Skip to main content

Flavor Starter Theme - Changelog

[8.2.0] - 2026-08-31 — Private invoice PDFs, emergency Lockdown Mode, reliable module updates & accurate checkout totals​

A large security- and accuracy-focused release. Invoice PDFs are now private, a single Lockdown Mode switch hardens your site while WordPress core is unpatched, enabled modules update reliably again, and every cart and checkout total now matches exactly what the shopper is charged.

Added​

  • Emergency Lockdown Mode. One switch under Flavor Options → Security force-enables every safe hardening control at once, so you can shrink your attack surface while a WordPress core vulnerability is still unpatched. It is non-destructive — it overrides your individual settings only while it is on, and restores them exactly when you switch it off. On the Business plan it can also raise itself automatically the moment an actively-exploited core vulnerability appears, and lower itself when that clears.
  • Product Inquiry — "Ask about this product". Show any of your contact forms directly on product pages, as a product tab, a popup under Add to Cart, or both (Flavor Modules → Product Inquiry, with per-product include/exclude scope). It reuses your existing form engine, so validation, spam protection, reCAPTCHA / Turnstile, GDPR settings and smart tags all carry over unchanged — and the message names the product the shopper asked about.
  • Running nginx? Generate a matching server config. Flavor Options → Optimize → Server Optimization now produces a ready-to-paste nginx snippet mirroring exactly the protection and caching rules you enabled, with Copy and Download .conf buttons. Because nginx ignores .htaccess, this closes the gap for stores that aren't on Apache. It writes nothing to your server — you paste it into your server { } block and reload nginx.
  • Two new optional protections on the Security tab — block the oEmbed discovery proxy (a rarely-used helper that has served as a request-forgery vector; normal post embeds keep working) and rate-limit comment submissions to slow automated flooding. Both are off by default and both join the Lockdown Mode preset.

Fixed​

  • Security: invoice PDFs are no longer readable by anyone who guesses the address. Customer invoice PDFs were stored at a sequential, public path, so an anonymous visitor could work through the numbers and download every invoice's full customer details (name, address, email, VAT number, line items). Downloads are now streamed only to authorised staff (and to a customer through a self-verifying link in their own invoice email), filenames are unguessable, the invoice folder is blocked at the web server, and existing invoices are renamed automatically on update. We strongly recommend updating.
  • Enabled modules update and appear in your dashboard again. A module whose files were present on your site but missing from the installed-components list was a dead end — no update was ever offered, it was invisible in the Flavor Core dashboard, and its card had no Install / Update / Uninstall button. Flavor now reconciles those modules automatically, so updates, the dashboard list, uninstall and integrity checks all work normally.
  • Saved passwords and API keys now confirm they are saved. Secret fields (myDATA/AADE password, image-optimization API key, SMTP password and the rest) are deliberately never sent back to your browser, so after saving they came up blank and looked like lost data. Every secret field across every module now shows a masked "saved" indicator — leave it blank to keep the stored value, or type to replace it.
  • Cart and checkout totals now always match what the shopper is charged. Every cart and checkout surface — the storefront and all page-builder templates — now shows your store's authoritative total with coupons and promotions itemised, instead of recalculating it in the browser and missing cart-level promotions. A free-shipping coupon shows "Free" consistently everywhere.
  • Checkout is honest about shipping. The full delivery address (country, region and postcode) now drives shipping and tax as it is entered; an address you don't ship to shows a clear "no shipping options for this address" message instead of quietly showing "Free"; and a card is never confirmed against a total that has since moved.
  • Two fatal errors that could take a site down are removed. Enabling the Size Guide or Product FAQ module used to white-screen every product page, and the Delivery Date Picker module used to white-screen the entire storefront. Both are fixed.
  • Optimization toggles that broke the site are fixed. Defer JavaScript no longer breaks module settings screens, the media library or the SEO and Contact Forms editors (it is now a front-end-only optimization), and Disable Heartbeat completely no longer crashes the site.
  • Image optimization. The Remote API URL and key now appear in Hybrid mode — previously they were hidden, so the remote service could never be set up and Hybrid quietly behaved as local-only. Turning on a new output format such as AVIF now correctly surfaces the missing work in Bulk Optimize instead of reporting "everything is optimized" (existing WebP-only sites are not forced to re-optimize). WebP conversion also no longer logs a PHP deprecation notice on PHP 8.5.
  • PDF invoices print the buyer's details exactly as they were at the time of sale. Name, address and email now come from the order itself rather than the live customer record, so re-downloading an old invoice always reproduces the original document. Product names, SKUs, quantities and street addresses now print correctly too (they could previously come out blank, as 0, or updated to a renamed product).
  • Features that silently did nothing now work. Size Guide and Product FAQ tabs appear on product pages; the Product FAQ and flash-countdown shortcodes render on a product page; Exit Intent's "Product pages" targeting works; Mega Menu's 13 blank menu icons render, its mobile "Submenu indent" slider takes effect and its "Scale" animation animates; the loyalty welcome bonus is now awarded to a shopper who registers after buying as a guest; and approving a wholesale application now actually assigns the customer's price group instead of leaving them on retail prices.
  • Broad security hardening pass. The newsletter signup form can no longer be used to probe internal services or relay mail, and is rate-limited and capped; the Request a Quote form is rate-limited; the public gift-card balance check no longer returns the recipient's and sender's names, emails and message (only the balance) and is rate-limited; a dead store-locator endpoint that exposed your full store list is removed; and manual gift-card balance and status changes are now recorded in the transaction ledger.
  • Abandoned-cart data retention now completes reliably on large stores. The cleanup sweep ran as one unbounded operation that could time out and roll back, leaving retention permanently stuck; it now runs in safe batches with proper indexes. What is retained is unchanged.
  • Account, Cart and Checkout pages are recognised correctly for SEO and page-specific asset loading, including when they are built with the Visual Page Builder.

Updated​

  • The Security tab is reorganised into one place. XML-RPC, self-pingbacks, Application Passwords, WordPress-version hiding and REST API restriction moved from Optimize to Flavor Options → Security; XML-RPC and author-enumeration blocking are now single controls with an optional "also block at the web server" layer instead of two disconnected switches; HTTP security headers and HSTS are controlled from one place; and security .htaccess rules now apply the moment you press Save rather than waiting for a separate Apply step on another tab. No setting changed — your stored values are migrated across automatically, and a control managed by Lockdown Mode now clearly shows as Managed by Lockdown instead of appearing unchecked.
  • A restricted REST API no longer breaks post embeds or licensing — WordPress post embeds and Flavor Core are always allowed through when you set REST API Restriction to "Logged In Users Only" or stricter.
  • The CSP Report-Only diagnostic now also reports client-side script sinks, giving you a fuller picture of your storefront's cross-site-scripting surface in the same violations table, with no extra setup. It is a diagnostic only and never blocks anything.
  • On a non-Business store, a core vulnerability with a free manual workaround now links you straight to it instead of only advertising the Business one-click mitigation.
  • Clearer wording across the Security and Optimize tabs, including a rewritten first-run hardening notice that states what was enabled and that no action is required.
  • Three half-built flows are safely gated while they are rebuilt. Converting a quote into an order, gift-card redemption at checkout, and the product-bundle add-to-cart could each produce an incorrect order, invoice or tax filing, so they are disabled for now with a clear admin notice. Gift-card management and balance lookup, the quote request and response workflow, and bundle display are unaffected.

[8.1.0] - 2026-08-03 — WordPress Core Protection, Security Hardening levels & accessible contact forms​

A security-focused release. Your store now gets an early warning when your WordPress core version has a known vulnerability, with an optional one-click way to reduce your exposure until you update. A new Security Hardening Level adds layered browser and file-upload protections in a single setting, Contact Forms became fully accessible, and the store currency now displays correctly everywhere.

Added​

  • WordPress Core Protection. When a vulnerability affecting your WordPress core version is disclosed, Flavor shows a clear admin warning listing the issues and the version to update to. On the Business plan you also get a one-click mitigation that reduces exposure to issues whose entry point can be gated — applied only when you confirm, and reverted automatically once you update core — plus an optional setting to apply mitigations automatically for actively-exploited issues. Detection is on every plan. (Flavor cannot patch WordPress core itself — this is honest early warning and best-effort mitigation, never a guarantee; updating core is the real fix.)
  • Security Hardening Level — Off / Low / Medium / Aggressive. One setting under Flavor Options → Security that layers browser and upload protections: a safe Content-Security-Policy subset, blocking executable file uploads, disabling PHP execution in your uploads folder (Apache/LiteSpeed), and blocking SVG/HTML uploads at the higher levels. It reduces the exploitability of injection and file-upload bugs without affecting a normal storefront, and existing stores start on the zero-risk Low baseline.
  • CSP Report-Only diagnostic. An opt-in tool that shows what a strict Content-Security-Policy would block on your store — collected on your own site — so you can plan a stricter policy without blocking anything yet.
  • Optionally block the WordPress REST batch endpoint — a Security setting to disable a broad multi-operation REST endpoint most stores never use, reducing your REST API's attack surface (off by default).
  • Contact Forms — full accessibility (WCAG 2.2): field errors appear at the field and are announced to screen readers, keyboard focus moves to the first field needing attention, and known fields (email/phone) autocomplete correctly.
  • Contact Forms — email-delivery status + product prefill: the Entries list shows whether each notification email Sent or Failed (a failed lead is no longer silently lost), and a form on a product page can prefill which product it's about.

Fixed​

  • The store currency now displays correctly on every storefront surface — changing your currency updates the symbol everywhere, and the picker now offers 23 currencies.
  • Stripe card payments now complete reliably at checkout.
  • Checkout no longer locks out new customers when Guest Checkout is off — it offers Login + Create Account and respects your account-creation settings.
  • Rate-limiting & login-protection hardening: a spoofed search-engine crawler can no longer bypass the rate limiter, the login lockout now identifies the real visitor behind a proxy/CDN, and the activity log is safe to open in a spreadsheet and no longer floods with repeated blocked-request entries.

[8.0.0] - 2026-07-27 — Contact Forms refocus, WooCommerce migration, back-in-stock alerts, product image zoom & recommendations​

A major release. Contact Forms was streamlined — A/B testing and detailed event analytics were removed in favour of a simple Views / Submissions / Conversion-rate counter, and forms gained show/hide conditional fields, smart-tag prefill and an order-picker add-on. Migrating from WooCommerce now brings across far more of your store, with a full report of anything skipped. Back-in-stock alerts got a complete storefront experience, product pages gained image zoom and a consistent frame, and product and cart pages now show related, upsell and cross-sell rails.

⚠️ Breaking Changes​

  • Contact Forms: A/B Testing and detailed per-event analytics are removed. Form stats are now a simple Views / Submissions / Conversion-rate counter. Any form with a live A/B experiment loses it, and historical experiment/analytics data is removed — but the upgrade first backs both tables up and verifies the backup before removing anything (and aborts safely, leaving your data untouched, if the backup fails), and your existing view counts carry over so no form resets to zero.

Added​

  • Product image zoom — with a choice of styles. Under Flavor Options → Shop → Products → Product Gallery, choose Lightbox (click for full-screen high-res with prev/next + keyboard + pinch-to-zoom), Magnifier (a lens follows your cursor), Inner zoom (zoom in place on hover), or None. The same section sets the image frame shape and fit so every product renders in a consistent, tidy box.
  • Related, upsell and cross-sell rails on the storefront. Product pages show "Upsells" and "Related products" rails; the cart shows a "Cross-sells" rail across all cart items. Each rail loads only when scrolled into view, hides when empty, and skips out-of-stock or unpriced items.
  • A far more complete WooCommerce migration. The migration tool now brings across variable products (attributes, variations, per-variation prices/stock/images), tax rates + shipping zones, coupons, product reviews (with their original dates), brands, cross-sells & up-sells, registered customer accounts — with the password each customer already knows, guest customers + address books, and your store currency & number formatting. A Migration Report shows exactly what was skipped, dropped or expanded (CSV-exportable), oversized/corrupt images are skipped-and-logged instead of crashing the run, and a built-in safeguard suppresses all customer emails during migration.
  • Contact Forms: show or hide a field based on what the visitor entered. Any field can carry show/hide rules — enforced both live in the browser and on the server (a hidden field is never required and its value is never stored).
  • Contact Forms: auto-fill a field from the logged-in customer's own data (name, email, and — with the Commerce add-on — their orders count, total spent, last order, and more), safely and only for the signed-in visitor.
  • Contact Forms — Commerce add-on: an Order Picker field. A logged-in customer picks from a dropdown of their own orders instead of typing an order number; guests get a normal text box. Available on any licence.
  • Contact form entries: scheduled auto-delete + privacy. A per-form retention setting (off by default), submitter-IP anonymization, consent records, and WordPress's Export/Erase Personal Data tools now include form entries.
  • Back-in-stock alerts with double opt-in and a full privacy floor. Shoppers can subscribe to be emailed when an out-of-stock product returns (double or single opt-in, your choice), with a stored consent record, one-click unsubscribe on every email, and automatic clean-up of old records.
  • Per-product back-in-stock control + a self-showing "Notify me" button. Enable/disable alerts per product (with a store-wide default), and a "🔔 Notify me when back in stock" button appears automatically on out-of-stock product pages.

Updated​

  • A site-wide Trusted Proxies setting so rate limiting works correctly behind Cloudflare, a load balancer or managed hosting — no wp-config edit needed (Flavor Options → Security).
  • Contact Forms internals were rebuilt for reliability: the entries CSV export now streams (no timeout on very large tables) and the form re-skins fully with your theme.

Fixed​

  • Security: rate limiting can no longer be bypassed behind a trusted proxy — the per-visitor limit now correctly identifies the real visitor.
  • Privacy: the Contact Forms upgrade backup folder is now protected from direct web access.
  • Product page: the main image now sits in a consistent frame across all products, and images load at the right size (faster pages).
  • Numerous WooCommerce-migration robustness fixes — retries and resumes are now safe and idempotent, partial (percentage) runs no longer flatten the category tree, and orders are automatically linked to their customers at the end of every run.
  • Back-in-stock notifications now actually send when a product returns to stock (they were wired to an event that never fired).

[7.5.0] - 2026-07-14 — Per-product SEO overrides, richer product data & safer theme updates​

Products can now carry their own SEO title, description, social card and more — rendered ahead of your global templates — with richer product structured data for Google. Plus a fix that keeps your installed modules through a theme update, and remote unlocking of the read-only Diagnostics tools.

Added​

  • Per-product SEO overrides. Each product can now carry its own SEO title, meta description, robots directive, canonical URL and social (Open Graph) card — edited in the product editor's new SEO tab — that render on the storefront ahead of your global SEO templates. Leave any field blank and the product keeps using the global template, exactly as before.
  • SEO module activation prompt. Flavor now shows a one-time, dismissible prompt to install and activate the Flavor SEO module, so product structured data, titles/meta, social cards and sitemaps are one click away — it never turns a module on silently.
  • Compatibility Advisor. When a third-party SEO plugin that Flavor already replaces (Yoast, Rank Math, All in One SEO) is active, Flavor shows a non-blocking, dismissible heads-up on its own admin screens explaining the native equivalent — it never disables anything.

Updated​

  • Richer product structured data. Product data for search engines now includes GTIN/MPN, the product's condition, and — for variable products — a real low-to-high price range across variants (previously the parent price, often 0). Prices are emitted cleanly, improving eligibility for Google and marketplace rich results.
  • Diagnostics tools can now be unlocked with your Flavor licence. The read-only Diagnostics tools under Flavor Options → Tools can now be enabled remotely by FlavorTeam support via your licence, instead of only by editing a file on your server. Account-creating Sandbox tools stay off unless explicitly enabled on the server.
  • Faster product and category pages — the SEO system now resolves each page once per request instead of repeating the same lookups.

Fixed​

  • Updating the theme no longer removes your installed modules. On the slim update package a theme self-update could come back with your on-demand modules gone (settings kept, files removed). The theme now backs them up before the update and restores them straight after — and the Flavor Core dashboard no longer drops them from its list afterwards.
  • Sharing a product on social media now links to the product, not the homepage. The share link on product pages pointed at the site home; it now uses the product's own canonical URL.
  • The product SEO tab now opens reliably and correctly steps aside when a third-party SEO plugin is active; product structured data is also hardened against script injection.
  • Product structured data no longer disappears when a third-party SEO plugin is active, and the product brand is now correct — it shows the real product brand instead of the site name.
  • Category pages no longer flash the full catalogue for a moment before showing the category's own products.
  • A fresh activation now downloads the theme core only — not all 36 modules — as the on-demand model intended.
  • Internal reliability and security hardening — the self-update backup now uses an unpredictable folder name, an update-window debug log stays silent unless debug logging is on, and a developer docblock was corrected.

[7.4.0] - 2026-06-23 — On-demand theme modules & safer AI image import​

Added​

  • Theme modules now install on demand. Activating your license no longer downloads all 36 modules up front — a fresh activation installs just the theme core, and you add each module you want with a single click from the Modules tab. Installed modules get an "Uninstall" action that removes the files but keeps your settings (re-installing restores them). Existing sites keep every module they already have.

Fixed​

  • Hardened the AI stock-photo import. The import-to-Media-Library action now only downloads from the Unsplash and Pexels image services over HTTPS, and the Google Gemini API key is no longer placed in request URLs. No change to how you use the feature.

[7.3.2] - 2026-06-15 — Theme-only autonomy & smarter AI provider handling​

Updated​

  • The theme now runs fully standalone without the WP eCommerce Core plugin: storefront-only settings are clearly disabled with a single notice when the shop plugin isn't active, the page builder's Save as Template works on its own, and product URLs return a proper "not found" page on a content-only site.
  • AI content generation now automatically uses whichever provider key you've configured — with a clear pointer to Theme Options → AI if none is set.

Fixed​

  • Restore points are now captured before component updates (enabling one-click rollback — see Flavor Core), and the Design System "Add Class" button icons are aligned.
Full Version History

For the complete changelog including all previous versions, contact our support team.

Last updated on