Fixed – Wrapped all plugin functions inside the Freemius function_exists guard to prevent “Cannot redeclare” fatals when free and premium builds load together during an upgrade switch (F1)
Fixed – Comment form action now sets the sj5 token on DOMContentLoaded instead of on scroll, so legitimate commenters who never scroll are no longer blocked with “Form validation failed” (F2)
Security – sj5 HMAC token is now time-boxed and rotates hourly (accepts current and previous window) to prevent indefinite token replay; validated with hash_equals() (S1)
Fixed – Empty/missing HTTP referer is no longer hard-blocked, eliminating false positives for privacy browsers, Referrer-Policy: no-referrer, and proxies (S2)
Enhancement – WooCommerce: comment protection script no longer loads on product pages for users who cannot leave a verified-purchase review
