Security: Webhook requests now use reject_unsafe_urls to block requests to internal IPs and unsafe ports (SSRF hardening, found in monthly AI-driven security review)
1.4.5
Added: hxfe_after_submit action hook — fires after successful form submission with $form_id, $values, $schema. Enables third-party plugins (e.g. HXMD) to capture submissions
1.4.4
Added: Cloudflare Turnstile field type (type: ‘turnstile’) — privacy-friendly spam protection as an alternative to reCAPTCHA
Added: Turnstile managed mode (auto-verification widget) and invisible mode (no UI, token obtained on submit)
Added: Turnstile site key / secret key settings under Settings → HXFE
Added: Server-side verification against Cloudflare’s siteverify API with fail-closed behavior in production
1.4.3
Fixed: Resolved double URL-encoding of the SMTP test result message (removed redundant urlencode/urldecode)
Fixed: Sanitize $_GET[‘test_msg’] before use in the settings page
Fixed: Shortened Short Description to under 150 characters
1.4.2
Added: SECURITY.md — security policy, vulnerability reporting, and disclosure timeline
Docs: Updated ai-reference.md — added design philosophy and maintainability section for AI agents
1.4.1
Updated: htmx 1.9.12 → 2.0.10
Changed: htmx script handle renamed to ‘hx-htmx’ (HX series shared handle)
Improved: Added wp_script_is() check to prevent duplicate htmx loading
1.4.0
Added: Error logging system — SMTP, Webhook, and reCAPTCHA errors are now logged to wp-content/hxfe-logs/
Added: Settings → Form Engine — Logs page to view and clear error logs from the admin
Added: Logs are color-coded by error type (SMTP / Webhook / reCAPTCHA / File)
Added: Automatic log cleanup after 30 days
Added: .htaccess protection on the log directory to prevent web access
Changed: Error logging now always active (previously required WP_DEBUG)
1.3.9
Fixed: Renamed htmx script handle from ‘htmx’ to ‘hxfe-htmx’ to avoid conflicts with other plugins loading htmx
Fixed: Duplicate shortcode on same page now renders a safe HTML comment instead of broken duplicate IDs
Docs: Added schema linter warning reference to ai-reference.md and HXFE-manual.md
1.3.8
Security: IP access control (allowed_ips) now uses REMOTE_ADDR only by default, ignoring forgeable proxy headers (X-Forwarded-For, etc.). Sites behind a trusted reverse proxy (e.g. Cloudflare) can opt in with define( ‘HXFE_TRUST_PROXY’, true ); in wp-config.php, or scope it precisely via the hxfe_trusted_proxy_headers filter. Action required only if you use allowed_ips behind a proxy.
Security: reCAPTCHA validation now fails closed in production when the secret key is missing (previously requests passed through unverified). Development environments with WP_DEBUG still skip validation for convenience.
Security: Form password comparison for plain-text passwords now uses hash_equals() to avoid timing side channels.
Security: CORS wildcard origin (*) no longer sends Access-Control-Allow-Credentials, avoiding the unsafe wildcard+credentials combination. Named origins are unaffected.
Dev: Schema lint now warns when a recaptcha field has no secret key configured.
1.3.7
Security: Removed skip_sanitize parameter from hxfe_process_fields() — all values are now sanitized on every call, including confirm→submit flow
Security: Clarified that sanitize_text_field() and related functions are idempotent, so re-sanitizing already-sanitized values is safe
1.3.6
Security: Added nonce verification to hxfe_handle_back() to prevent unauthorized form re-rendering
Security: Back button now passes hxfe_nonce (hxfe_validate_{form_id}) via hx-vals
Code: Clarified skip_sanitize=true comment in hxfe_handle_submit() to explain double-sanitize prevention
1.3.5
Renamed schema key: redirect_rules → complete_redirect_rules (consistent with other complete_* keys)
