13 versions
FireBox Pro history.
Every release of FireBox Pro is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
11 of 13 releases scanned clean
v3.1.15Latest
October 23, 20263.7 MBScanned
Improved
- FireBox campaign editor now always open in the block editor, even on sites that use the Classic Editor plugin or are forced by a theme that turns the block editor off. Posts and pages keep using the editor you chose.
- usage tracking for opted-in users.
- translations. The campaign editor's settings, block controls and display conditions can now be translated, along with form and template library messages that previously always showed in English.
- an empty Campaigns list on WordPress 6.x now links to creating your first campaign.
Fixed
- Revenue ROI and Lifetime Revenue amounts on stores running Easy Digital Downloads.
- the FireBox Overview page could appear blank when the templates server couldn't be reached.
- the Templates Library kept retrying when templates couldn't load. It now uses your last saved templates instead.
- FireBox sometimes didn't open its Overview page right after activation.
September 7, 20263.7 MBScanned
Improved
- security across the plugin, including how campaigns are searched, previewed and tracked, how form submissions and integrations are handled, and how visitor information is read.
- your captcha secret keys and MaxMind license key now stay on the server and are no longer shared with the campaign editor.
- the {user.*} Smart Tag now only returns profile details such as name and email.
- stored integration credentials (MailChimp, Brevo, Klaviyo and others) get an extra layer of protection. Existing connections keep working.
- visitor cookies now work correctly on sites served over plain HTTP.
- IP and Geolocation conditions now detect a reverse proxy on your own network automatically. If your site sits behind a CDN that does not pass the visitor's address through to WordPress, the new fpframework/trusted_proxies filter lets you tell FireBox about it.
- the Cloudflare Turnstile and hCaptcha setup notice in the campaign editor now also appears when only the secret key is missing.
Fixed
- the Brevo integration failed to load your contact lists.
v3.1.11Unavailable
August 25, 20263.7 MBScanned
Improved
- FireBox now automatically excludes its files from Delay JavaScript Execution, minification, and Remove Unused CSS, so campaigns keep working without adding manual exclusions in WP Rocket's settings.
- custom PHP in display conditions and PHP Scripts now runs only for campaigns whose author holds a dedicated "run PHP" permission. Administrators have it by default; other roles cannot run PHP unless you grant them the permission deliberately.
- custom JavaScript and custom CSS on a campaign now run only for campaigns whose author is allowed to add code. Administrators can by default; other roles cannot add custom code unless you grant them the permission deliberately. Custom CSS is also cleaned so it can't be used to inject anything other than styles.
- turning a campaign on or off from the campaigns list now checks that you have permission to edit that specific campaign, and only ever changes FireBox campaigns.
- values taken from the current page address and the referring page now have any code removed before they appear inside a campaign, so a crafted link can't inject content into your campaigns.
- duplicating a campaign now checks you have permission to edit it, and the copy belongs to whoever created it.
v3.1.10Unavailable
August 19, 20263.6 MBScanned
Other
- WordPress 7.1 compatibility.
Added
- a limit on how many times the same visitor can submit a form each minute, so a single visitor can't spam your submissions list.
Improved
- FireBox now sets itself up on every site of a network, including sites added later, so campaigns, analytics and permissions work without visiting each site first.
- campaigns on different sites of a network no longer share cookies, so closing a campaign on one site can't hide a campaign on another.
- removing FireBox from a network now clears each site's data according to that site's own "Keep data on uninstall" setting, and deleting a site removes its FireBox data with it.
- cookies now follow your site's WordPress cookie settings, so campaign frequency and analytics keep working on sites that share cookies between www and non-www addresses.
- how integration credentials (MailChimp, Brevo, Klaviyo, and others) are stored.
- the handling of imported campaigns so their content is cleaned up before it is saved.
- how Rating field values are shown in the Submissions list.
- campaigns now use their own set of permissions, so you can give someone access to campaigns without giving them access to all your posts.
- the accuracy of conversion and analytics tracking by ignoring invalid or duplicated data.
- connecting or disconnecting an integration now requires administrator access.
- how the submissions REST API key is sent and verified.
- it now confirms it is really talking to the FirePlugins license server before downloading anything.
- WordPress now offers the auto-update option for FireBox in the Plugins list, instead of saying auto-updates are not available.
- FireBox no longer tells WordPress.org about itself when WordPress checks for plugin updates.
- the handling of the {fbExpr} expression feature.
- the handling of redirects and messages shown after a form is submitted.
- the delete and duplicate actions in the campaigns list.
- page speed for campaigns with custom JavaScript no longer hold up the rest of the page while FireBox loads. Custom code now runs right after your campaigns are ready.
- page speed when serving multiple FireBox campaigns on same page.
- page speed by loading only the animations your campaign uses, instead of the whole animation library. This cuts about 69KB from every page a campaign appears on.
Fixed
- page slide campaigns could appear full-height and outside their slide area on some sites.
- an error that could occur while FireBox was updating itself.
v3.1.9Unavailable
July 17, 20263.6 MBScanned
Added
- a new campaigns list with ability to sort, filter, and manage your campaigns in bulk.
Improved
- security of visitor cookie handling on campaigns using a daily, weekly, or monthly display frequency.
- security of Phone Number values shown in the Submissions list and in admin notification emails.
- security of the {post.*} and {cookie.*} Smart Tags, which now strip HTML from their values, matching the {querystring.*} Smart Tag.
- Compatibility of YouTube shorts in the Video block.
- replaced PHP sessions with cookies on the front-end, restoring full-page caching compatibility and fixing the Site Health "active PHP session" warning and REST API loopback timeouts.
- cookies are now only set when a campaign actually needs them (e.g. Pageviews condition).
- the front-end script now loads deferred for faster page rendering.
- campaign and settings lookups are now cached on sites with a persistent object cache.
- WordPress 6.3 compatibility.
- campaign revenue now excludes refunded WooCommerce and Easy Digital Downloads orders, matching your shop's own analytics. Use the firebox/revenue_attribution/order_total filter to restore gross revenue.
- hardened display-condition, conversion-tracking, geolocation, upgrade, and license handling against unexpected or malformed data.
Fixed
- MailChimp integration removed a subscriber's existing tags and interest groups even when "Replace Tags?" was turned off.
- a campaign containing a Heading, Button, or Paragraph block set to a Google font could fail to render on the front-end in some saved or imported campaigns.
- submitting a form with an optional Phone Number field, or editing a submission with malformed data, could trigger a PHP error.
- exporting campaigns via a malformed request could trigger a PHP error before the security check.
- corrected a build marker in the upgrade routine that could mis-package the Free, Basic, and Growth builds.
- the Phone Number field appeared unstyled in the block editor due to missing stylesheet.
- the Performance chart kept a Weekly or Monthly grouping selected after switching to a shorter timeframe that no longer supports it, now falls back to Daily automatically.
- YouTube videos in the Video block failed to load in the block editor preview with "Error 153".
- a {cookie.*} Smart Tag referencing a cookie that was not set could blank out the campaign's content.
Removed
- the mini onboarding appearing after the first install.
v3.1.8Unavailable
June 16, 20263.5 MBScanned
Other
- Security: Fixed unauthenticated access to the form submissions CSV export endpoint.
Fixed
- Google Analytics tracking no longer triggers extra page views when tracking popup events.
- PHP deprecation notice for fputcsv() during form submissions CSV export on PHP 8.4+.
v3.1.7Unavailable
May 21, 20263.5 MBScanned
Improved
- WordPress 7.0 compatibility.
- styling in responsive controls.
Fixed
- an issue where changing block settings in the campaign editor could switch back to the FireBox panel.
v3.1.6Unavailable
April 23, 20263.5 MBScanned
Added
- ActiveCampaign integration.
- Klaviyo integration.
- Salesforce Web-to-Lead integration.
- GetResponse integration.
- Support for the native Desktop / Tablet / Mobile device preview switch in the campaign editor.
Fixed
- Deprecation notices in Gutenberg editor related to FireBox blocks.
- Revenue chart bars appeared with incorrect sizing across some date ranges.
- Revenue ROI values now display with consistent 2-decimal formatting for Plan Cost and ROI.
- FireBox logo in the Gutenberg editor header would not display correctly when Top toolbar was enabled.
- AcyMailing integration now displays the documentation help icon in FireBox Settings > Integrations.
Improved
- Design controls now follow your selected preview device, so Desktop, Tablet, and Mobile styles are easier to edit and preview accurately.
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin FireBox Pro to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.