Firebox Pro 3.1.15

Improved

• Improved security across the plugin, including how campaigns are searched, previewed and tracked, how form submissions and integrations are handled, and how visitor information is read.
• Your captcha secret keys and MaxMind license key now stay on the server and are no longer shared with the campaign editor.
• The {user.*} Smart Tag now only returns profile details such as name and email.
• Stored integration credentials (MailChimp, Brevo, Klaviyo and others) get an extra layer of protection. Existing connections keep working.
• Visitor cookies now work correctly on sites served over plain HTTP.
• IP and Geolocation conditions now detect a reverse proxy on your own network automatically. If your site sits behind a CDN that does not pass the visitor's address through to WordPress, the new fpframework/trusted_proxies filter lets you tell FireBox about it.
• The Cloudflare Turnstile and hCaptcha setup notice in the campaign editor now also appears when only the secret key is missing.

Fixed

• The Brevo integration failed to load your contact lists.

Fixed

• Fixed an issue in the free version where a campaign using Custom JavaScript could cause an error on the front end.

Improved

• Improved compatibility with WP Rocket: FireBox now automatically excludes its files from Delay JavaScript Execution, minification, and Remove Unused CSS, so campaigns keep working without adding manual exclusions in WP Rocket's settings.

Fixed

• Custom PHP in display conditions and PHP Scripts now runs only for campaigns whose author holds a dedicated "run PHP" permission. Administrators have it by default; other roles cannot run PHP unless you grant them the permission deliberately.
• Custom JavaScript and custom CSS on a campaign now run only for campaigns whose author is allowed to add code. Administrators can by default; other roles cannot add custom code unless you grant them the permission deliberately. Custom CSS is also cleaned so it can't be used to inject anything other than styles.
• Turning a campaign on or off from the campaigns list now checks that you have permission to edit that specific campaign, and only ever changes FireBox campaigns.
• Values taken from the current page address and the referring page now have any code removed before they appear inside a campaign, so a crafted link can't inject content into your campaigns.
• Duplicating a campaign now checks you have permission to edit it, and the copy belongs to whoever created it.

New

• A limit on how many times the same visitor can submit a form each minute, so a single visitor can't spam your submissions list.

Improved

• WordPress 7.1 compatibility.
• Improved Multisite support: FireBox now sets itself up on every site of a network, including sites added later, so campaigns, analytics and permissions work without visiting each site first.
• Improved Multisite support: campaigns on different sites of a network no longer share cookies, so closing a campaign on one site can't hide a campaign on another.
• Improved Multisite support: removing FireBox from a network now clears each site's data according to that site's own "Keep data on uninstall" setting, and deleting a site removes its FireBox data with it.
• Cookies now follow your site's WordPress cookie settings, so campaign frequency and analytics keep working on sites that share cookies between www and non-www addresses.
• Improved how integration credentials (MailChimp, Brevo, Klaviyo, and others) are stored.
• Improved the handling of imported campaigns so their content is cleaned up before it is saved.
• Improved how Rating field values are shown in the Submissions list.

Fixed

• Page slide campaigns could appear full-height and outside their slide area on some sites.
• An error that could occur while FireBox was updating itself.

New

• A new campaigns list with ability to sort, filter, and manage your campaigns in bulk.

Improved

• Improved security of visitor cookie handling on campaigns using a daily, weekly, or monthly display frequency.
• Improved security of Phone Number values shown in the Submissions list and in admin notification emails.
• Improved security of the {post.*} and {cookie.*} Smart Tags, which now strip HTML from their values, matching the {querystring.*} Smart Tag.
• Compatibility of YouTube shorts in the Video block.
• Replaced PHP sessions with cookies on the front-end, restoring full-page caching compatibility and fixing the Site Health "active PHP session" warning and REST API loopback timeouts.
• Cookies are now only set when a campaign actually needs them (e.g. Pageviews condition).
• The front-end script now loads deferred for faster page rendering.
• Campaign and settings lookups are now cached on sites with a persistent object cache.

Fixed

• MailChimp integration removed a subscriber's existing tags and interest groups even when "Replace Tags?" was turned off.
• A campaign containing a Heading, Button, or Paragraph block set to a Google font could fail to render on the front-end in some saved or imported campaigns.
• Submitting a form with an optional Phone Number field, or editing a submission with malformed data, could trigger a PHP error.
• Exporting campaigns via a malformed request could trigger a PHP error before the security check.
• Corrected a build marker in the upgrade routine that could mis-package the Free, Basic, and Growth builds.
• The Phone Number field appeared unstyled in the block editor due to missing stylesheet.
• The Performance chart kept a Weekly or Monthly grouping selected after switching to a shorter timeframe that no longer supports it, now falls back to Daily automatically.
• YouTube videos in the Video block failed to load in the block editor preview with "Error 153".