Changelog

Release notes for WCKD Forms and WCKD Forms Lite.

Version 1.0.11 (2026-10-14)

Security hardening following a review of the dashboard, submission and update paths.
Every lead has a reference number, shown on its card and searchable, and added to the subject of the new-lead email and the auto-reply, for example [#482].
Each new-lead email has its own subject, so mail apps no longer thread every lead together. The subject line can use {name}, {email}, {id}, {form} and {page}.
Tidier lead cards: the message, the page and any payment stay in view, the rest sits behind More details.

Webhooks: "Send only for these forms" now works with any placement label.
Webhooks: new trigger for when a payment succeeds.
Webhooks: a saved secret can now be removed.
Per-form CC, BCC and SMTP settings now take effect.
New Reply-To setting for the visitor auto-reply, site-wide and per form.
Simpler setup: no changes to your site's .htaccess are needed, and the default thank-you and not-sent pages work on any site.
Re-running the installer keeps your Operations settings and your Primary Owner account.
Block an IP address straight from a lead.
Clearer sign-in messages when an account is paused or locked.
Clearer messages on the not-sent page.
Check for updates now links to what changed.
Minor fixes and wording improvements.

Rebuilt Form Submissions Report with charts, period comparisons, top forms, keywords, pages and busiest times.
Hover any headline number, or any point on the leads chart, to see the detail behind it.
Top forms, pages and the Entry log now page through all results, with search and sorting on the Entry log.
New scheduled email reports: send a performance summary to any inbox weekly, monthly or quarterly.
New Leads by recipient breakdown for directories and multi-department forms.
Inbox: one-click reply and call buttons, with the lead's message quoted in your reply.
Inbox: contact card on each lead, and tidier lead details.
Auto-reply emails now show the page the form was sent from, with a new {page} placeholder.
Clearer wording in Settings, including "Send notifications to" for where leads are emailed.
Faster on large sites: forms no longer check the database on every page view.
New Repair lead text tool under Settings → Admin, for older leads showing garbled characters.
More reliable submissions on cached pages.
Security hardening and a lighter, faster dashboard.

Payment forms now send one confirmation email, with the receipt, once payment succeeds.
Redesigned, itemized payment receipt.
Clearer payment field setup in the form builder.
New Test connection button for your email server settings.
Terms of service field polish and a popup display fix.
Security hardening.

Blocked IPs, blocked names and rate limits are now enforced on incoming submissions.
Stronger duplicate protection for retried or refreshed submissions.
More reliable Stripe payments.
Changing a user's password now signs out their other sessions.
Security hardening for payment return links.

Your own forms are kept when you upgrade Lite. Copy a form's file into the schemas folder and it is available.
Wording updated to match the main dashboard.

Submit button now disables while sending, preventing double submissions.
Lite intake must now be turned on in your main install under Operations (off by default).