Changelog

Release notes for WCKD Forms and WCKD Forms Lite.

Version 1.0.6 (2026-09-15)

New Terms of service field: add a required consent checkbox to any form with your own terms shown inline, in a popup, or as a link to your terms page. Each lead records an auditable consent fingerprint proving which version of the terms was agreed to.
Email delivery is now visible per lead: submissions record whether the staff notification and auto-reply were sent, and leads whose email failed show a warning in the inbox with the reason.
Security and privacy hardening across the installer, form submission, and intake endpoints, with tighter control over how staff notifications are routed.
Re-running the installer now preserves your existing settings and saved credentials, and verifies your private configuration is correctly in place before completing. Multi-site installs keep their configuration fully isolated from one another.
Reliability improvements to form submission: clearer handling when the database is unavailable, time limits so a slow mail or webhook provider can't make a saved submission look failed, stronger duplicate-submission protection, and better logging of webhook deliveries.
The per-form "do not send visitor auto-reply" switch is now honored regardless of template settings, and confirmation-page routing follows the same rules as the dashboard (custom site-wide pages are no longer ignored for certain toggle combinations).
Performance: configuration files are read once per request, speeding up submissions and dashboard pages.

Fixed a bug that could cause a single form submission to be counted more than once against your submission limits.
Post-submission redirect URLs now support explicit file extensions, depending on how your host serves pages.
The installer now generates a unique private config filename per install so multiple installations sharing one private config directory on shared hosting each load their own database credentials. Existing installs continue to work without changes.

Spam protection is now enforced at submission time: the blocked IP addresses, blocked names, and submission rate limits you set under Operations are actively applied to incoming submissions (previously these were saved but not acted on).
Duplicate protection now extends to the server: even if a submission is retried or replayed (browser refresh, back button, or a flaky connection), it is recognized and will not create a second lead, notification email, or Stripe checkout session.
Payment reliability: a lead can no longer get stuck as "pending" after starting Stripe Checkout more than once, and repeated payment confirmations from Stripe are now handled safely.
Changing a dashboard user's password now signs out that user's other active sessions.
Payment return links are now restricted to your trusted site address, closing an open-redirect avenue after checkout.

Install to any directory — the dashboard no longer has to live in a folder named "wckd-forms". Pick your own path and the embed codes are generated to match automatically. A non-default path also keeps the admin off the predictable URL that automated bots probe first (defense in depth, not a replacement for login security).
Forms now guard against duplicate submissions: the submit button disables and shows a "Sending…" spinner on click, so an impatient double-click no longer files the same lead (or sends the same notification) multiple times.
Minor ux/ui improvements.

Minor ux/ui improvements.
Installer: an optional install check-in to the update server (best-effort; never blocks installation).
Shop admin licences list sorts by most recent client check-in when tracking columns are present.

Added Accept Payments for forms, with Stripe Checkout support. (Square and PayPal payment providers are planned for a future release.)
Added payment status tracking, invoice details, and a Payments dashboard view.

Forms now guard against duplicate submissions: the submit button disables and shows a "Sending…" spinner on click, so an impatient double-click no longer files the same lead (or sends the same notification) multiple times.
Cross-site (Lite) intake must now be explicitly enabled on the host WCKD Forms install before Lite forms can submit — it is disabled by default. Turn it on under Operations → Lite forms in the WCKD Forms Dashboard.