Changelog

Release notes for WCKD Forms and WCKD Forms Lite.

Version 1.0.4 (2026-06-01)

Spam protection is now enforced at submission time: the blocked IP addresses, blocked names, and submission rate limits you set under Operations are actively applied to incoming submissions (previously these were saved but not acted on).
Duplicate protection now extends to the server: even if a submission is retried or replayed (browser refresh, back button, or a flaky connection), it is recognized and will not create a second lead, notification email, or Stripe checkout session.
Payment reliability: a lead can no longer get stuck as "pending" after starting Stripe Checkout more than once, and repeated payment confirmations from Stripe are now handled safely.
Changing a dashboard user's password now signs out that user's other active sessions.
Payment return links are now restricted to your trusted site address, closing an open-redirect avenue after checkout.

Install to any directory — the dashboard no longer has to live in a folder named "wckd-forms". Pick your own path and the embed codes are generated to match automatically. A non-default path also keeps the admin off the predictable URL that automated bots probe first (defense in depth, not a replacement for login security).
Forms now guard against duplicate submissions: the submit button disables and shows a "Sending…" spinner on click, so an impatient double-click no longer files the same lead (or sends the same notification) multiple times.
Minor ux/ui improvements.

Minor ux/ui improvements.
Installer: optional licence key sends a best-effort install ping to the update server (does not block install on failure).
Shop admin licences list sorts by most recent client check-in when tracking columns are present.

Added Accept Payments for forms, with Stripe Checkout support. (Square and PayPal payment providers are planned for a future release.)
Added payment status tracking, invoice details, and a Payments dashboard view.

Forms now guard against duplicate submissions: the submit button disables and shows a "Sending…" spinner on click, so an impatient double-click no longer files the same lead (or sends the same notification) multiple times.
Cross-site (Lite) intake must now be explicitly enabled on the host WCKD Forms install before Lite forms can submit — it is disabled by default. Turn it on under Operations → Lite forms in the WCKD Forms Dashboard.