PBJ Forms & Products Changelog — 2.1.0

2.4.1 — Forms work on cached pages

• Fixed: forms on cached pages. A page cache stored the spam check with the page, so every visitor shared one challenge: the first submission used it up for everyone, and after 30 minutes every visitor was told the form had expired. Each visitor now gets a fresh challenge as the form loads. Without JavaScript the built-in challenge still works as before.
• Fixed: PayPal on sites installed in a subfolder or using plain permalinks.
• Updated the built-in license client: replacing or clearing a license key now frees this site’s slot on the old key, and the update download link is signed fresh at the moment WordPress downloads the update, so “Update now” no longer fails on an expired link.
• No database change.

2.4.0 — A real shop: products with options, coupons, tax, shipping and orders

• Forms and Products are two separate parts, each with its own switch in Setup. Switching one off hides its screens but never deletes anything, and forms or products already on your pages keep working.
• A new menu: Setup, Forms, Products, Orders, Coupons, Settings. Old links to the Cart screen now open Settings.
• Setup is a hub of switches. Every part has a card with a switch. Turning one on opens a short guide that asks one question at a time. Nothing is saved until the last screen, and every guide can be run again.
• Products work like a real shop: products with options (size, colour and so on), each with its own price, SKU, stock and picture; sale prices with dates; stock counts with “Only N left”; backorders; categories and tags; a gallery; weight and size; virtual or downloadable items.
• Product pages and a shop page. Every product gets its own page. Add [pbj_shop] to any page to list your products with categories, sorting and paging; Setup can make the page for you.
• Cart and checkout collect billing and shipping addresses, show shipping choices and tax, and accept coupon codes. The cart can be switched off while “Purchase now” products keep selling.
• Coupons: percentage, fixed cart and fixed product discounts, with expiry dates, usage limits, spend limits, product and category rules, “cannot be combined” and free shipping.
• Tax and shipping: tax rates by country and state, and shipping zones with flat rate, free shipping and local pickup.
• Orders: order numbers you can prefix, statuses, order notes, and full or partial refunds with optional restocking. A full PayPal refund can be sent straight to PayPal.
• Order emails to buyers (received, processing, completed, refunded, a note from you), each with its own switch, subject line and preview.
• Buttons match your theme, and license keys come from the cart: each PBJ License Manager product in a cart gets its key and download link.
• For developers: new pbj_form_builder_order_status_changed and pbj_form_builder_order_refunded actions; orders carry billing, shipping, coupon, tax and refund details as added keys; contract version stays 1.
• Settings DB 7 to 8: new settings get their defaults and nothing you saved is changed.

2.3.0 — Safer delete, sealed gateway secrets, stricter payments

• Deleting the plugin keeps your data unless you ask (code review 2026-09-28, fix-first #1). Forms, submissions, products, orders and settings are removed only when “Delete all forms, submissions, products, orders and settings when the plugin is deleted” is ticked under Setup › Basics.
• Gateway secrets are sealed (security #5). With PBJ CRM’s encryption available, Square, Stripe and PayPal secrets are stored encrypted (plain-text values are sealed on the next load); Setup › Payments shows only the last 4 characters of a saved secret, with a Clear button beside it (leaving the field blank still keeps it).
• PayPal checks the amount first (security #3). A PayPal order whose amount does not match the price is not captured, or is refunded, and the order is flagged.
• A gateway timeout is not a decline (security #4). When a charge cannot be confirmed the submission is held as “Payment uncertain” with the gateway reference and nothing is fulfilled; Submissions › Held for review shows the badge and a Release button.
• Removed the unreachable Guide page (and its Getting started panel), along with the unreachable Settings and Theme pages; every remaining help link points at the matching Setup step.
• Settings DB unchanged (7).

2.2.0 — Email bans and spam held for review

• A ban covers the email too. The Spam action adds every email address in the submission to a new Blocked emails list (Settings > Anti-bot and the setup screen) and deletes that address’s other submissions. A blocked address is silently dropped, the same way as a blocked IP, before any payment. Settings DB 6 to 7 (additive).
• Spam is held for review. Four rules flag a submission: a link in the message, Cyrillic or CJK text, a scam or lead-gen phrase, or a third post from one email within 24 hours. A flagged submission is stored under Submissions > Held for review with the reason, sends no email or receipt, fires no CRM or Help Desk event and is never charged; Release (not spam) publishes it and fires those once.

2.1.0 — Form submissions fixed, and a cart that works like a cart

Critical fix: on 2.0.0, 2.0.1 and 2.0.2 every JavaScript form submission posted to a 404. The submit code read form.action, but each rendered form carries a hidden input named action, and a form control of that name shadows the form’s own action property — so the request went to [object HTMLInputElement] and the visitor saw “Something went wrong.” Every gateway was affected. The endpoint is now read from the attribute. If you are running any 2.0.x, update.

• The cart is now one page. Line items with picture, unit price, a plus/minus quantity stepper and a real Remove button; a running item count and total; an empty-cart state; and an optional “Keep shopping” link.
• Quantity changes and removals no longer reload the page. They call a new JSON endpoint that recomputes the cart from published product config and returns the authoritative state. The plain form POST remains as the no-JavaScript fallback.
• Checkout sits beneath the cart on the same page. The pay button states the amount — “Pay 33.50 USD” — and follows the total as it changes.
• Product blocks gained a quantity chooser and confirm in place with “Added to your cart – View cart” instead of bouncing the shopper to the cart page.
• Products screen shows the checkout mode as a badge and the gateway beneath it, with a one-click copy button for each shortcode.
• Clearer product editor. The “Use Add to cart” tick-box becomes two explained choices, and the per-product gateway is hidden when a product is sold through the cart, because the Cart tab’s gateway is what charges it.
• Cart screen opens with a readiness panel that checks the facts: the cart page exists and contains the cart shortcode, a checkout form is chosen, the cart gateway has working credentials, and at least one product uses Add to cart.
• Richer order-ticket event. The neutral event now also carries customer_name, customer_phone, items, total_cents and currency, so a future PBJ CRM listener can raise an order ticket without unpacking the order itself. Additive; contract_version stays 1. No CRM code is loaded or required.
• Removed the unused product-details block left behind in the form editor by 1.6.0.
• Settings database version 5 → 6 (adds shop_page_url, blank by default).

2.0.2 — Bundled licence client refresh

The bundled PBJ license client moved to 1.2.0 (version stamp plus a drift warning when an older copy of the client loaded first on a multi-plugin site). No change to licensing behaviour or to the plugin itself.

2.0.1 — Semantic admin themes

PBJ Forms & Products now consumes the shared PBJ admin-theme contract without depending on PBJ CRM.

• Readable setup steps in every theme. Current, completed, and upcoming steps expose semantic states and receive matching foreground, background, and border colors.
• Theme-safe admin surfaces. Forms, products, setup cards, notices, controls, and layout tables use neutral --pbj-admin-* variables with WordPress-safe fallbacks.
• Content previews stay independent. Customer-facing preview frames are explicit content islands, so an admin theme cannot repaint the design being previewed.
• No selector hacks or CRM dependency. Forms publishes exact component and state attributes; CRM contains no Forms-specific selectors, includes, calls, or runtime dependency.

2.0.0 — Forms, products, and cart are separate

PBJ Forms & Products 2.0 turns the old combined builder into four clear admin workflows: Setup, Forms, Products, and Cart.

• Forms and products are independent records. Forms collect fields and outcomes. Products own the price, gateway, presentation, checkout form, and selling mode.
• One centralized setup. The six-step Setup walkthrough now owns the old settings, payment, protection, appearance, cart, and license controls. It is skippable and safe to rerun.
• Purchase now or Add to cart. Each product gets one simple toggle. Cart items and quantities stay server-side, and every price and total is recalculated from the published product.
• Private order records. Direct purchases and cart checkouts create idempotent order snapshots after the form submission is saved.
• Ready for the next CRM update. Versioned order-created and Help Desk ticket-request events are documented for the future CRM listener. PBJ Forms does not load or modify CRM.
• Backward compatible. Existing forms, submissions, shortcodes, paid checkouts, product presentation, theme values, and License Manager hooks remain intact. Legacy paid/product forms gain linked product records without rewriting the original form.

New shortcodes: and

1.6.1 — Licensed download handoff

Added the post-purchase redirect filter used by PBJ License Manager to attach a one-time download credential after a successful paid submission.

1.6.0 — Guide, appearance, and product presentation

Renamed the plugin to PBJ Forms & Products, added guided administration, site-wide appearance controls, and optional product presentation while preserving existing forms and shortcodes.

1.5.x — Spam controls

Added one-click spam handling, permanent sender-IP blocking, submission cleanup, and optional PBJ Geo Viewer country blocking.

1.2.0–1.4.0 — Payments and guided administration

Added Stripe, buyer receipts, payment hardening, stable slug/title shortcodes, licensing controls, and guided admin explanations.