PBJ Form Builder Changelog (v1.5.1): One-Click Spam Bans That Name the Country

PBJ Form Builder is our self-hosted form plugin: unlimited forms with custom fields, dropped anywhere via shortcode, with optional payments through Stripe, Square, or PayPal. Anti-bot protection is built in — math CAPTCHA, honeypot, time-trap, and per-IP rate limiting — with no Google reCAPTCHA anywhere. Here’s the version history.

Version 1.5.1 — the block button tells you the country

A small follow-up to 1.5.0: the Geo Viewer offer after marking spam now resolves the IP’s country before you click anything. Instead of a generic “block the sender’s country”, the notice reads “203.0.113.7 resolves to Russia (RU)” and the button says Block Russia (RU) — the confirmation prompt and the success notice name the country too, so there’s never any doubt about what you’re blocking. If the lookup hasn’t succeeded yet, the generic button remains and simply retries when clicked. No settings or database changes.

Version 1.5.0 — mark it spam once, never hear from that IP again

1.5.0 turns the Submissions screen into a spam command center. Every entry now has a Spam action: one click permanently blocks the sender’s IP address and deletes every submission that IP ever made — not just the one you clicked.

• Silent drops. Blocked IPs aren’t shown an error — they get the form’s normal success message while nothing is stored, no notification email is sent, and no card is ever charged. All three gateways are guarded, including both PayPal endpoints, where the refusal is indistinguishable from the ordinary rate limiter. The spammer never learns they’re blocked, so they don’t adapt.
• Editable ban list. A new “Blocked IPs (spam)” box under Settings → Anti-bot lists every blocked address, one per line — remove a line to unblock it.
• PBJ Geo Viewer teamwork. With PBJ Geo Viewer installed, marking spam offers two one-click follow-ups: make the sender’s entire country view-only site-wide (pages stay visible; forms, purchases, comments, and sign-ups are disabled), or add just that IP to Geo Viewer’s site-wide blacklist.

The settings schema moves from 2 to 3 (a new blocked-IP list; existing settings are untouched). Update through the WordPress updates screen as usual.

Version 1.4.0 — every screen explains itself

1.4.0 is a documentation-and-UI release: no functional or database changes, but every admin screen now explains itself in plain English.

• Getting-started card on the Forms list: a live status checklist (forms created, payment provider configured, PBJ License Manager detected) plus five numbered steps covering building, embedding by slug or title (never numeric id — IDs change on a Studio→Live sync), testing, charging money, and the built-in anti-bot layers.
• Builder intro on the Add/Edit screen: how the page works — one row per field, the Required toggle, what each field type is for, field keys, half/full width — and the recommended slug-based shortcode shown alongside the title and id variants.
• Submissions intro: filtering by form, how paid amounts are stored and displayed, and what View and Delete actually do.
• Settings walkthroughs for each payment section, telling you exactly where to find your credentials: Square (Developer Dashboard → Credentials/Locations, sandbox vs production), Stripe (Dashboard → Developers → API keys, test vs live by key prefix), and PayPal (Developer Dashboard → Apps & Credentials) — plus buyer receipts, anti-bot switches, and general defaults.

Version 1.3.0 — license keys arrive

A License section was added to PBJ Form Builder’s settings. Enter the PBJ license key from your purchase and the plugin unlocks automatic updates straight from pbj.tech, delivered through the normal WordPress updates screen. The plugin is fully functional without a key — a key only gates updates, never features — and one key covers up to 3 sites.

Version 1.2.0

• Stripe gateway. Stripe.js Elements card field in the browser with a server-side PaymentIntents charge. Test vs live is decided by which keys you enter — no environment toggle to forget.
• Buyer receipt emails. Paid submissions email the buyer a receipt (fields, amount, transaction ID, gateway) with a configurable subject; replies go to the admin notification address.
• Richer admin emails — amount, transaction ID, and gateway on paid submissions, with Reply-To set to the buyer.
• Security hardening: proxy IP headers (CF-Connecting-IP / X-Forwarded-For) are no longer trusted by default; math-CAPTCHA tokens are single-use and bound to the form; Square and Stripe charges are idempotent so a retried submission can never double-charge; PayPal order creation is rate-limited; and field keys that would collide with the plugin’s own inputs are auto-prefixed.
• Time-trap hardening — a missing render timestamp is now rejected instead of skipping the check.
• Non-JS feedback — visitors without JavaScript now see the success or error message rendered server-side.
• Paid-but-unsaved alerting — if a payment captures but the submission row fails to save, the plugin logs a critical line and emails the admin the transaction details for recovery.

Version 1.1.1

• The [pbj_form] shortcode now also resolves by exact title, e.g. [pbj_form title="Contact PBJ.Tech"]. Like slug, the title survives a Studio→Live clone, so the shortcode keeps resolving after a sync.

Version 1.1.0

• The [pbj_form] shortcode accepts a slug attribute, e.g. [pbj_form slug="contact-pbj-tech"]. Slugs survive a Studio→Live clone (numeric post IDs do not), so slug-based shortcodes keep resolving after a sync. The numeric id attribute still works.

Version 1.0.0

• Initial release: forms custom post type with shortcode renderer and field repeater builder.
• Standard field types (text, email, phone, URL, number, date, paragraph, dropdown, radio, checkbox, consent, hidden) plus a custom field type.
• Built-in anti-bot stack: math CAPTCHA (HMAC-signed, works on cached pages), honeypot, time-trap, and per-IP rate limit.
• Square Web Payments SDK integration with server-side charge, and PayPal Smart Buttons with server-side capture and amount verification.
• Submission storage with its own admin list and detail view, plus optional admin email notification.
• Update URI header and self-hosted updater for in-place upgrades, with settings schema versioning and idempotent migrations.