Skip to main content

Flavor Starter Theme - Changelog

[9.3.1] - 2026-10-25 — Timezone-correct timestamps across the storefront and admin​

Fixed​

  • "Installed", "created" and "x ago" dates — and gift-card, quote and loyalty-points expiries — now use your store's timezone, not the database server's clock. On a store whose database runs in UTC while your WordPress timezone is ahead of it, some dates and "time ago" labels could read a few hours — or a calendar day — off; they now resolve on your store's own calendar. (No change on a store whose database clock already matches its site timezone.)

[9.3.0] - 2026-10-23 — File-integrity protection groundwork, the branded storefront on more pages, and a smoother WooCommerce import​

Added​

  • File-integrity protection (theme side). The theme now keeps a tamper-evident integrity record of its own files, which Flavor Core's daily check monitors (see the Flavor Core 2.12.0 notes). Monitoring-only for the theme in this release.

Changed​

  • Your branded storefront now appears on a page you assign in Flavor Options → Pages, even without hand-picking its page template. Previously the branded storefront rendered only on pages set to a Flavor page template; a page you'd assigned as, say, your Shop in Flavor Options → Pages but left on the default template fell back to the plain default design. The theme now recognises the assigned page and applies the branded template automatically.
  • WooCommerce import now fills in your store name & email automatically. After importing a WooCommerce store, your Store Name and Store Email are set from your WordPress Site Title and admin email instead of being left blank (WooCommerce has no separate store-name field). Only empty fields are filled — anything you've already set is kept.

Fixed​

  • Storefront page templates can no longer be opened directly. Visiting a theme template file by its direct URL now exits cleanly instead of reaching an error that could reveal your server path.
  • Add-on components install only the files they're signed for. The theme's component installer now writes only the exact files listed in a component's cryptographic signature — any extra, duplicate, or out-of-place file slipped into a tampered download is refused before anything is written.

[9.2.2] - 2026-10-16 — Page Builder styling on more pages, cleaner new-store defaults, and reliability & privacy fixes​

Changed​

  • Image Grid / Banners block — options that don't apply now hide automatically in both the default and the Visual editor, and the block's styling moved into the shared builder stylesheet (emitted once, easy to override from your theme, and hover animations now respect a visitor's "reduce motion" setting). Existing Image Grid blocks render exactly as before.
  • Brand-new stores start cleaner — a fresh install now begins with every Optimize performance tweak off (you opt in) and leaves the WordPress heartbeat alone. Existing stores are unaffected.

Fixed​

  • Page Builder blocks now render fully styled on archive, search and template-driven pages — blocks on those pages previously lost their shared layout, tab switching and animations.
  • Performance options now take effect when you change them — e.g. turning off Product Prefetch now actually stops it, and the heartbeat "leave WordPress alone" choice is honoured.
  • Privacy — Google resource hints no longer reach out to Google before consent unless your store actually uses Google Fonts or Google Analytics/Tag.
  • Disabling a module now also stops its background task instead of leaving it to run.
  • Text with apostrophes, quotes or backslashes no longer accumulates stray backslashes on save — storefront translations, contact-form submissions and various module forms round-trip cleanly now.
  • Removed a WordPress 6.7+ deprecation notice triggered by the Visual Builder editor page.

[9.2.1] - 2026-10-12 — A cleaner first impression for new stores, and more storefront translations​

This release gives brand-new stores a calmer, stock-WordPress first impression — no post-install nag banners, and the standard WordPress editor, comments and block styles stay on by default — while existing stores are completely unaffected. It also translates more storefront text (checkout, the sale banner, category pages and the contact form).

Updated​

  • A calmer first impression for new stores — a brand-new store no longer shows the "activate Flavor SEO" prompt or the security-baseline notice on the dashboard. The safe security baseline is still applied automatically and remains adjustable under Flavor Options → Security → Hardening Level.
  • Stock-WordPress defaults for new stores — a fresh install now keeps the WordPress block editor, site comments and WordPress' block/global styles on by default, so a new store behaves like stock WordPress until you choose otherwise. Existing stores are unaffected — updating changes nothing for them; all four toggles remain under Flavor Options → Optimize.

Fixed​

  • More of the storefront follows your store language — the Stripe / PayPal / Everypay payment messages at checkout, the sale-banner countdown and "Sale Ended", the Categories page title and description, the contact-form validation messages, and the "subscription will not renew" account notice are now translatable and editable under Flavor Options → Language.

[9.2.0] - 2026-10-06 — Subscriptions in My Account, Image Grid / Banners 2.0, and a critical order-confirmation security fix​

This release brings the storefront side of Subscriptions — see and manage a subscription from My Account, with honest checkout and order-received wording — a full rebuild of the Image Grid / Banners Page Builder block, a critical order-confirmation privacy fix, a safer My-Account email change, and 61 more translatable storefront strings. Existing pages and settings are unchanged.

Added​

  • Image Grid / Banners block 2.0 (Page Builder) — layouts now place items exactly as their labels promise ("2 Small + 1 Large", masonry, …); images render as real pictures with alt text and an Auto height that follows the image; a new Aspect Ratio control fixes banner shape regardless of the source image; and every per-item control (overlay, text colour, button style, image position) now takes effect. Grids built in the Visual builder are migrated automatically.
  • Subscriptions in My Account. A subscription order now carries a New subscription / Renewal badge in your order list, and the order detail shows a Subscription box — reference, status, recurring terms and the next renewal date — with an honest note on how it renews. (The storefront side of the Subscriptions rollout.)

Updated​

  • Clearer subscription checkout. On a subscription cart, checkout now explains that subscriptions are paid by card, and the order-received page shows the recurring terms in-flow with honest wording about how and when they renew. A custom (Page-Builder) checkout no longer leaves a subscriber at a dead end — a clear notice sends them back to the cart.
  • 61 more storefront strings are now translatable (Greek included) — across the account / subscriptions area, checkout, category and product pages, order-received and the product-question form.
  • The shop sidebar Brand filter now has a real on/off setting (Flavor → Shop → Filters).

Fixed​

  • Security (critical): the order-confirmation ("thank you") page no longer exposes order details to strangers. The order-received page now shows a generic confirmation unless the viewer can prove they placed the order. (See the plugin v9.12.0 note for the full fix.)
  • My Account email change & confirmation now work end-to-end and more safely — changing your email requires your current password, and the confirmation link's page handles logged-out and password-less accounts clearly. All strings are translatable (Greek).
  • The subscription recurring price shown at checkout and on the order-received page now excludes the one-time shipping that renewals never re-charge; unavailable subscription terms fail safely with a clear "contact us" notice; the "next payment" line states the real renewal mechanism; and add-to-cart rejections (e.g. the no-mixed-subscription-cart rule) now show a toast on every surface.

[9.1.0] - 2026-09-21 — Page Builder: flexible columns & ratios, layout coherence, Wrapper Style everywhere, Revision History & one-click layout upgrade​

A big Page Builder release. In the Visual editor a Section's columns are now fully flexible — add, remove and reorder them, set any ratio (or 5–6 columns), each with its own content. Wrapper Style controls (background, border, shadow, spacing) reach 33 blocks, every save is snapshotted for Revision History, and an admin notice offers a one-click upgrade of pages saved in an older format. Plus per-device responsive controls, clearer Section labels, security hardening, and the restored device-preview toolbar. Existing pages are unchanged.

Added​

  • Flexible Section columns (Visual editor). Add, remove and reorder columns directly — each column is its own block with its own content — instead of picking from a fixed 1–4 preset. A Columns control gives a quick count picker and ratio presets (Equal, 2:1, 1:2, 1:2:1, …) plus a Custom weights field and a per-column Width, so you can build any proportion (50/50, 25/25/50, …). 5- and 6-column sections are now editable in the Visual builder too, the left outline lists a section's real columns, and a Search blocks box filters the block drawer as you type. Your saved pages are unchanged.
  • Revision History for page layouts. Every builder save snapshots the previous layout; a Revision History panel lists them (with who/when) and lets you Preview or Restore any earlier version — and a Restore snapshots the current layout first, so it's undoable. Works in both editors.
  • One-click layout-format upgrade. When a site still has pages saved in an older builder format, an admin notice offers an upgrade: Preview reports what will change, Apply upgrades them all (taking a Revision History snapshot of each first, so it's reversible). It runs in the background and never touches a page you're editing.
  • Wrapper Style controls on 33 blocks. Background (colour/image), Border, Shadow and Spacing controls — in collapsible panels, in both editors — now appear on 33 blocks (headings, post/archive elements, galleries, product/category/team grids, pricing tables, testimonials, tables, accordions, tabs, counters and more), including Alert, Trust Badges and Map. The control paints the block's wrapper cleanly; your Custom CSS still wins.
  • Design System palette & spacing in the Visual editor. Every colour picker shows your Design System palette as clickable swatches (picking one stores the token, so the colour follows your DS site-wide), and the Wrapper Spacing / Border Radius controls suggest your DS spacing scale as you type. The Classic editor already had these; the Visual editor now matches.
  • Per-device Heading font size. The Heading block's font size gains a Desktop / Tablet / Mobile toggle (leave a device empty to inherit Desktop), following your Design System breakpoints — the first of more responsive controls to come.
  • WooCommerce migration: plugin-compatibility audit. The Analyze step now reads the active plugins on your source WooCommerce site and groups each by how Flavor covers it — carries over, enable a module, needs custom work, not available yet, or review — so you see the business-logic migration cost up front. Requires the updated WC Migration Bridge (1.15.0+) on the source site.

Updated​

  • Section layout controls, clarified. The column controls now name what they move: Column Content Flow (how blocks inside a column flow), Align Columns — Vertical / Horizontal, and a new Column Arrangement (Grid — proportional tracks with the per-column ratio, the default; or Flex — columns wrap/size to content and stack on tablet/mobile). Vertical/horizontal column alignment now previews correctly in both editors, ratio presets read as percentages, and the editor warns when a non-Stretch alignment would override your ratio. Existing pages keep the Grid arrangement.
  • More per-device Section controls. Column Gap, Top/Bottom Padding and Content Max Width are now per-device (Desktop / Tablet / Mobile), and a Section's Tablet/Mobile layout, padding and gap follow the breakpoints you set in Design System instead of fixed widths.
  • More reliable Custom CSS on a Section. Targeting a section with {selector} in its Custom CSS now correctly overrides the section's own background/padding/layout (emitted as a clean scoped rule), so your Custom CSS is the final word.
  • A tidier, consistent block sidebar. Custom CSS / CSS Class always sit last and the advanced cluster (Wrapper Style, Animation, Conditional Display, Responsive Visibility, Custom CSS) starts collapsed — in both editors — with the shared controls inherited from one central place so their order never drifts block-to-block.
  • Faster content-heavy pages + a safety bound. Dynamic-tag processing no longer scans inline CSS, a page's layout is read once per request, and a layout that nests or fans out too far (e.g. Query Loops inside Query Loops) is now capped with a clear editor notice instead of exhausting server memory.

Fixed​

  • Security: the {option:…} dynamic tag now uses a safe allowlist. It exposes only safe site options (title, tagline, URLs, date/time formats) instead of any option outside a small block-list — closing a path where a page author could print admin-only values (a mail-server password, a plugin's API key) to public visitors. {custom_field:…} no longer returns protected (_-prefixed) meta. ⚠ A page that used {option:…} for an option outside the allowlist will render blank there — developers can widen it via the flavor_dynamic_tag_option_allowlist filter.
  • No more empty-canvas data loss (Visual editor). The builder no longer opens with an empty canvas when a page's layout can't be loaded (a failed request, no page context, or a corrupted layout) — it shows a "couldn't load this page's layout" screen with Retry, so publishing can't overwrite your page with a blank one; and saving a page that would remove every section now asks first.
  • Stored-but-hidden columns are preserved + surfaced. When a section stores more columns than its layout shows, the content is kept (not deleted) and the Columns control shows a note plus a one-click "Make all N columns live". Multi-column and 5–6-column sections no longer lose their extra columns when opened and saved in the Visual editor. ⚠ If a page saved before this build already lost columns, recover them from Page Builder → Revision History.
  • Uneven column layouts render their true proportions everywhere. A "2/3 + 1/3" (or "1/3 + 2/3") section previously fell back to equal columns on the published page; it now renders the intended ratio on the frontend and in both editor canvases. ⚠ A live page with such a section built in the Visual editor will visibly change from equal columns to the intended ratio on update — this is the fix.
  • Section fixes. A Minimum Height with Vertical Alignment = Top/Bottom now aligns correctly (was always centred) ⚠ (a section with a Min Height but the default Top will shift from centred to top-aligned on update); custom column-width layouts no longer clip the last column when a gap is set (widths are now ratio weights); a wide element in a narrow column no longer breaks an uneven layout's proportions; "Inherit" mobile column layout now keeps the inherited arrangement instead of collapsing to one column; and Tablet/Mobile padding now reduces padding, not just adds it.
  • Classic editor drag-and-drop, much more capable. A block can now be dragged between different sections (and in/out of nested containers), dropped exactly where you want it, reordered within its column, and dragged back out to the page — and the canvas shows uneven layouts in their true proportions with the Tablet/Mobile device preview honouring the section's responsive layout.
  • Visual editor device-preview restored. Fixed a crash that broke drag & drop and scrolling in the editor canvas; it now renders reliably inside wp-admin with the native Desktop / Tablet / Mobile viewport toolbar back. Preview also works before a page's first publish, the Visual builder is the single owner of the layout (an old standard-editor tab can't silently revert it), and a failed save no longer reports "Saved".
  • Plus smaller fixes: a page with a posts/archive block no longer triggers a memory-exhausted error; responsive rules follow your Design System breakpoints; blocks rendered more than once on a page (Query Loop cards, duplicated sections) no longer share an element id; images picked in repeater blocks store the full-size URL (no more blurry images); and the block canvas preview strips unsafe markup before showing it in the editor.

[9.0.0] - 2026-09-11 — Compare 2.0 on the storefront, one-click compare/wishlist/quote buttons, and accurate variation stock everywhere​

A major storefront release. Product pages gain a real Specifications tab, shoppers can filter a category by its specifications, and Compare / Wishlist / Request-a-Quote buttons now appear right on the shop grid, product page and quick view — with one consistent look on desktop and mobile. A variable product's in-stock state now reflects its variations across the whole store, and a running-low item is flagged at checkout before payment.

Added​

  • Specifications tab on the product page. Each product shows its specifications — grouped into sections, typed, and unit-aware (a measurement reads "15.6 inch", a yes/no reads "Ναι/Όχι") — with a variable product's Size/Colour options preserved. The product page and the compare page always show the same values.
  • Filter a category by its specifications. The shop sidebar gains per-category specification filters — a range for numbers, checkboxes for options, Yes/No for booleans — built from the products actually in that category. Selections show as removable chips and are shareable via the URL. Turned on under Flavor Options → Shop (with the plugin's Product Specifications switch on).
  • Compare, Wishlist and Request-a-Quote buttons on the storefront. The three buttons now appear directly on the shop grid, product page and quick view, sharing one consistent look, keyboard behaviour and mobile layout. Guests can use compare and wishlist (stored in their browser). Request-a-Quote now sits beside Add to Cart as a clear labelled button.
  • A heads-up at checkout when an item has run low. The order summary shows a passive notice — naming the affected products — if a cart item is no longer available in the requested quantity, so you see it while reviewing rather than at the final step.

Updated​

  • The product page's Specifications tab got a visual polish (compact section titles, zebra rows, a mobile-tightened layout).
  • A saved secret (API key / password) in any module's settings can now be removed (not just replaced), with an Undo before you save.
  • A failed component file-integrity check now shows an admin notice (with a link to reinstall) instead of failing silently.
  • PDF Invoices now warns you if it and the ERP invoicing are both issuing invoices on a myDATA store — so you don't end up with two numbering series, one of which never reaches ΑΑΔΕ.

Fixed​

  • The product-comparison page keeps its styling and working remove/clear buttons when "Smart Asset Loading" is on.
  • A variable product's in-stock / out-of-stock badge now reflects its variations everywhere (shop grid, product page, quick view, related rows) — no more "in stock" when every variation is sold out, or the reverse.
  • A running-low product no longer disappears from related-product rows or gets advertised as "out of stock" to Google.
  • The shop no longer goes blank when a product request fails — an error message and a "Try Again" button appear.
  • The checkout no longer flashes a full-page spinner on arrival and during submission.
  • Customer-uploaded product-option files are no longer readable at a guessable public address.
  • A requested invoice correctly issues as a ΤΙΜΟΛΟΓΙΟ carrying the buyer's ΑΦΜ (not a receipt).
  • The invoice email no longer shows raw placeholder text; a product with inventory tracking turned off now displays correctly everywhere (no phantom "Only N left", no false "out of stock").

[8.2.0] - 2026-08-31 — Private invoice PDFs, emergency Lockdown Mode, reliable module updates & accurate checkout totals​

A large security- and accuracy-focused release. Invoice PDFs are now private, a single Lockdown Mode switch hardens your site while WordPress core is unpatched, enabled modules update reliably again, and every cart and checkout total now matches exactly what the shopper is charged.

Added​

  • Emergency Lockdown Mode. One switch under Flavor Options → Security force-enables every safe hardening control at once, so you can shrink your attack surface while a WordPress core vulnerability is still unpatched. It is non-destructive — it overrides your individual settings only while it is on, and restores them exactly when you switch it off. On the Business plan it can also raise itself automatically the moment an actively-exploited core vulnerability appears, and lower itself when that clears.
  • Product Inquiry — "Ask about this product". Show any of your contact forms directly on product pages, as a product tab, a popup under Add to Cart, or both (Flavor Modules → Product Inquiry, with per-product include/exclude scope). It reuses your existing form engine, so validation, spam protection, reCAPTCHA / Turnstile, GDPR settings and smart tags all carry over unchanged — and the message names the product the shopper asked about.
  • Running nginx? Generate a matching server config. Flavor Options → Optimize → Server Optimization now produces a ready-to-paste nginx snippet mirroring exactly the protection and caching rules you enabled, with Copy and Download .conf buttons. Because nginx ignores .htaccess, this closes the gap for stores that aren't on Apache. It writes nothing to your server — you paste it into your server { } block and reload nginx.
  • Two new optional protections on the Security tab — block the oEmbed discovery proxy (a rarely-used helper that has served as a request-forgery vector; normal post embeds keep working) and rate-limit comment submissions to slow automated flooding. Both are off by default and both join the Lockdown Mode preset.

Fixed​

  • Security: invoice PDFs are no longer readable by anyone who guesses the address. Customer invoice PDFs were stored at a sequential, public path, so an anonymous visitor could work through the numbers and download every invoice's full customer details (name, address, email, VAT number, line items). Downloads are now streamed only to authorised staff (and to a customer through a self-verifying link in their own invoice email), filenames are unguessable, the invoice folder is blocked at the web server, and existing invoices are renamed automatically on update. We strongly recommend updating.
  • Enabled modules update and appear in your dashboard again. A module whose files were present on your site but missing from the installed-components list was a dead end — no update was ever offered, it was invisible in the Flavor Core dashboard, and its card had no Install / Update / Uninstall button. Flavor now reconciles those modules automatically, so updates, the dashboard list, uninstall and integrity checks all work normally.
  • Saved passwords and API keys now confirm they are saved. Secret fields (myDATA/AADE password, image-optimization API key, SMTP password and the rest) are deliberately never sent back to your browser, so after saving they came up blank and looked like lost data. Every secret field across every module now shows a masked "saved" indicator — leave it blank to keep the stored value, or type to replace it.
  • Cart and checkout totals now always match what the shopper is charged. Every cart and checkout surface — the storefront and all page-builder templates — now shows your store's authoritative total with coupons and promotions itemised, instead of recalculating it in the browser and missing cart-level promotions. A free-shipping coupon shows "Free" consistently everywhere.
  • Checkout is honest about shipping. The full delivery address (country, region and postcode) now drives shipping and tax as it is entered; an address you don't ship to shows a clear "no shipping options for this address" message instead of quietly showing "Free"; and a card is never confirmed against a total that has since moved.
  • Two fatal errors that could take a site down are removed. Enabling the Size Guide or Product FAQ module used to white-screen every product page, and the Delivery Date Picker module used to white-screen the entire storefront. Both are fixed.
  • Optimization toggles that broke the site are fixed. Defer JavaScript no longer breaks module settings screens, the media library or the SEO and Contact Forms editors (it is now a front-end-only optimization), and Disable Heartbeat completely no longer crashes the site.
  • Image optimization. The Remote API URL and key now appear in Hybrid mode — previously they were hidden, so the remote service could never be set up and Hybrid quietly behaved as local-only. Turning on a new output format such as AVIF now correctly surfaces the missing work in Bulk Optimize instead of reporting "everything is optimized" (existing WebP-only sites are not forced to re-optimize). WebP conversion also no longer logs a PHP deprecation notice on PHP 8.5.
  • PDF invoices print the buyer's details exactly as they were at the time of sale. Name, address and email now come from the order itself rather than the live customer record, so re-downloading an old invoice always reproduces the original document. Product names, SKUs, quantities and street addresses now print correctly too (they could previously come out blank, as 0, or updated to a renamed product).
  • Features that silently did nothing now work. Size Guide and Product FAQ tabs appear on product pages; the Product FAQ and flash-countdown shortcodes render on a product page; Exit Intent's "Product pages" targeting works; Mega Menu's 13 blank menu icons render, its mobile "Submenu indent" slider takes effect and its "Scale" animation animates; the loyalty welcome bonus is now awarded to a shopper who registers after buying as a guest; and approving a wholesale application now actually assigns the customer's price group instead of leaving them on retail prices.
  • Broad security hardening pass. The newsletter signup form can no longer be used to probe internal services or relay mail, and is rate-limited and capped; the Request a Quote form is rate-limited; the public gift-card balance check no longer returns the recipient's and sender's names, emails and message (only the balance) and is rate-limited; a dead store-locator endpoint that exposed your full store list is removed; and manual gift-card balance and status changes are now recorded in the transaction ledger.
  • Abandoned-cart data retention now completes reliably on large stores. The cleanup sweep ran as one unbounded operation that could time out and roll back, leaving retention permanently stuck; it now runs in safe batches with proper indexes. What is retained is unchanged.
  • Account, Cart and Checkout pages are recognised correctly for SEO and page-specific asset loading, including when they are built with the Visual Page Builder.

Updated​

  • The Security tab is reorganised into one place. XML-RPC, self-pingbacks, Application Passwords, WordPress-version hiding and REST API restriction moved from Optimize to Flavor Options → Security; XML-RPC and author-enumeration blocking are now single controls with an optional "also block at the web server" layer instead of two disconnected switches; HTTP security headers and HSTS are controlled from one place; and security .htaccess rules now apply the moment you press Save rather than waiting for a separate Apply step on another tab. No setting changed — your stored values are migrated across automatically, and a control managed by Lockdown Mode now clearly shows as Managed by Lockdown instead of appearing unchecked.
  • A restricted REST API no longer breaks post embeds or licensing — WordPress post embeds and Flavor Core are always allowed through when you set REST API Restriction to "Logged In Users Only" or stricter.
  • The CSP Report-Only diagnostic now also reports client-side script sinks, giving you a fuller picture of your storefront's cross-site-scripting surface in the same violations table, with no extra setup. It is a diagnostic only and never blocks anything.
  • On a non-Business store, a core vulnerability with a free manual workaround now links you straight to it instead of only advertising the Business one-click mitigation.
  • Clearer wording across the Security and Optimize tabs, including a rewritten first-run hardening notice that states what was enabled and that no action is required.
  • Three half-built flows are safely gated while they are rebuilt. Converting a quote into an order, gift-card redemption at checkout, and the product-bundle add-to-cart could each produce an incorrect order, invoice or tax filing, so they are disabled for now with a clear admin notice. Gift-card management and balance lookup, the quote request and response workflow, and bundle display are unaffected.

[8.1.0] - 2026-08-03 — WordPress Core Protection, Security Hardening levels & accessible contact forms​

A security-focused release. Your store now gets an early warning when your WordPress core version has a known vulnerability, with an optional one-click way to reduce your exposure until you update. A new Security Hardening Level adds layered browser and file-upload protections in a single setting, Contact Forms became fully accessible, and the store currency now displays correctly everywhere.

Added​

  • WordPress Core Protection. When a vulnerability affecting your WordPress core version is disclosed, Flavor shows a clear admin warning listing the issues and the version to update to. On the Business plan you also get a one-click mitigation that reduces exposure to issues whose entry point can be gated — applied only when you confirm, and reverted automatically once you update core — plus an optional setting to apply mitigations automatically for actively-exploited issues. Detection is on every plan. (Flavor cannot patch WordPress core itself — this is honest early warning and best-effort mitigation, never a guarantee; updating core is the real fix.)
  • Security Hardening Level — Off / Low / Medium / Aggressive. One setting under Flavor Options → Security that layers browser and upload protections: a safe Content-Security-Policy subset, blocking executable file uploads, disabling PHP execution in your uploads folder (Apache/LiteSpeed), and blocking SVG/HTML uploads at the higher levels. It reduces the exploitability of injection and file-upload bugs without affecting a normal storefront, and existing stores start on the zero-risk Low baseline.
  • CSP Report-Only diagnostic. An opt-in tool that shows what a strict Content-Security-Policy would block on your store — collected on your own site — so you can plan a stricter policy without blocking anything yet.
  • Optionally block the WordPress REST batch endpoint — a Security setting to disable a broad multi-operation REST endpoint most stores never use, reducing your REST API's attack surface (off by default).
  • Contact Forms — full accessibility (WCAG 2.2): field errors appear at the field and are announced to screen readers, keyboard focus moves to the first field needing attention, and known fields (email/phone) autocomplete correctly.
  • Contact Forms — email-delivery status + product prefill: the Entries list shows whether each notification email Sent or Failed (a failed lead is no longer silently lost), and a form on a product page can prefill which product it's about.

Fixed​

  • The store currency now displays correctly on every storefront surface — changing your currency updates the symbol everywhere, and the picker now offers 23 currencies.
  • Stripe card payments now complete reliably at checkout.
  • Checkout no longer locks out new customers when Guest Checkout is off — it offers Login + Create Account and respects your account-creation settings.
  • Rate-limiting & login-protection hardening: a spoofed search-engine crawler can no longer bypass the rate limiter, the login lockout now identifies the real visitor behind a proxy/CDN, and the activity log is safe to open in a spreadsheet and no longer floods with repeated blocked-request entries.

[8.0.0] - 2026-07-27 — Contact Forms refocus, WooCommerce migration, back-in-stock alerts, product image zoom & recommendations​

A major release. Contact Forms was streamlined — A/B testing and detailed event analytics were removed in favour of a simple Views / Submissions / Conversion-rate counter, and forms gained show/hide conditional fields, smart-tag prefill and an order-picker add-on. Migrating from WooCommerce now brings across far more of your store, with a full report of anything skipped. Back-in-stock alerts got a complete storefront experience, product pages gained image zoom and a consistent frame, and product and cart pages now show related, upsell and cross-sell rails.

⚠️ Breaking Changes​

  • Contact Forms: A/B Testing and detailed per-event analytics are removed. Form stats are now a simple Views / Submissions / Conversion-rate counter. Any form with a live A/B experiment loses it, and historical experiment/analytics data is removed — but the upgrade first backs both tables up and verifies the backup before removing anything (and aborts safely, leaving your data untouched, if the backup fails), and your existing view counts carry over so no form resets to zero.

Added​

  • Product image zoom — with a choice of styles. Under Flavor Options → Shop → Products → Product Gallery, choose Lightbox (click for full-screen high-res with prev/next + keyboard + pinch-to-zoom), Magnifier (a lens follows your cursor), Inner zoom (zoom in place on hover), or None. The same section sets the image frame shape and fit so every product renders in a consistent, tidy box.
  • Related, upsell and cross-sell rails on the storefront. Product pages show "Upsells" and "Related products" rails; the cart shows a "Cross-sells" rail across all cart items. Each rail loads only when scrolled into view, hides when empty, and skips out-of-stock or unpriced items.
  • A far more complete WooCommerce migration. The migration tool now brings across variable products (attributes, variations, per-variation prices/stock/images), tax rates + shipping zones, coupons, product reviews (with their original dates), brands, cross-sells & up-sells, registered customer accounts — with the password each customer already knows, guest customers + address books, and your store currency & number formatting. A Migration Report shows exactly what was skipped, dropped or expanded (CSV-exportable), oversized/corrupt images are skipped-and-logged instead of crashing the run, and a built-in safeguard suppresses all customer emails during migration.
  • Contact Forms: show or hide a field based on what the visitor entered. Any field can carry show/hide rules — enforced both live in the browser and on the server (a hidden field is never required and its value is never stored).
  • Contact Forms: auto-fill a field from the logged-in customer's own data (name, email, and — with the Commerce add-on — their orders count, total spent, last order, and more), safely and only for the signed-in visitor.
  • Contact Forms — Commerce add-on: an Order Picker field. A logged-in customer picks from a dropdown of their own orders instead of typing an order number; guests get a normal text box. Available on any licence.
  • Contact form entries: scheduled auto-delete + privacy. A per-form retention setting (off by default), submitter-IP anonymization, consent records, and WordPress's Export/Erase Personal Data tools now include form entries.
  • Back-in-stock alerts with double opt-in and a full privacy floor. Shoppers can subscribe to be emailed when an out-of-stock product returns (double or single opt-in, your choice), with a stored consent record, one-click unsubscribe on every email, and automatic clean-up of old records.
  • Per-product back-in-stock control + a self-showing "Notify me" button. Enable/disable alerts per product (with a store-wide default), and a "🔔 Notify me when back in stock" button appears automatically on out-of-stock product pages.

Updated​

  • A site-wide Trusted Proxies setting so rate limiting works correctly behind Cloudflare, a load balancer or managed hosting — no wp-config edit needed (Flavor Options → Security).
  • Contact Forms internals were rebuilt for reliability: the entries CSV export now streams (no timeout on very large tables) and the form re-skins fully with your theme.

Fixed​

  • Security: rate limiting can no longer be bypassed behind a trusted proxy — the per-visitor limit now correctly identifies the real visitor.
  • Privacy: the Contact Forms upgrade backup folder is now protected from direct web access.
  • Product page: the main image now sits in a consistent frame across all products, and images load at the right size (faster pages).
  • Numerous WooCommerce-migration robustness fixes — retries and resumes are now safe and idempotent, partial (percentage) runs no longer flatten the category tree, and orders are automatically linked to their customers at the end of every run.
  • Back-in-stock notifications now actually send when a product returns to stock (they were wired to an event that never fired).
Full Version History

For the complete changelog including all previous versions, contact our support team.

Last updated on