11 versions
FireBox Pro history.
Every release of FireBox Pro is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
9 of 11 releases scanned clean
v3.1.13Latest
September 7, 20263.7 MBScanned
Improved
- security across the plugin, including how campaigns are searched, previewed and tracked, how form submissions and integrations are handled, and how visitor information is read.
- your captcha secret keys and MaxMind license key now stay on the server and are no longer shared with the campaign editor.
- the {user.*} Smart Tag now only returns profile details such as name and email.
- stored integration credentials (MailChimp, Brevo, Klaviyo and others) get an extra layer of protection. Existing connections keep working.
- visitor cookies now work correctly on sites served over plain HTTP.
- IP and Geolocation conditions now detect a reverse proxy on your own network automatically. If your site sits behind a CDN that does not pass the visitor's address through to WordPress, the new fpframework/trusted_proxies filter lets you tell FireBox about it.
- the Cloudflare Turnstile and hCaptcha setup notice in the campaign editor now also appears when only the secret key is missing.
Fixed
- the Brevo integration failed to load your contact lists.
August 25, 20263.7 MBScanned
Improved
- FireBox now automatically excludes its files from Delay JavaScript Execution, minification, and Remove Unused CSS, so campaigns keep working without adding manual exclusions in WP Rocket's settings.
- custom PHP in display conditions and PHP Scripts now runs only for campaigns whose author holds a dedicated "run PHP" permission. Administrators have it by default; other roles cannot run PHP unless you grant them the permission deliberately.
- custom JavaScript and custom CSS on a campaign now run only for campaigns whose author is allowed to add code. Administrators can by default; other roles cannot add custom code unless you grant them the permission deliberately. Custom CSS is also cleaned so it can't be used to inject anything other than styles.
- turning a campaign on or off from the campaigns list now checks that you have permission to edit that specific campaign, and only ever changes FireBox campaigns.
- values taken from the current page address and the referring page now have any code removed before they appear inside a campaign, so a crafted link can't inject content into your campaigns.
- duplicating a campaign now checks you have permission to edit it, and the copy belongs to whoever created it.
August 19, 20263.6 MBScanned
Other
- WordPress 7.1 compatibility.
Added
- a limit on how many times the same visitor can submit a form each minute, so a single visitor can't spam your submissions list.
Improved
- FireBox now sets itself up on every site of a network, including sites added later, so campaigns, analytics and permissions work without visiting each site first.
- campaigns on different sites of a network no longer share cookies, so closing a campaign on one site can't hide a campaign on another.
- removing FireBox from a network now clears each site's data according to that site's own "Keep data on uninstall" setting, and deleting a site removes its FireBox data with it.
- cookies now follow your site's WordPress cookie settings, so campaign frequency and analytics keep working on sites that share cookies between www and non-www addresses.
- how integration credentials (MailChimp, Brevo, Klaviyo, and others) are stored.
- the handling of imported campaigns so their content is cleaned up before it is saved.
- how Rating field values are shown in the Submissions list.
- campaigns now use their own set of permissions, so you can give someone access to campaigns without giving them access to all your posts.
- the accuracy of conversion and analytics tracking by ignoring invalid or duplicated data.
- connecting or disconnecting an integration now requires administrator access.
- how the submissions REST API key is sent and verified.
- it now confirms it is really talking to the FirePlugins license server before downloading anything.
- WordPress now offers the auto-update option for FireBox in the Plugins list, instead of saying auto-updates are not available.
- FireBox no longer tells WordPress.org about itself when WordPress checks for plugin updates.
- the handling of the {fbExpr} expression feature.
- the handling of redirects and messages shown after a form is submitted.
- the delete and duplicate actions in the campaigns list.
- page speed for campaigns with custom JavaScript no longer hold up the rest of the page while FireBox loads. Custom code now runs right after your campaigns are ready.
- page speed when serving multiple FireBox campaigns on same page.
- page speed by loading only the animations your campaign uses, instead of the whole animation library. This cuts about 69KB from every page a campaign appears on.
Fixed
- page slide campaigns could appear full-height and outside their slide area on some sites.
- an error that could occur while FireBox was updating itself.
v3.1.9Unavailable
July 17, 20263.6 MBScanned
Added
- a new campaigns list with ability to sort, filter, and manage your campaigns in bulk.
Improved
- security of visitor cookie handling on campaigns using a daily, weekly, or monthly display frequency.
- security of Phone Number values shown in the Submissions list and in admin notification emails.
- security of the {post.*} and {cookie.*} Smart Tags, which now strip HTML from their values, matching the {querystring.*} Smart Tag.
- Compatibility of YouTube shorts in the Video block.
- replaced PHP sessions with cookies on the front-end, restoring full-page caching compatibility and fixing the Site Health "active PHP session" warning and REST API loopback timeouts.
- cookies are now only set when a campaign actually needs them (e.g. Pageviews condition).
- the front-end script now loads deferred for faster page rendering.
- campaign and settings lookups are now cached on sites with a persistent object cache.
- WordPress 6.3 compatibility.
- campaign revenue now excludes refunded WooCommerce and Easy Digital Downloads orders, matching your shop's own analytics. Use the firebox/revenue_attribution/order_total filter to restore gross revenue.
- hardened display-condition, conversion-tracking, geolocation, upgrade, and license handling against unexpected or malformed data.
Fixed
- MailChimp integration removed a subscriber's existing tags and interest groups even when "Replace Tags?" was turned off.
- a campaign containing a Heading, Button, or Paragraph block set to a Google font could fail to render on the front-end in some saved or imported campaigns.
- submitting a form with an optional Phone Number field, or editing a submission with malformed data, could trigger a PHP error.
- exporting campaigns via a malformed request could trigger a PHP error before the security check.
- corrected a build marker in the upgrade routine that could mis-package the Free, Basic, and Growth builds.
- the Phone Number field appeared unstyled in the block editor due to missing stylesheet.
- the Performance chart kept a Weekly or Monthly grouping selected after switching to a shorter timeframe that no longer supports it, now falls back to Daily automatically.
- YouTube videos in the Video block failed to load in the block editor preview with "Error 153".
- a {cookie.*} Smart Tag referencing a cookie that was not set could blank out the campaign's content.
Removed
- the mini onboarding appearing after the first install.
v3.1.8Unavailable
June 16, 20263.5 MBScanned
Other
- Security: Fixed unauthenticated access to the form submissions CSV export endpoint.
Fixed
- Google Analytics tracking no longer triggers extra page views when tracking popup events.
- PHP deprecation notice for fputcsv() during form submissions CSV export on PHP 8.4+.
v3.1.7Unavailable
May 21, 20263.5 MBScanned
Improved
- WordPress 7.0 compatibility.
- styling in responsive controls.
Fixed
- an issue where changing block settings in the campaign editor could switch back to the FireBox panel.
v3.1.6Unavailable
April 23, 20263.5 MBScanned
Added
- ActiveCampaign integration.
- Klaviyo integration.
- Salesforce Web-to-Lead integration.
- GetResponse integration.
- Support for the native Desktop / Tablet / Mobile device preview switch in the campaign editor.
Fixed
- Deprecation notices in Gutenberg editor related to FireBox blocks.
- Revenue chart bars appeared with incorrect sizing across some date ranges.
- Revenue ROI values now display with consistent 2-decimal formatting for Plan Cost and ROI.
- FireBox logo in the Gutenberg editor header would not display correctly when Top toolbar was enabled.
- AcyMailing integration now displays the documentation help icon in FireBox Settings > Integrations.
Improved
- Design controls now follow your selected preview device, so Desktop, Tablet, and Mobile styles are easier to edit and preview accurately.
v3.1.5Unavailable
February 20, 20263.3 MBScanned
Added
- MailerLite integration.
- New Integrations settings tab to connect services once and reuse API keys across forms.
- Redirection to dashboard after activation and mini onboarding guide.
Improved
- Click tracking now correctly tracks clicks on linked images.
Fixed
- PHP error Uncaught Error: Call to undefined function in SubmissionMeta.php file.
- AcyMailing integration could show duplicate follow-up lists in the list selector.
v3.1.4Unavailable
January 1, 20263.4 MBUnknown
Improved
- WordPress listing.
- URLs pointing to WordPress.org.
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin FireBox Pro to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.