Fix: radio buttons in “Buttons” display mode now lay out horizontally (side by side) instead of stacking vertically. The base field layout was overriding the flex direction due to higher CSS specificity.
New: configurable button shape — choose “Pill” (fully rounded, default), “Rounded” (matches form field radius) or “Square” (no rounding) in the block inspector when display is set to “Buttons”.
1.5.0
New: the Radio field can now display its choices as selectable buttons (“pills”) instead of a plain list — set “Display: Buttons” in the block inspector. The active choice fills with your form’s primary colour. Keyboard, screen-reader and no-JavaScript support are unchanged (the buttons are real radio inputs, only styled).
1.4.4
Fix: forms embedded outside the current page’s own content — in a footer or header template part, a synced pattern, a theme-builder element or a site-wide popup — were silently rejected on submit, because the submission was matched only against the current page’s content. Submissions now resolve the form wherever it actually lives, so popup and footer forms save correctly.
1.4.3
Critical fix: a variable-ordering error introduced in 1.4.0 aborted the whole frontend module on load — the proof-of-work spam solver never ran, so EVERY submission (popup or not) was silently rejected as spam and nothing was stored. If you are on 1.4.0-1.4.2, update immediately.
1.4.2
Fix: popup submissions now actually use the fetch path — the hidden admin-post “action” input shadowed the form’s action property in JavaScript, so every fetch went to a broken URL and silently fell back to the classic page-reload submit
Change: the spam-challenge token lifetime is now 30 minutes (was 5) — visitors who read a long page or open a popup form some minutes after page load were silently rejected with no feedback and no stored submission
1.4.1
Fix: the spam-challenge token is now consumed when a submission is accepted instead of when it is checked — a popup submission that failed validation can be corrected and resubmitted without hitting the replay guard (the popup flow never re-renders the page, so no fresh token is minted between attempts)
1.4.0
New: forms inside popups/modals now submit via fetch() without a page reload — the success card and validation errors render inline, so the popup stays open and the visitor sees the outcome
Applies automatically when a form sits inside a modal container ([role=”dialog”], a native <dialog> element, or the dbw popup block); forms in the normal page flow keep the exact same behaviour as before
All server-side protections (nonce, honeypot, time-check, spam challenge, duplicate-submission guard) run unchanged; redirect-after-submit still works from popups and network errors fall back to the classic submission
1.3.1
Update: plugin homepage now points to the dedicated product site at flinkform.de
1.3.0
New: duplicate-submission protection — a double-click, back-button resubmit or parallel request no longer creates a second entry, duplicate notification emails or repeated side effects (webhooks, payment verification in Pro)
New: flinkform_admin_format_value filter — add-ons can format field values on the submission detail view (Flinkform Pro uses it to render uploaded files as download links)
1.2.1
Fix: pages with a Flinkform are now excluded from full-page caching (DONOTCACHEPAGE) — prevents stale spam-challenge tokens from silently rejecting submissions on cached pages
1.2.0
UX: redesigned error messages with inline icon, subtle background on global errors, and a gentle shake animation on invalid fields
UX: consent field shows a clear “Please agree to continue” error instead of the internal field name
UX: removed the thick left-border error indicator in favour of a cleaner full-border highlight
1.1.1
UX: consent field error message fix (included in 1.2.0)
1.1.0
Fix: consent checkbox is now correctly enforced as required during server-side validation (previously the required attribute was lost because Gutenberg does not serialise defaults)
GDPR: new default consent text with inline privacy-policy link (replaces the old appended link)
GDPR: consent text supports a {privacy_policy} placeholder that renders as an inline link to the site’s privacy-policy page
UX: updated default success message to “Thank you! Your message has been sent successfully.”
Backwards-compatible: forms saved with the old consent text or success message automatically use the new defaults
1.0.4
i18n: regenerate German (de_DE) translation files (.mo + .json) to ensure all editor strings are up to date
1.0.3
Style: reduce consent checkbox label to 12px for a cleaner visual hierarchy
1.0.0
Floating labels now work on all text-input field types (URL, phone, date, select) – previously only text, email, textarea and number were supported
Date and select fields start with the label in the lifted/notched position since they always show native browser UI
Beside and hidden label positions now also apply to URL, phone, date and select fields
Fix: style toggle buttons (field style, label position) no longer overflow in the editor sidebar, especially with longer translated labels
First stable release
0.4.2
i18n: block attribute defaults (success message, submit label, consent text) are now translated at render time – existing forms on non-English sites display the correct language without manual editing
i18n: complete German (de_DE) translation – all frontend text, editor UI, admin screens and validation messages
i18n: load bundled translations via load_plugin_textdomain() so they work without waiting for translate.wordpress.org
Fix: the “Add field” editor button no longer inherits a 62 px font-size when the form block is placed inside a Spectra/UAGB container
0.4.0
Renamed the plugin to Flinkform (new slug, text domain, prefixes flinkform_/FLINKFORM_, block namespace flinkform/*)
Security: the spam time-check timestamp is now HMAC-signed and form-bound, so it can no longer be forged
Security: additional sanitisation on the notification Reply-To header
Reliability: the daily retention purge is now guarded against overlapping cron runs
Corrected the FAQ: multi-step forms are part of the free core (and always were since 0.2.7)
Fixed the plugin and author URIs to use a resolvable host (www.dennisbuchwald.de)
Documented the public source repository and build steps in the readme (Source Code section)
Output escaping: conditional-logic data attributes are now escaped late at render time (esc_attr), and submission detail values are output via wp_kses_post()
0.3.0
Renamed all WordPress-global prefixes to satisfy WordPress.org naming requirements
Revised readme description to remove promotional language
0.2.9
WordPress.org Plugin Check pass: documented the safe direct custom-table queries, fixed admin sort-order input handling, sanitised spam/honeypot inputs — no functional change
Resolved all Plugin Check errors and warnings (output escaping is handled internally; queries are prepared)
0.2.8
Added a dedicated Consent field (GDPR), per-form retention auto-purge, and a GPLv2 LICENSE file
Accessibility: explicit focus rings for checkboxes/radios/toggles, High-Contrast-Mode-safe focus on the soft field style, aria-invalid on group/consent errors, improved contrast
Hardening: mail subject + Reply-To stripped of CR/LF; privacy-policy strings escaped; webhook header REST input sanitised
Privacy text now documents the retention period and the strictly-necessary flash cookie
0.2.7
Architecture refactor: the core stays fully free (incl. multi-step + conditional logic); integration features (webhooks, SMTP, CSV export) were factored out of the core
Privacy: full WordPress privacy-tools integration (exporter + eraser); accurate disclosure of the single strictly-necessary flash cookie
Accessibility: broader prefers-reduced-motion coverage; required spam-math fallback for no-JS visitors
Hardening: defence-in-depth against mail-header injection; open-redirect-safe thank-you redirects
