= 1.5.3 =
* Security: Checkout now uses a signed, server-authored contract for the form, price, currency, billing interval, gateway, and payment method; cached 1.5.2 pages receive a bounded compatibility path that still resolves values from the current form.
* Reliability: Stripe checkout attempts now keep durable local/provider references and stable idempotency across duplicate clicks, reloads, retries, and lost responses.
* Reliability: One-time and subscription checkout now validates Stripe products, prices, customers, intents, first invoices, amounts, currencies, modes, and payment methods before reporting an outcome.
* Fixed: Payment Page 1.5.2 incorrectly added a subscription's configured First Payment Amount on top of the recurring price; 1.5.3 now uses it as the exact first invoice amount while later invoices remain at the recurring price.
* Reliability: Browser recovery now reconciles interrupted Stripe attempts with WordPress and safely clears terminal failures so customers can retry.
* Compatibility: Free and Pro checkout now use the same explicit Stripe API 2024-06-20 response contract. Existing Payment Page 1.5.2 webhook endpoints using 2026-04-22.dahlia remain supported and are upgraded in place without rotating their signing secrets.
* Webhooks: Stripe handling now covers the complete released 12-event payment, setup, invoice, and subscription lifecycle with ordered, idempotent processing.
* Webhooks: Payment Page-owned Stripe Connect endpoints can be upgraded in the background to the required event set; manually managed endpoints are left untouched and must be configured with the event list shown in wp-admin.
* PayPal: Standard Checkout remains one-time only, with server-created orders, exact amount/currency/order binding, server-side capture verification, idempotent retries, and verified webhook reconciliation.
* Fixed: The wp-admin form preview now renders selected payment methods even when the current gateway mode is not connected.
* Fixed: Imported templates now preserve their exact payment-method choices instead of inheriting every enabled gateway method.
* Safety: Admin previews no longer initialize payment-provider SDKs or synchronize payment data.
* Fixed: The form editor now fails closed instead of leaving a loader visible when no eligible gateway exists or optional marketing content is unavailable.
* Fixed: The form editor settings and preview now adapt to smaller screens.
* Corrected: ACH now uses a neutral bank icon and evergreen Stripe Financial Connections migration guidance instead of legacy Plaid branding and an unverified cutoff date.
* Corrected: Microsoft Pay, which is no longer supported by the Stripe wallet integration, is no longer selectable or rendered; legacy stored values remain inert and other supported payment methods remain unchanged.
* Fixed: All 10 bundled form templates now import their complete settings as one intact WordPress metadata value.
* Fixed: URL prefill now accepts only valid currency, billing-frequency, and amount combinations; return parameters preserve existing queries and fragments; custom amounts respect zero-, two-, and three-decimal currencies.
* Compatibility: Restored WordPress 6.1–6.3 installation and update support after validating Payment Page 1.5.3 on WordPress 6.1.1 with PHP 7.4.
* Reliability: PayPal certificate-error retries now use WordPress core's readable CA bundle; ordinary cURL certificate handling is unchanged.
* Safety: Freemius uninstall now invokes Payment Page's strict cleanup guards in both Free and Pro, and refuses destructive cleanup when recent payment activity cannot be verified.
* Compatibility: Activating Free or Pro now quietly deactivates the other package before a second Payment Page runtime can bootstrap.
* Packaging: Free and Pro distributions no longer include the vendored PSR logger test classes.

= 1.5.2 =
* Fixed: Checkout no longer fails with "Cookie check failed" on cached pages.
* Fixed: Payment Form admin screens no longer error on older WordPress versions.
* Compatibility: Now requires WordPress 6.4 and PHP 7.4 or newer.
* Compatibility: Tested up to WordPress 7.1. Updated Freemius SDK.

= 1.5.1 =
* Critical Stripe Connect hotfix — three 1.5.0 regressions that broke connect end-to-end, each masked by the previous. All verified against a live Stripe test-mode connect.
* Fix 1 (403): connect-callback REST endpoint gated via current_user_can(), which fails in REST context without a _wpnonce that Stripe's OAuth redirect can't carry. Now reads the wordpress_logged_in_* cookie directly via wp_validate_auth_cookie(), then user_can(uid, PAYMENT_PAGE_ADMIN_CAP) + per-user state-token check. F001 security model preserved.
* Fix 2 (fatal): 1.5.0 P4 perf pass lazy-loaded app/_functions/administration.php behind is_admin(), but REST handlers need it and is_admin() is false in REST context -> "Call to undefined function _payment_page_stripe_payment_methods_background_setup()". Now also loaded on REST + AJAX; frontend perf win unaffected.
* Fix 3 (webhook): auto-provisioner (Shortcut #5904) omitted the api_version required when creating a webhook endpoint on a connected account, so every connect silently failed to register the webhook and kept the old signing secret -> events never delivered. Now passes the SDK-pinned 2026-04-22.dahlia on create; endpoint registered + real signing secret persisted.
* Merchants who connected Stripe between 1.5.0 and 1.5.1 should re-run Payment Gateways -> Connect with Stripe once to register the webhook and refresh the signing secret.

= 1.5.0 =
* ACH Direct Debit migrated from the legacy Charges + Tokens + Plaid stack to Stripe Financial Connections + PaymentIntents. Merchants reusing previously saved bank accounts should follow Stripe's ACH migration and mandate requirements. Shortcut #7177.
* Stripe PHP SDK bumped 15.7.0 → 20.1.0, API version pinned to 2026-04-22.dahlia.
* Reliability: Stripe webhook now catches SignatureVerificationException; idempotent (7-day transient dedupe + is_paid short-circuit); handles payment_intent.payment_failed + payment_intent.processing events; PayPal webhook errors now logged via PP_Model_Log (no more silent swallow); webhook routes restricted to POST. Audit S1+S2+S5+S14+S17.
* Reliability: subscription-with-setup-fee no longer uses sleep(1) race — switched to canonical add_invoice_items pattern. Shortcut #7141 / Audit S10+P7.
* Security: Stripe Connect callback now requires PAYMENT_PAGE_ADMIN_CAP and a 10-minute single-use state token. Shortcut #7142 / Audit F001.
* Security: template import rejects PHP-serialized strings (was maybe_unserialize — RCE-class vector). Shortcut #7144 / Audit F003.
* Security: hardening bundle — Settings::update recursive sanitize (F004), Payment::sync_details hash_hmac sha256 + no literal salt fallback (F005), Migration AJAX nonce (F006), drop data: protocol from admin-notice wp_kses (F008), force-db-table-integrity nonce (F011), $_GET['page'] sanitize (F012), Skeleton ORM column allow-list (S11), sync_details per-IP rate limit (S12), sanitize-on-write for identity fields (S13).
* Performance: conditional frontend enqueue (P1) — Payment Page assets no longer load on every page; only when a [payment-page-payment-form] shortcode, Elementor widget, or pp_payment_form singular is present. Biggest LCP/TBT win.
* Performance: payment_page_settings autoload=no (P3); admin + Elementor function files lazy-loaded (P4); jQuery UI base theme bundled locally instead of code.jquery.com CDN (P8); .distignore strips dev artifacts from distribution zip (P11).
* Folded: Confirmation Email Builder GA v2 (Shortcut #6932) + Stripe Connect webhook auto-provision v2 (Shortcut #5904).

= 1.4.10 =
* Compat: WP 7.0 readiness — Requires PHP bumped to 7.4 (matches WP 7.0 runtime floor); Tested up to 7.0. No functional changes.

= 1.4.9 =
* Fix: admin Connect Stripe button spun forever; the dashboard JS was reading the gateway config from the wrong path (`configuration.payment_gateway` instead of `data.payment_gateway`). Shortcut #6953.
* Fix: "Cookie check failed" no longer blocks the payment form on desktop browsers that restrict third-party cookies (Safari ITP, Firefox ETP, ad-blockers). Stripe.js is now initialized with `advancedFraudSignals: false` by default; sites that want the full Radar advanced-signals fingerprinting back can opt in via the new `payment_page_stripe_advanced_fraud_signals` filter. Shortcut #6937.
* Fix: Elementor's widget editor (including the built-in Form widget) no longer breaks when Payment Page is active. Our Elementor control scripts called the deprecated `jQuery(window).load(fn)`, which was removed in jQuery 3.0 and threw a TypeError under WP 6.x / Elementor 3.x, blocking Elementor's editor init. Switched all six bundled control scripts to `jQuery(window).on('load', fn)`. Shortcut #3807.
* Fix: "Show Payment Details" toggle now actually hides the post-payment details template on forms built with the Elementor widget. The previous logic only matched `'no'` (the off-value our custom form-builder saves) and missed `''` (the empty-string off-value Elementor's SWITCHER control saves), so Elementor-built forms always rendered the details. Shortcut #3993.
* Fix: WP Rocket (and any other page-cache plugin honoring `DONOTCACHEPAGE`) no longer caches pages that contain a payment form. Cached HTML contained per-request data — `uniqid()`, browser-detected wallet flag, Stripe publishable_key — that was being served to subsequent visitors, surfacing as "This wallet is not compatible in your browser" and Microsoft Pay initiating Google Pay flow. The form now sets `DONOTCACHEPAGE` on render and registers a `rocket_excluded_inline_js_content` filter that keeps the inline `payment_page_data` localized config out of WP Rocket's combine / minify / delay passes. Shortcut #3731.

= 1.4.7 =
* Security upgrades.

= 1.4.6 =
* Update Freemius.

= 1.4.5 =
* Fix translations for payment frequency filter.
* Freemius SDK updated.

= 1.4.4 =
* Domain API update.

= 1.4.3 =
* Freemius SDK update. 

= 1.4.2 =
* Implemented Elementor Colors API.
* Freemius SDK update. 

= 1.4.1 =
* Fix to draft mode form. 
* General UI improvements. 
* Freemius SDK update. 

= 1.4.0 =
* Freemius SDK update. 

= 1.3.9 =
* Translation fixes.

= 1.3.8 =
* Translation fixes.

= 1.3.7 =
* Translation fixes. 
* Freemius SDK update. 

= 1.3.6 =
* Fix to Stripe return URL.
* Minor UI/template changes. 

= 1.3.5 =
* Update to template importing.
* Other general UI changes. 

= 1.3.4 =
* Subscriptions now included in free version! 
* Stripe library update.

= 1.3.3 =
* Fix to Plaid/ACH activation. 

= 1.3.2 =
* New custom payment form builder! 

= 1.3.1 =
* Code formatting improvements.
* Update Freemius SDK. 

= 1.3 =
* Updates to formatting of payment confirmation emails.
* Fixes to non-decimal currencies charging incorrectly. 
* Update Freemius SDK. 

= 1.2.9 =
* Update Freemius SDK. 

= 1.2.8 = 
* Improved the methods for storing Stripe and PayPal transaction details in the database. 
* Added Paypal transaction description to be from the pricing plan name. 
* Migration bugfix. 
* Decreased the size of a loading animation GIF to just 22kb. 

= 1.2.7 =
* Updated Freemius SDK to v2.4.5. 

= 1.2.6 =
* Added Payment Description field to show up properly in Stripe receipts (matches pricing name). 
* Ensured submit button automatically activates when all fields are automatically pre-filled. 

= 1.2.5 =
* Added polyfill function to properly handle webhooks. 
* Fix for database migration issues. 

= 1.2.4 =
* Implemented confirmation emails for Admin and Payer. 
* Implemented PayPal Webhooks to verify payments for Form Actions on Submit. 
* Updated Freemius SDK to v2.4.4. 

= 1.2.3 = 
* Updates to custom actions on payment completion, which now includes the currently logged in user in the request. 

= 1.2.2 = 
* Added the option to have a different first payment amount in a subscription. 
* Updates to the custom actions on payment completion. 

= 1.2.1 = 
* Zip code field is now optional. 
* Added support for custom actions on payment completion. 

= 1.2.0 = 
* Updated Quick Setup to be optional.
* Switched order of Templates and Gateways tabs to make Templates more readily available.
* Enabled Demo mode on the payment form to display without any gateways connected.
* Made Custom Payment Amounts available in the free version. 
* Made all Stripe payment methods available in the free version, except ACH via Plaid. 
* Added Stripe platform fee in free version. 

= 1.1.3 = 
* Fix to German translation of SEPA mandate.
* You can now prefill form fields with query string parameters. 
* Added Action for sending HTTP request of form data to external URL. 

= 1.1.2 =
* SEPA mandate translated to German.
* Better error handling for PayPal. 

= 1.1.1.1 = 
* Fix to PayPal integration where PayPal could not be disabled in some cases. 
* Fix to Payment Method tabs not appearing in Free version with China Payments Plugin enabled. 
* Improvements to settings layout. 

= 1.1.1 = 
* Update to Features Notifications section so you can more easily stay up to date when we release new features.  

= 1.1 = 
* Added PayPal Standard Integration! You can now accept one-time PayPal payments with the standard checkout flow that requires logging into a PayPal account.
* Added Stripe Payment Methods Google Pay, Apple Pay, and Microsoft Pay. 
* The Stripe + Plaid integration is now supported for ACH transactions. Register a Plaid account and utilize Stripe to allow customers to seamlessly make ACH payments with US-based bank accounts. 
* Custom form fields are now supported.
* Form fields can now be reordered.  
* Desktop and mobile width settings are now available for form fields. 

= 1.0.8 =
* Added Stripe Payment Methods SEPA Direct Debit, WeChat Pay, and Alipay.
* Tons of styling improvements and updates to the payment form.
* Added Tabs and Payment Buttons mechanisms - now the payment form supports multiple payment options.
* Stripe account name now appears next to TEST/LIVE switcher after connecting. 
* TEST/LIVE mode button added to WP-Admin bar.
* All 10 templates have had a huge makeover! 
* SCA integration 100% implemented. 
* We now show a little 'Payment Page' label next to each page where a payment form is detected.
* Error message added if no gateway is connected. 
* Added integration with China Payments Plugin. 

= 1.0.7 =
* Refactored Elementor payment form widget to vanilla JS/CSS.
* Stripe now fully attaches customer details for one-time and recurring payments. 
* Decimal issues for various currencies have been fully resolved. 
* Improving the validation for multiple pricing plans being selected in the Elementor Widget. 

= 1.0.6 =
* New First Time UX and Settings area.
* Major rebuild of Stripe Connect API. 
* Fixes to Stripe Connect Onboarding.
* Templates are now cached for retrieval once every hour instead of being loaded each time they are accessed. 

= 1.0.5.1 =
* Bugfix where payment form wasn't rendering properly in some cases. 

= 1.0.5 =
* Major styling fixes to the payment form.

= 1.0.4 = 
* Bug-fixes for opt-in form
* Fixed redirection issue
* Fixed filters not appearing in some cases
* Fixed WP Admin styling components (typography conflict)

= 1.0.3 = 
* Added custom payment amounts
* Prepared for AppSumo launch! 

= 1.0.2 = 
* Fixed subscriptions issue
* Updated and prepared for AppSumo launch!

= 1.0.1 = 
* Major bug fixes to Elementor Widget and Setup Wizard.

= 1.0 =
* Our first version! Woo-hoo!
