the most recorded visits, or your shop pages, with WooCommerce, while there are none yet. Nothing is saved until you press “Watch these pages”.
• New: a page that is still short of observations now says how long it may take to get enough, in the readiness checklist and beside “Insufficient data” in the baseline table: “≈ 3 days at the current traffic”, “no visits recorded yet”, or “not within the baseline window at the current traffic” when the window cannot hold that many. It is an estimate, never a promise of a verdict, and the last wording is held back during the first two days of recording.
• Reading the busiest pages is limited to the newest 50,000 records, so the Monitoring screen opens quickly on a site with millions of records; a smaller site is read in full.
• The new lines are translated in all 15 shipped languages.

v1.2.6 Improvement Oct 5, 2026

Deleting the plugin leaves the job queue the Forge plugins share in place while another

• Deleting the plugin leaves the job queue the Forge plugins share in place while another Forge plugin or add-on is still on the site. The check used to miss add-ons, and Rank Forge installed from wordpress.org, so the queue could be dropped while a neighbour still had jobs in it.
• Requires WordPress 6.6 or newer. The database health check asks WordPress which autoload values it loads on every request, and WordPress answers that only from 6.6. Sites on WordPress 6.5 stay on 1.2.5.

v1.2.5 Improvement Sep 29, 2026

The recovery drill checks the secret panic URL with a one-off secret instead of the site's

• The recovery drill checks the secret panic URL with a one-off secret instead of the site's own, and verifies TLS like any other request.
• The readme no longer describes the Forge Suite admin layer, which this download does not include.

v1.2.4 Improvement Sep 26, 2026

Field data is kept for up to a year on every install

• Field data is kept for up to a year on every install; the three-month ceiling without the Pro add-on is gone.
• The licence screen, the plan badge in the header and the upgrade card moved into the Pro add-on. This plugin only notes which features the separate add-on provides, with a link to its product page.
• A scan on the Assets screen runs only from the screen's own Scan button or "Create rule" link, which now carry a nonce.
• The readme lists the third-party hosts VelocityForge recognises on your pages and never contacts.

v1.2.3 Improvement Sep 25, 2026

The recovery drill no longer writes into wp-content

• The recovery drill no longer writes into wp-content. It checks the panic constant, the secret panic URL, the safe-mode option and the autoload backups, and leaves the filesystem alone.
• The page profiler and the asset inventory stay on this site: a pasted URL on another host is refused, and scripts or styles served from another host are listed without a size instead of being fetched.
• The notice about an outdated Pro add-on appears on VelocityForge screens, the plugin list and the dashboard only.
• The usage-telemetry switch appears only where something honours it — the Pro add-on — instead of in every install.
• Request input is sanitised where it is read, database queries are prepared or documented, and admin output is escaped.

v1.2.2 Improvement Sep 18, 2026

This release needs VelocityForge Pro 1.2.0 or newer

• This release needs VelocityForge Pro 1.2.0 or newer. An older add-on is switched off whole rather than left running: 1.2.0 is where the free screens started promising that a rule which begins applying is measured against real visitors for a day and reverted on its own, and every part of that decision is in the add-on — beside a 1.1.x add-on the sentence is printed and nothing measures anything. Nothing you have saved is touched, an admin notice names both versions and what stopped, and installing the current add-on brings all of it back.
• Deleting the last Forge product on a site now clears the job queue the Forge plugins share — its table, its two scheduled events and its version marker. While any other Forge product is still installed, deleting this one leaves the queue exactly as it is, because the pending jobs in those rows are that product's too.
• Admin script globals carry the full velocityforge prefix instead of spf.

v1.2.0 Improvement Sep 9, 2026

New: a measurement now names what it points at

• New: a measurement now names what it points at. An interaction is recorded with the control that was hit and with the time split three ways — the wait before the handler ran, the handler itself, and the repaint afterwards — plus whether the page was still loading at the time. A largest paint is recorded with its element and the file that element loaded. Those live in their own table and are counted rather than read one at a time, because "one visitor waited 340 ms on button.add-to-cart" is an anecdote and "this is the p75 of two hundred interactions, and three hundred of those milliseconds are the handler" is a task.
• Two cards on the Monitoring screen say it out loud: the ten controls that cost the most interaction time and the five elements that most delay the first paint, each with the file and, where it can be established, the plugin that shipped it. The owner is resolved from a prefix table, then from this site's own enqueued handles, then from a filter — and where none of the three answers it says "theme" or nothing, never a confident wrong name.
• Every figure is a 75th percentile per element over 28 days, and an element appears only once it has at least three measurements. A p75 of two measurements is the larger of two under a borrowed name.
• An LCP file is linked only when its host is your own site. Resource URLs arrive through an unauthenticated beacon, so a stranger's link is named but never made clickable.
• New: the regression says what the update changed. Immediately before an update replaces any file, VelocityForge fetches your real front page and reads its script and stylesheet queue out of the served HTML — the rendered page, not the handle registry — and afterwards the regression row names what the front end gained, lost or resized. A non-2xx response is refused before the body is parsed, because a bulk update serves a 503 maintenance page that parses perfectly into an empty list, which would have made your whole real asset queue look like an addition.
• That snapshot is bounded on purpose: at most twenty-four assets are sized per run, and sizing stops after a three-second budget, so updating twenty plugins cannot eat max_execution_time from inside the installer. Both the page fetch and the size probes go through the SSRF guard, because the URLs come out of somebody else's HTML.
• New: the Database screen names owners. The twenty heaviest autoloaded options are listed with the plugin that wrote each one, resolved from the option-name prefix. Read-only, as the free health report has always been.
• New: the recovery drill (free). One button runs five independent checks — the panic constant, a probe write and delete in the panic file's directory, a real loopback request to the secret panic route with the real secret, the safe-mode option's round trip, and the autoload backups table — and puts everything it touched back exactly as it found it, the on-disk copy of the secret included. A drill that left the file disagreeing with the database would have broken the SFTP escape hatch it exists to verify.
• New: Safe Mode in the admin bar, on the front end as well as in wp-admin, because a broken site is usually noticed on the front end. It calls the same rollback manager the form does, so it lands in the same audit trail rather than becoming a second way to write the same state.
• New in Pro: rules that take themselves back. A rule that starts applying is measured for a window — 24 hours by default, settable 6 to 72 — against what real visitors measured the week before. If LCP or INP is worse by more than your threshold it is reverted through the same call your own button makes, the reason auto-watch is written onto the rollback event, and you get an e-mail with the numbers and how to put it back. It refuses on no licence, no beacon, too few measurements, Safe Mode, a hard-railed handle and a pinned rule; one watch is open per rule and one verdict is taken per watch, so a retried job cannot revert twice or send a second e-mail. The free plugin carries the table and announces that a rule was created or enabled; every decision is in the add-on.
• Pro alerts are configurable by a person. Bot tokens, webhook URLs and HMAC secrets used to sit in a JSON textarea in clear text and be printed straight back into it. They are now encrypted at rest and shown only as their last four characters, the screen is a card per channel with Add, Remove and a "Send test" that really sends and writes nothing, and an empty field means "leave it as it is" — so the first save through the new form re-encrypts an old clear-text value without you doing anything. The test path runs the same https-only, no-private-address guard as the save path, so it cannot be used to probe your internal network.
• New: a Total Blocking Time budget, 300 ms, in the same map as LCP, INP, CLS and TTFB. It is honest about itself: no field source populates it, because TBT needs a long-tasks trace the beacon does not capture, so it is read only by the Pro lab audits' comparison. Banding needed no new code — it keys off the metric name and does not care which instrument produced the value.
• The lab-audit panel's status line is now the run's own state instead of a fixed "Queued — refresh in a minute": nothing started says nothing, an open run says when it was queued, and a finished one repeats exactly the wording the history table uses, so the two can never disagree.
• Five more caching and optimisation plugins are recognised — Jetpack Boost, SiteGround Optimizer, WP-Optimize, Breeze and WP Fastest Cache — bringing the list to seventeen. The coexistence notice now names every feature we stood down rather than only the overlapping one: for a plugin that owns the whole asset pipeline the optimiser stands down entirely, and a banner claiming we had only stepped back from minification while four other features were silently off was worse than saying nothing.
• New: the trend, on the Monitoring screen. Thirty days of daily 75th percentile for LCP, INP, CLS and TTFB, so a regression row has the fortnight either side of it to be read against. A percentile rather than an average, because the average of a day where nine visitors waited a second and one waited eleven is two seconds, and two seconds is a number nobody experienced. A day with no measurements is a gap in the line, never a zero.
• Free, and it draws whatever it has. On a site with the Pro add-on and scheduled lab audits switched on, the same chart carries a second line.
• New in Pro: scheduled lab audits. Lighthouse runs against a list of your pages once a day through your own PageSpeed Insights key — your key, your Google quota, your billing relationship with Google, and no proxy of ours in between. The key is encrypted at rest with a value from wp-config.php and is never shown back to you.
• Lab results are ordinary measurements in the ordinary table, so the trend, the regression history, the e-mail and the Telegram / Slack / webhook alerts all treat them the same way. They are never compared against a real visitor's measurement, though: a reading from Google's edge and a reading from a browser in Jakarta are not the same instrument, and comparing them reports a regression whose only cause is the yardstick.
• New: a Speculation panel. WordPress 6.8 prefetches the next page on its own, conservatively and with no way to say "but not that link" short of writing a filter. This screen gives you the two controls — prefetch or prerender, and how eagerly — plus a list of paths to leave alone.
• It steers the rule set WordPress already prints rather than adding one of its own. That is not tidiness: a page may carry several speculation rule sets and the browser takes their union, so a second one can only add speculation, never take it away. "Prerender the site but never the cart" is unreachable any other way.
• Cart, checkout, my-account, logout, anything carrying a nonce and anything carrying add-to-cart= are excluded and cannot be switched on. Cart and checkout paths are read from the site — a shop whose cart lives at /basket/ is excluded at /basket — rather than guessed from slugs. Prefetch is railed as tightly as prerender, because a prefetch reaches the server too, and a speculated add-to-cart link puts a product in a real basket.
• The exclusions you write are checked and a bad line is refused, not repaired. One pattern the browser cannot read makes it discard every speculation rule on the page, so the screen drops the line and tells you how many it dropped.
• Defaults reproduce what WordPress does today — prefetch, conservative — so upgrading changes nothing about your pages until you move a control.
• On WordPress below 6.8 the panel says so plainly and the settings still save, ready for the upgrade. Nothing here is greyed out and nothing asks about a licence.

v1.0.1 Improvement Sep 3, 2026

Regression alerts actually send

• Regression alerts actually send. The "Email me on regressions" toggle had existed since launch with nothing behind it.
• Field-data CSV export, streamed — the half of "90-day retention" that was advertised and missing.
• Removed two licence entries with no code behind them (per-page profiles was a second name for asset rules; agency reports was not built).

v1.0.0 Improvement Sep 3, 2026

Initial public release

• Initial public release. WordPress.org Free core; Pro features delivered by the separate VelocityForge Pro add-on.

v1.8.8 Improvement Oct 11, 2026

Security: the flow editor's save form is read field by field and sanitised on receipt

• Security: the flow editor's save form is read field by field and sanitised on receipt; a flow that fails to save keeps only the sanitised text for you to correct, never the raw form.
• Database queries: the Runs screen search and flow filter, the run claim in the flow runner, the failed-run list and its counts, run clean-up, and the dashboard figures now use fixed query text with every value bound, instead of building the query from pieces.
• No change to what the screens show or to how flows run. Flows, settings and run history are untouched.

v1.8.7 Improvement Oct 9, 2026

New name: Cascade Forge

• New name: Cascade Forge. Flows, settings and run history carry over unchanged.
• Security: the settings form and every JSON field the flow editors post are sanitised as soon as they are received; the flowforge/settings_saved hook now receives sanitised values.
• Security: the "Create user" step may choose a role only when the flow's author can promote users, never a role with capabilities the author lacks, and never a role that manages users, plugins, themes or options. A refused role fails the step before any account is created.
• Outgoing webhooks are signed in the X-CascadeForge-Signature header.

v1.8.6 Improvement Oct 8, 2026

This release needs Cascade Forge Pro 1.6.7 or newer if you run the add-on

• This release needs Cascade Forge Pro 1.6.7 or newer if you run the add-on. The licence class, the License screen, the upgrade prompt and the plan badge in the screen header moved out of this plugin into the Cascade Forge Pro add-on. This plugin no longer carries any licence code: it asks only whether the add-on is installed. The License item in the Cascade Forge menu now comes from the add-on, so a site without it has no such item.
• An add-on older than 1.6.7 is not started beside this version, because it would look here for code that has moved. A notice on the Cascade Forge screens, the plugin list and the dashboard asks for the update and says where to get the package.
• On a site without the add-on, the Inbound webhooks screen names Cascade Forge Pro as the plugin that provides it and links to its page. Nothing on it is locked or greyed out.
• Fixed: with WP_DEBUG on, the flow editor, canvas and history screens no longer log "Deprecated: strip_tags(): Passing null to parameter #1" on PHP 8.1 and later; each of the three sets its own title before the admin header is printed.
• Admin output: the flow editor's inline save errors are escaped where they are printed.

v1.8.5 Improvement Oct 7, 2026

The empty Flows screen has a second button, “Start from a recipe”

• The empty Flows screen has a second button, “Start from a recipe”, next to “Create your first flow”: it opens the Recipes screen, where the ready-made flows are.

v1.8.4 Improvement Oct 5, 2026

Deleting the plugin leaves the job queue the Forge plugins share in place while another

• Deleting the plugin leaves the job queue the Forge plugins share in place while another Forge plugin or add-on is still on the site. The check used to miss add-ons, and Rank Forge installed from the WordPress plugin directory, so the queue could be dropped while a neighbour still had jobs in it.

v1.8.3 Improvement Oct 4, 2026

Declared compatibility with WooCommerce High-Performance Order Storage

• Declared compatibility with WooCommerce High-Performance Order Storage. Cascade Forge reads and writes orders only through WooCommerce's own order functions.
• Fixed: the "Update post meta" step now sets the meta on the order itself when the ID it is given is a WooCommerce order. Under High-Performance Order Storage it wrote to the posts tables, where WooCommerce does not look.
• Fixed: the Recipes screen listed nothing in the packaged plugin because the build left the recipe catalogue out; the ready-made flows are in the package now.
• Fixed: the "Insert field" menu in a condition row no longer stretches to the width of its longest field name and squeezes the value box beside it.

v1.8.2 Improvement Sep 25, 2026

This release needs Cascade Forge Pro 1.6.2 or newer

• This release needs Cascade Forge Pro 1.6.2 or newer. A Pro step now checks its own licence inside the add-on; the free runner no longer asks about licences.
• The notice about an outdated Pro add-on appears on Cascade Forge screens, the plugin list and the dashboard only.
• Request input is sanitised where it is read, database queries are prepared or documented, and admin output is escaped.

v1.8.1 Improvement Sep 18, 2026

Admin script globals carry the full flowforge prefix instead of flf

• Admin script globals carry the full flowforge prefix instead of flf.
• The plugin's site is now cascadeforge.app: the plugin header and the translations link there.

v1.8.0 Improvement Sep 10, 2026

This release needs Cascade Forge Pro 1.2.0 or newer — unchanged from 1.7.1

• This release needs Cascade Forge Pro 1.2.0 or newer — unchanged from 1.7.1; an older add-on adds none of its steps or events, and an admin notice names both versions.
• The Runs screen now honours ?flow_id in its ordinary view, not only in the failed one, so a link that names a flow lands on that flow's runs instead of the newest hundred of every flow.

v1.7.1 Improvement Sep 10, 2026

This release needs Cascade Forge Pro 1.2.0 or newer

• This release needs Cascade Forge Pro 1.2.0 or newer. An older add-on adds none of its steps or events rather than adding them and failing halfway through a run. Until you update it, flows that use a Pro step stop at that step; an admin notice names both versions, and installing the current add-on brings them back.
• Deleting the last Forge product on a site now clears the job queue the Forge plugins share — its table, its two scheduled events and its version marker. While any other Forge product is still installed, deleting this one leaves the queue exactly as it is, because the pending jobs in those rows are that product's too.

v1.7.0 Improvement Sep 9, 2026

Contract regression checks

• Contract regression checks. Record a flow's current behaviour — a depersonalised sample payload and the effects it produces — and every later save (or restore) of that flow replays the same sample and compares the result: still matches, differs (with what changed), or nothing recorded yet to compare against. Shown on the flow's own history screen, per version. This is a simulation, exactly like "Test this flow" — labelled as such on screen, and it never writes a run, a run step or a receipt.
• Two new database tables back this: one recorded contract per flow, and one check result per flow version. A free-only install can record a baseline and see checks with no Pro add-on required.

v1.0.1 Improvement Sep 3, 2026

AI recipes: describe an automation and get a draft flow

• AI recipes: describe an automation and get a draft flow, validated against the triggers and actions this site actually has.

v1.0.0 Improvement Sep 3, 2026

Initial public release

• Initial public release. WordPress.org Free core; Pro features delivered by the separate Cascade Forge Pro add-on.

v1.0.2 Improvement Sep 30, 2026

llms.txt and llms-full.txt show prices, names and descriptions as plain characters

• llms.txt and llms-full.txt show prices, names and descriptions as plain characters: a dollar price carried the HTML entity for the "$" sign instead of the sign itself, and a sale price repeated itself. A sale now reads the way WooCommerce says it to screen readers ("Original price was: $150.00. Current price is: $129.00."). The documents cached by 1.0.1 are not served after the update.
• The per-page crawler visit counters were never saved because of a malformed database query; they are now, and they are deleted with the rest of the crawler log when it reaches the retention limit.

v1.0.1 Improvement Sep 30, 2026

Crawler address verification is now off until you turn it on in Settings

• Crawler address verification is now off until you turn it on in Settings. Activation no longer schedules any download.
• Settings: choose whether deleting the plugin also deletes its data.
• Readme and admin screens describe only what the plugin and its add-on actually do.

v1.1.2 Improvement Oct 9, 2026

The plugin now includes the CSV reader that Profit Forge Pro uses to import a gateway

• The plugin now includes the CSV reader that Profit Forge Pro uses to import a gateway statement, so the import works with the version of this plugin from WordPress.org. Nothing changes for stores that do not use Profit Forge Pro.

v1.1.1 Improvement Oct 7, 2026

On stores where WooCommerce's Cost of Goods Sold feature is switched off

• On stores where WooCommerce's Cost of Goods Sold feature is switched off, Profit Forge no longer writes a WooCommerce "called incorrectly" notice to the log for every line item of every order it reads. It now asks WooCommerce for the cost of goods only when that feature is on, and otherwise reads costs from the cost-of-goods plugins it already supports, as before.

v1.1.0 Improvement Sep 30, 2026

Before a scan runs, the screen now states what it will and will not check on this store

• Before a scan runs, the screen now states what it will and will not check on this store, and why — with a real example line instead of a promise. A rule that cannot run names the data it is missing.
• The scan preview and the contract card now agree on how many orders are in the window; the two could previously quote different figures for the same scan.
• A case reopened by a later scan keeps its "fix applied" date, and a re-test can no longer quietly demote a finding you already confirmed.
• Findings and their re-test outcomes are now published in a shared format, so a dashboard plugin installed alongside can read this plugin's results without scraping the screen. Nothing leaves your server: this plugin still makes no external requests.

v1.3.2 Improvement Oct 15, 2026

Removed: the optional key field on the settings screen and the account-status lines

• Removed: the optional key field on the settings screen and the account-status lines that came with it (added in 1.3.0). Stores that were connected with it stay connected: the site token and webhook secret were saved on their own. Connect a new store by pasting the site token and webhook secret from the Inclusive Forge dashboard.
• Change: the statement HTML is filtered when it arrives, before it is cached, as well as when it is printed.
• Change: the "cache cleared" and "re-test" notices on the settings screen no longer depend on a flag in the address.
• Change: removing the plugin deletes exactly the options and cached entries it created, by name, and no longer flushes the site's object cache.
• Change: the readme says the plugin works on any WordPress site and is built for WooCommerce stores, describes the statement cache and the home-page check as the code does, and lists the link visitors may see in "External services".
• Internal: removed a helper class nothing called.

v1.3.1 Improvement Oct 8, 2026

Fix: the Accessibility Statement block now appears in the block editor's inserter

• Fix: the Accessibility Statement block now appears in the block editor's inserter. Its editor script used to register the block under an old product name, so the block could not be added from the editor. The [inclusiveforge_statement] shortcode was not affected.
• Change: the "External services" section says exactly when the plugin contacts Inclusive Forge and no longer names a service the plugin itself never contacts.
• Change: the translation template now includes the block editor's strings.
• Change: the readme no longer says a visitor never waits for the statement. The page view that refreshes the 12-hour cache does.
• Internal notes removed from the code comments. No change in behaviour.

v1.3.0 Improvement Sep 30, 2026

New: an optional key field on the settings screen that connected the store for you

• New: an optional key field on the settings screen that connected the store for you and filled in the site token and webhook secret (removed in 1.3.2).
• Fix: a verified site with no published statement yet no longer reads as "Could not reach Inclusive Forge" on the settings screen; it says the statement is still to be published.

v0.3.1 Improvement Oct 9, 2026

Changed: the journal table gets an index on the order number

• Changed: the journal table gets an index on the order number. A table from an earlier version is brought up to date in wp-admin, by WP-Cron or when the plugin is activated, one request at a time and never on a visitor's request; a table that is missing is created at once. No record is changed.
• Developers: the journal can be read by order number (EventFilter::$orderId; the Journal screen has no such filter). A paid order carries the unit its amounts were recorded in (PaidOrder::$decimals), so 99.50 in a shop that now shows whole units is not rounded to 100, and an amount with more than six decimal places is refused with an exception that names the order. The subscriptions gateway gains paidOrderDates() and lastPaidRenewalExact().