PBJ Form Builder Changelog (v1.4.0): Guided Admin, From First Form to First Payment

PBJ Form Builder is our self-hosted form plugin: unlimited forms with custom fields, dropped anywhere via shortcode, with optional payments through Stripe, Square, or PayPal. Anti-bot protection is built in — math CAPTCHA, honeypot, time-trap, and per-IP rate limiting — with no Google reCAPTCHA anywhere. Here’s the version history.

Version 1.4.0 — every screen explains itself

1.4.0 is a documentation-and-UI release: no functional or database changes, but every admin screen now explains itself in plain English.

• Getting-started card on the Forms list: a live status checklist (forms created, payment provider configured, PBJ License Manager detected) plus five numbered steps covering building, embedding by slug or title (never numeric id — IDs change on a Studio→Live sync), testing, charging money, and the built-in anti-bot layers.
• Builder intro on the Add/Edit screen: how the page works — one row per field, the Required toggle, what each field type is for, field keys, half/full width — and the recommended slug-based shortcode shown alongside the title and id variants.
• Submissions intro: filtering by form, how paid amounts are stored and displayed, and what View and Delete actually do.
• Settings walkthroughs for each payment section, telling you exactly where to find your credentials: Square (Developer Dashboard → Credentials/Locations, sandbox vs production), Stripe (Dashboard → Developers → API keys, test vs live by key prefix), and PayPal (Developer Dashboard → Apps & Credentials) — plus buyer receipts, anti-bot switches, and general defaults.

Version 1.3.0 — license keys arrive

A License section was added to PBJ Form Builder’s settings. Enter the PBJ license key from your purchase and the plugin unlocks automatic updates straight from pbj.tech, delivered through the normal WordPress updates screen. The plugin is fully functional without a key — a key only gates updates, never features — and one key covers up to 3 sites.

Version 1.2.0

• Stripe gateway. Stripe.js Elements card field in the browser with a server-side PaymentIntents charge. Test vs live is decided by which keys you enter — no environment toggle to forget.
• Buyer receipt emails. Paid submissions email the buyer a receipt (fields, amount, transaction ID, gateway) with a configurable subject; replies go to the admin notification address.
• Richer admin emails — amount, transaction ID, and gateway on paid submissions, with Reply-To set to the buyer.
• Security hardening: proxy IP headers (CF-Connecting-IP / X-Forwarded-For) are no longer trusted by default; math-CAPTCHA tokens are single-use and bound to the form; Square and Stripe charges are idempotent so a retried submission can never double-charge; PayPal order creation is rate-limited; and field keys that would collide with the plugin’s own inputs are auto-prefixed.
• Time-trap hardening — a missing render timestamp is now rejected instead of skipping the check.
• Non-JS feedback — visitors without JavaScript now see the success or error message rendered server-side.
• Paid-but-unsaved alerting — if a payment captures but the submission row fails to save, the plugin logs a critical line and emails the admin the transaction details for recovery.

Version 1.1.1

• The shortcode now also resolves by exact title, e.g.
  Your name *

  Your email *

  Message *

  Leave this field blank

  Verify you are human: 8 - 5 = ? *

  Send message
  . Like slug, the title survives a Studio→Live clone, so the shortcode keeps resolving after a sync.

Version 1.1.0

• The shortcode accepts a slug attribute, e.g.
  Your name *

  Your email *

  Message *

  Leave this field blank

  Verify you are human: 16 - 2 = ? *

  Send message
  . Slugs survive a Studio→Live clone (numeric post IDs do not), so slug-based shortcodes keep resolving after a sync. The numeric id attribute still works.

Version 1.0.0

• Initial release: forms custom post type with shortcode renderer and field repeater builder.
• Standard field types (text, email, phone, URL, number, date, paragraph, dropdown, radio, checkbox, consent, hidden) plus a custom field type.
• Built-in anti-bot stack: math CAPTCHA (HMAC-signed, works on cached pages), honeypot, time-trap, and per-IP rate limit.
• Square Web Payments SDK integration with server-side charge, and PayPal Smart Buttons with server-side capture and amount verification.
• Submission storage with its own admin list and detail view, plus optional admin email notification.
• Update URI header and self-hosted updater for in-place upgrades, with settings schema versioning and idempotent migrations.