Changelog

Fixed: the Fluent Forms integration scored every submission twice. Fluent Forms fires both its modern validation filter and a legacy alias for the same submission, so each visitor counted double toward velocity limits, the activity log grew two rows per submission, and the second scoring run could cross a block threshold the first run did not. The integration now scores once per submission and replays that outcome on the duplicate call. Includes 1.10.1: Fluent Forms framework fields excluded from scoring (the random-hex form nonce tripped the gibberish heuristic on every submission), only a hard block rejects the form with the error on the first visible field, and weak signals alone never hard-block (a block requires at least one strong signal; anything weaker is held for review). Includes 1.10.0: AI agent checkout protection for sites running QWeb Agent Ready, plus a second scan of agent-created orders once they become real pending orders.

Requires WordPress 5.8+ · Tested to 7.1 · PHP 7.4+

• Fixed: the Fluent Forms integration could silently reject genuine submissions. The scoring pipeline was fed Fluent Forms' own framework fields, so the random-hex form nonce tripped the gibberish heuristic on every submission, and the resulting error was attached to that hidden field so the visitor saw no response at all. Framework fields are now excluded from scoring, only a hard block rejects the form (borderline submissions are held for review as designed), and a block error now shows on the first visible field.
• Changed: weak signals alone never hard-block. Soft heuristics (lone junk tokens, low-count velocity, a single link) could stack past the block threshold with no actual spam content. A hard block now requires at least one strong signal; anything weaker is held for review, so the message stays recoverable. Includes 1.10.0: AI agent checkout protection for sites running QWeb Agent Ready (agentic checkout sessions are gated before the order exists, crawler user agents are refused, network-reputation-only refusals become review flags), and a second scan of agent-created orders once they become real pending orders (flags for review, never rejects a live order).

Requires WordPress 5.8+ · Tested to 7.1 · PHP 7.4+

Fixes a fatal error introduced in 1.9.4. The daily statistics cron was scheduled using wp_rand(), which WordPress has not defined yet at the point the plugin loads, so any site that did not already have that cron scheduled failed on every request. Sites updating from 1.9.3 or earlier were affected; sites that had passed through 1.9.4 normally were not, which is why it was missed before release. Update immediately if you are on 1.9.5.

Requires WordPress 5.8+ · Tested to 7.0 · PHP 7.4+

Security hardening. Every PHP file now carries a direct-access guard. 95 files had none, so requesting one of them directly executed its top-level code instead of exiting immediately. No functional or detection changes.

Requires WordPress 5.8+ · Tested to 7.0 · PHP 7.4+

Security hardening. Every PHP file now carries a direct-access guard. 95 files had none, so requesting one of them directly executed its top-level code instead of exiting immediately. No functional or detection changes.

Requires WordPress 5.8+ · Tested to 7.0 · PHP 7.4+

Security hardening. Every PHP file now carries a direct-access guard. 95 files had none, so requesting one of them directly executed its top-level code instead of exiting immediately. No functional or detection changes.

Requires WordPress 5.8+ · Tested to 7.0 · PHP 7.4+

• New: site statistics in your QWeb account. The plugin now sends a small daily summary (how many submissions each form received, how many were blocked, held or released, the countries blocked traffic came from, and your review-queue depth) so the dashboard can show what the plugin is doing across all your sites in one place. Privacy: the summary carries counts only. Message contents, field values, email addresses and IP addresses never leave your site. Where an individual blocked submission is listed, the sender's email and IP are replaced with a one-way hash salted per site, so the same sender cannot be matched across different sites.
• New: support can view this site's own activity log from the licence server, over a request your site verifies with your private callback key. Nothing is copied or stored there; the log is read live from your database and it is read-only. Both are switchable: Settings, General, "Send usage statistics" and "Allow remote log read". Turn either off and the plugin stops immediately. The free WordPress.org edition contains neither feature and makes no outbound calls.

Requires WordPress 5.8+ · Tested to 7.0 · PHP 7.4+

Redesigned the weekly protection report email (branded logo header, Outlook/dark-mode-safe layout, live review-queue count, 30-day summary). Fixed false positives: the gibberish check no longer scans structured identity/address fields (billing city/name/company) or attribution questions (Where did you buy this product?) - real spam signals (message-body gibberish, keywords, URLs, checkout velocity) unchanged and verified on real data.

Requires WordPress 5.8+ · Tested to 7.0 · PHP 7.4+

• Security - federated regex patterns are length-capped and catastrophic-backtracking shapes are refused before evaluation (defense in depth on the federation feed).
• Fix - debug-log folder creation uses wp_mkdir_p; the autoloader gains a direct-access guard.

Requires WordPress 5.8+ · Tested to 7.0 · PHP 7.4+

• Security: stricter input sanitization across all form integrations and the Mail Guard admin (user agent headers, request parameters, and nonce values are sanitized at the point of reading).
• Security: the debug log moved into a protected plugin subfolder of the uploads directory, with directory listing and direct download blocked.
• Changed: Mail Guard admin styles and scripts are now enqueued through the WordPress asset pipeline instead of printed inline.
• Changed: admin screens no longer load a font from Google Fonts; the interface uses the system font stack, so admin pages make no external requests.
• Fixed: the plugin can be installed alongside the free QWeb Spam Shield edition without a fatal error. Whichever edition loads first runs; the other stays dormant and shows a notice.

Requires WordPress 5.8+ · Tested to 7.0 · PHP 7.4+

• New: protection for Elementor Pro Forms, Ninja Forms and Formidable Forms, with real validation-time blocking rather than only the wp_mail catch-all.
• New: optional Cloudflare Turnstile challenge. A visitor who passes the (mostly invisible) challenge is verified as human, so a borderline submission is let through instead of held. It never blocks; it only reduces false positives.
• New: weekly email report, a "we blocked N this week" summary, on by default and sent only when there was activity.
• New: setup wizard on first activation. Confirm your license, see which forms are protected, and choose your notification preferences.
• New: GDPR tools support. WordPress Tools, Export/Erase Personal Data now finds and can remove the submissions this plugin stored for a given email address.
• Security: plugin update packages are cryptographically signed. Your site verifies each update against a built-in key before installing it, so a tampered or unsigned package is refused. Internal: the two overlapping outbound-mail throttles were consolidated into one.

Requires WordPress 5.8+ · Tested to 7.0 · PHP 7.4+

• Fix: plugin updates run their upgrade routine again. An internal version constant had been left behind, so every database migration, cleanup and new scheduled task added since then never ran on sites that auto-updated.
• Fix: Contact Form 7 submissions were excluded from business-lead protection and from AI false-positive rescue, and recovered CF7 submissions went to the site admin instead of the form's real recipient. All three now work, and existing history is migrated.
• New: WooCommerce block checkout (the default since WooCommerce 8.3) is protected. Previously only the classic shortcode checkout was.
• New: orders held for review appear in the WooCommerce orders list with a Spam check column and a Flagged for review filter.
• New: WooCommerce High-Performance Order Storage (HPOS) compatibility is declared.
• Fix: card-testing detection by IP could never trigger on sites behind a CDN.
• Fix: banned keywords match whole words, so "size XXXL" no longer trips the keyword "xxx".
• Fix: a spam comment is filed in the spam folder and a borderline one goes to moderation, instead of both being destroyed with an error page.
• Fix: submission-speed detection now actually runs; a submission that is only "too fast" is held for review rather than blocked.
• Fix: deleting an entry from a settings list sticks, and saving settings no longer overwrites a saved AI API key with its masked placeholder.
• Security: API keys are no longer sent to the browser, the licensing server URL is validated, and a SQL injection reachable by an administrator through the queue REST endpoint was closed. Privacy: the Cloudflare-supplied client IP is anonymized under the same setting as the main IP address.

Requires WordPress 5.8+ · Tested to 7.0 · PHP 7.4+

WooCommerce checkout never hard-rejects a real customer over content or pattern signals: a spam verdict at checkout is downgraded to a review flag so the order completes and is flagged for you to review (card-testing bursts still hard-block; the payment gateway still stops stolen cards). Also restored the bundled CDN IP-ranges file that was missing from 1.8.5, so sites behind a CDN (CloudFront/Cloudflare) resolve the real visitor IP instead of the CDN edge IP - fixing false spam matches on shared CDN ranges for both checkout and forms.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

• Fix - a domain/brand name answered in a form field (e.g. 'BustBunny.com') is no longer mistaken for gibberish (removes a held false positive).
• Change - the hands-off AI rescue now also reviews soft single-token held items so a brand/short answer it confirms is a real customer is auto-released; strong gibberish still blocks rescue.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

• Fix - an email address written in a message is no longer mistaken for a link (removes a 'contains URL' false positive on genuine messages).
• New - hands-off AI rescue: a held contact-form message with a valid email and no hard spam signal is checked by AI using your business profile as context and auto-released + delivered if it is clearly a real customer, while unrelated spam/outreach stays held. Fails safe (held on any AI error). Toggle in AI settings.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Update-visibility fix. Clicking Check for updates now re-checks the license server immediately (a 12h cache previously hid freshly published releases from manual checks); background checks every 6h. Includes 1.8.0-1.8.2.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Display fix. The Activity log could briefly read empty on a site that updated from an older version before its one-time database migration finished; the screen now self-heals (adds the columns on load) and degrades gracefully so logs always show. No data was affected. Includes 1.8.0/1.8.1 features.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

The one-time AI site profile now also builds automatically on update (not only fresh activation), so existing sites gain per-business context with no manual step. It builds once and is skipped on routine updates (no rebuild unless intentionally refreshed). Includes all 1.8.0 detection improvements and the 1.7.0 false-positive Recovery.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

One-time AI site profiling (judges spam in your business context, e.g. crypto/wholesale), context-aware URL scoring (link risk by field + URL quality), smarter gibberish detection, lead-aware handling so real B2B enquiries are never hard-blocked, stronger cold-outreach/scam coverage, disposable-email blocking on by default, and the managed AI tiebreaker on by default (gray-area only, cached, per-plan capped). Includes the 1.7.0 false-positive Recovery.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

False-positive recovery. Allow on a blocked or held submission now re-delivers it (rebuilds the form notification from the saved fields and sends it to the form's real recipient, falling back to the site admin email) and trusts the sender; it no longer deletes the log row, so a wrongly-held message is kept and recoverable until normal log rotation. New Forward-only action delivers once without trusting. Detection rules unchanged from 1.6.8.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Federated threat-intel: confirmed-spammer source IP/CIDR ranges (Tor exits, datacenter VPS) now propagate across the fleet as a private DNSBL. Public, non-CDN ranges only; promoted solely on cross-site corroboration (never AI-verified, never PII). New sites inherit the fleet's known-bad ranges from day one. Includes the 1.6.7 checkout email-velocity log fix.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Checkout fix: a WooCommerce checkout whose ONLY signal is email-velocity (a returning/retrying customer) is now allowed cleanly and never leaves a phantom "held" row in the Activity log. Real carding signals (IP burst, failed-payment velocity, gateway) and all content/honeypot checks unchanged. Rolls up 1.6.3–1.6.6: outbound Mail Guard email_missing fix, dashboard Recent Activity actions + 7-day trend chart + top-reasons breakdown.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

promoted the current production build to the official update channel (parity with reference deployments qwebmaster.com / bustbunny.com). Local pattern mining, federated spam patterns, managed AI tiebreaker, WooCommerce checkout card-testing defenses, Mail Guard.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Implemented local pattern mining: the daily training cron now scans recent block/queue logs, identifies recurring fingerprints (email domains, user-agent hashes, content signatures), inserts them as local patterns, and contributes shareable kinds to the federation. Added Run training now button.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

New product logo across plugin admin header.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Customer-facing product renamed from 'QWeb SpamGuard AI' to 'QWeb Spam Shield AI'. New homepage at https://qwebspamshield.com and new support email support@qwebspamshield.com. Plugin folder, namespaces, constants, option keys, database tables, REST routes, and license slug all UNCHANGED — drop-in upgrade with zero migration.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

SECURITY: held-email body in admin Activity panel now renders inside a fully sandboxed iframe (no JS), preventing stored XSS via spammer-injected content in held notification emails. force_security=1 so even expired licenses can pull this update.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Auto-contribute confirmed spam patterns from Activity Logs with categories (pharma/casino/adult/payday/crypto/seo_spam/gibberish/phishing/comment_spam/impersonation). Settings -> Detection -> Disable categories opt-out panel. Pipeline ordering fix: federated Matcher runs after L3 / before AI as a scored penalty; high-confidence hits skip AI. Lowered local minimum_votes 3 -> 1.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Removed every AI configuration field from the customer Settings UI. AI is included with a valid license and rate-limited automatically to the plan; the admin tab now shows only the plan + usage card. BYOK code path remains in the engine for advanced users.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Federated Patterns: confirmed spam patterns now propagate across all licensed sites instantly. Brand-new installs catch the fleet's existing pattern knowledge from day one. Privacy boundary: only redacted pattern signatures travel — never raw submissions or PII. Auto-promotion via AI verification at 3+ corroborating sites; auto-retirement at high FP rates. Two opt-out toggles + a min-confidence threshold in Settings > Detection.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Managed AI — universal /v1/ai/call proxy on license.qwebmaster.com. Customers no longer need to bring their own Gemini key (BYOK still supported as a toggle). Per-plan call caps, cross-tenant prompt cache, snapshot meter in Settings.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Defensive guard on RegistrationProvider: never run on a request originating inside a WooCommerce checkout / wc-ajax / is_account_page() / carrying the WC checkout nonce. Protects against advanced-checkout plugins that route create-account through register_new_user(). Out-of-the-box WC already bypasses this filter (uses wp_insert_user); this is belt-and-braces.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Spam Queue Digest email is now opt-in (off by default). Fixed the plugin blocking its own digest when on — digest stamps an X-Qweb-Asai-Internal marker and Mail Guard short-circuits the pipeline for plugin-internal automated mail.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Reduced WP-Cron footprint. Mail Guard log prune merged into the existing daily log cleanup (one daily hook handles both tables). Pattern training reduced from hourly to daily. Sites upgrading from 1.3.2 are migrated automatically.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Mail Guard log now auto-prunes via a daily cron. Resolved entries (sent/blocked/deleted) use the same retention window as the inbound log (default 30 days). Held items kept for review with a 180-day safety cap. Row cap default 50,000 protects against runaway growth.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Activity detail panel now shows only the checks that actually flagged a submission, with friendly labels + hover-tooltips. Passes moved into a collapsible Other checks section. Duplicate field values in submitted content are deduped; field labels are human-readable.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Adds support for instant push-updates from the Qwebmaster license dashboard. Sites with valid licenses now register a secured callback URL during license validation; a single click in the license dashboard fans out an HMAC-signed ping that triggers the standard WordPress update flow on every licensed site at once. The native "Check for updates" / auto-update behavior is unchanged - push-updates are purely additive.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Fixed false-positive velocity_email_2 on first legitimate contact-form submission (inbound/outbound double-count idempotency).

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+

Initial release.

Requires WordPress 5.8+ · Tested to 6.8 · PHP 7.4+