S2Member Pro – A Powerful Membership Plugin For Wordpress history.

- (Pro) **Fix:** Improved Stripe 3D Secure recovery when browser and webhook processing overlap, or when the browser loses the final checkout response after successful authentication. s2Member now reconciles those recovery paths using the saved checkout state so successful signups can finish correctly without repeating fulfillment. Thanks to Felix for reporting it. See [thread #13627](https://f.wpsharks.com/t/13627). - (Framework) **Fix:** Improved Gateway Checkout state handling so concurrent recovery paths can safely patch independent checkout data and explicitly reload newly committed state without stale request-local cache values. - (Pro) **Fix:** Improved Stripe subscription recovery for new customers when payment authentication continues after the initial Pro-Form request. s2Member now keeps the pending WordPress account linked to the checkout, allowing browser or webhook recovery to complete the correct signup without losing its account association. - (Pro) **Fix:** In a rare Stripe pending-payment recovery case, membership processing could already be complete while the original checkout request still saw an older cached copy of the member's data and continued showing a processing state. s2Member now refreshes that data before deciding whether fulfillment has completed. - (Pro) **Fix:** Stripe one-time (Buy Now) Pro-Form purchases requiring 3D Secure could lose the password entered during the initial checkout when the form resumed after authentication. s2Member now keeps the same pending WordPress account through authentication and completes it with the password the customer originally chose. - (Pro) **Fix:** Closed a remaining failed-3D-Secure cleanup case where Stripe.js could return an authentication error without the PaymentIntent details used by s2Member's cleanup flow. s2Member now recovers the PaymentIntent ID from the existing Stripe client secret when needed so the incomplete subscription can still be cleaned up correctly. - (Pro) **Fix:** Failed card authentication during Stripe free-trial subscription checkout could leave the pending subscription active in a trialing state at Stripe. s2Member now cancels the incomplete subscription generation so unsuccessful authentication attempts do not leave orphaned trial subscriptions behind. - (Pro) **Fix:** Immediately retrying a Stripe free-trial subscription with another card after failed authentication could overlap with cleanup of the previous attempt or fail to continue correctly. s2Member now safely finishes that cleanup, confirms the retried authentication when needed, and starts a fresh subscription attempt without browser and webhook recovery interfering with each other. - (Pro) **Compatibility:** Improved Stripe SDK loading so s2Member does not accidentally trigger another plugin's dormant Stripe autoloader. This prevents an older Stripe library registered by another plugin from loading before s2Member Pro's bundled Stripe SDK. - (Pro) **Fix:** Prevented a PHP warning during Stripe Buy Now checkouts for existing members when determining whether a previous recurring subscription should be cancelled. - (Framework) **Compatibility:** Expanded no-cache support for caching solutions that use their own page-exclusion APIs or signals in addition to the commonly supported WordPress no-cache conventions. Added explicit compatibility for LiteSpeed Cache, FlyingPress, Super Page Cache for Cloudflare, WP Fastest Cache, and Cloudflare APO, helping prevent dynamic/private s2Member pages from being cached. - (Pro) **Fix:** When `[s2Member-List]` used `rlc_satisfy="ANY"` with multiple Levels, Roles, or Custom Capabilities, additional filtering on the member list could cause unrelated members to appear. Membership filters are now grouped correctly, so only members matching the requested criteria are returned. Thanks to Philip for reporting this. - (Framework) **Fix:** PayPal IPN domain checks could fail on some server setups when the incoming request did not provide a usable domain, for example with some reverse-proxy setups where something like Nginx, Cloudflare, a load balancer, etc. sits in front of WordPress and affects the request host. s2Member now falls back to the site's configured domain when needed. - (Framework) **Fix:** Some unexpected PayPal proxy values could cause notifications to fail and be ignored. These values are now normalized before the notification is processed. - (Framework) **Fix:** PayPal proxy notifications could fail on sites where their domain differs from the site's configured domain. s2Member now uses the appropriate site domain more consistently in these cases. - (Framework) **Fix:** Corrected the timeout value passed to the Mailchimp API client, preventing an invalid HTTP stream configuration that could interfere with list subscription requests. - (Framework) **Fix:** Avoided calling WordPress's deprecated `force_ssl_login()` helper on current WordPress versions when determining login and RPC URL schemes, preventing deprecation notices while preserving the same SSL behavior and compatibility with older WordPress versions. -

- (Framework) **Performance:** Further improved searching on the _WP Admin > Users_ screen, building on the performance improvements introduced in v260909. Searches across user profiles and s2Member membership data now require substantially less database work, with the biggest benefit on sites with large member databases. This can make member administration noticeably faster while preserving the same searchable fields, sorting, and pagination. - (Pro) **Performance:** Significantly improved `[s2Member-List]` and `[s2Member-List-Search]` performance for member directories and searches, especially on sites with larger user databases. Member searches now require substantially less database work, with much more efficient profile-field searching, filtering, sorting, and pagination. This can make large member directories noticeably faster and more responsive while preserving the shortcodes' existing Custom Field, wildcard, filtering, pagination, and sorting features. See: [s2Member-List Shortcode Documentation](https://s2member.com/kb-article/s2member-list-shortcode-documentation/). - (Framework) **Performance:** Improved Alternative View Protection performance on sites with larger amounts of protected content. Searches, archives, menus, widgets, and other areas where restricted content needs to be filtered now do less repeated work during each page request, helping busy pages load more efficiently while preserving the same access-control behavior. _WP Admin > s2Member > Alternative View Protection_ - (Pro) **Performance:** Reduced overhead when End-of-Term reminder emails are disabled. The heavier reminder processing, health, and email code is now loaded only when it is actually needed. - (Framework & Pro) **Security & UI:** Added a prominent admin warning for outdated s2Member Pro installations that predate the current Pro updater. The Framework now warns administrators when an old Pro version may be missing recent security fixes, shows how old the installed release is, and provides a prominent link to download the latest Pro version. The warning does not disable the installed Pro add-on or its features. - (Pro) **Security:** Enforced the _Shortcode User Fields Whitelist_ for `[s2Member-List]`'s `show_fields` attribute. Fields not on the whitelist are now omitted from Member Lists, with an administrator notice identifying blocked fields that may need to be allowed. _WP Admin > s2Member > General Options > Shortcode User Fields Whitelist_ - (Pro) **Security:** Enforced the _Pro Shortcode Templates Whitelist_. Custom templates specified with the `template` attribute are now blocked unless specifically allowed. The shortcode uses its standard template instead, and an administrator notice identifies blocked template files that may need to be allowed. _WP Admin > s2Member > General Options > Pro Shortcode Templates Whitelist_ - (Pro) **Improvement:** Hardened validation of PayPal Pro-Form `success` URLs used after subscription cancellation. Redirects are now limited to normal HTTP(S) destinations after replacement codes are processed, preventing executable or other non-web URL schemes from being used. Also hardened malformed programmatic `success` values to avoid PHP warnings. - (Framework) **Fix & UI:** Corrected Asset Health reporting when static CSS or JavaScript cannot be used because the site's current hooks or configuration require dynamic delivery. This intentional compatibility behavior is now treated as healthy instead of being reported as an unexpected fallback, and it no longer creates misleading "Latest Issues" entries. Asset Health now identifies why dynamic delivery is required, explains when the Full WordPress Dynamic Loader is necessary, and points to the "JavaScript Text Delivery" setting when it can help more pages continue using static JavaScript. - (Framework) **Improvement:** EOT demotion traditionally replaced all of a member's WordPress roles, but some sites need to preserve unrelated roles. The new _Demote From_ setting can now remove only the member's s2Member Level role instead. New installations use this level-only behavior by default; existing installations keep the legacy replace-all behavior unless changed. Thanks to Craig for suggesting this. See: [thread #13494](https://f.wpsharks.com/t/13494). - (Framework) **Improvement:** EOT demotion normally sends members to _Subscriber / s2Member Level 0_, and using another role previously required custom code. The new _Demote To Role_ setting lets site owners choose another s2Member Level or an available custom role directly from the EOT settings. Existing customizations using the `ws_plugin__s2member_force_demotion_role` filter continue to work. - (Pro) **Improvement:** PayPal Checkout cancellation buttons using `output="button"` can now also use a `success=""` attribute to redirect the member after a successful subscription cancellation. If no Success URL is provided, the existing cancellation confirmation remains unchanged. Thanks to Felix for suggesting this. See: [thread #13462](https://f.wpsharks.com/t/13462/7) - (Framework) **Improvement:** Ad

- (Framework) **Fix:** Made frontend CSS/JavaScript monitoring less impatient on sites where expected assets take a little longer to become active. Although the monitor already waited until the page had fully loaded before checking, some setups make their CSS/JavaScript become active a little later, which could cause a false alarm. This has now been fixed. Thanks to Gerard for reporting this. See: [thread #13609](https://f.wpsharks.com/t/13609) - (Framework) **Enhancement:** Expanded the frontend CSS/JavaScript monitoring introduced in the previous release into a new "CSS/JS Asset Health" system. The earlier monitoring layer is now smarter, more patient, more informative, more self-healing, quieter when the administrator does not need to intervene, and still designed to stay lightweight during normal frontend traffic. - **New overall health status:** "CSS/JS Asset Health" monitors frontend assets, including the Pro add-on's assets when installed, keeps track of recent delivery results, and summarizes the current situation as "Healthy", "Recent issue", "Working, review suggested", or "Needs attention" instead of reacting to every individual hiccup in isolation. - **More patient, configurable checks:** The original monitor checked whether expected assets had become active 1 second after the page finished loading. The default wait is now 3 seconds, and the new "Wait Before Checking Frontend Assets" setting lets site owners adjust that delay for setups where optimization, caching, networking, or other conditions make assets become active a little later. - **Smarter issue handling:** A single delayed or uncertain result no longer needs to become an immediate administrator problem. Asset Health considers both how recent and how persistent problems are, and can return to "Healthy" as normal loads continue. - **More resilient automatic recovery:** If an enabled static asset file unexpectedly disappears, s2Member will try to rebuild it automatically the moment the problem is encountered instead of waiting for the administrator to refresh it manually. Assets that need rebuilding can also be recovered during normal admin activity, avoiding an extra rebuild during a frontend page-load when possible, and relevant settings changes can trigger affected assets to be rebuilt immediately, too. - **Clearer diagnostics:** The new Asset Health panel shows each CSS/JavaScript asset and its current delivery state, including "Healthy", "Late", "Fallback", "Failed", "Not generated yet", and "Pending rebuild", with plain-language details when more information is useful. A persistent "Last issue" reminder and compact "Latest Issues" log preserve useful troubleshooting details, including affected frontend URLs, occurrence times, and repeated occurrences, with controls to clear them when they are no longer useful. - **Fallback visibility:** Asset Health understands s2Member's existing automatic fallback behavior, distinguishes successful delivery from successful fallback, and shows when the preferred delivery method could not be used but a compatible fallback kept the asset working. It can also show when the fallback itself is unavailable, even while the preferred delivery method is still working, so the administrator knows that the safety net needs attention before it's needed. - **More useful administrator notices:** Short-lived issues are given time to recover without unnecessary warnings. When a problem persists long enough to deserve attention, or is serious enough to require attention sooner, s2Member can show a compact administrator notice explaining the affected asset and link directly to the "CSS/JS Asset Health" section for review. - **Manual recovery and rechecking:** The "Refresh Static Assets" button rebuilds the enabled static files, while the "Recheck Asset Health" button performs a fresh check of the current delivery setup. Refreshing static assets also rechecks their health automatically afterward. - **Performance-conscious health tracking:** Frontend page-loads save small, independent Asset Health records without waiting for the shared health history to be updated. Those events are merged into the rolling history separately and in chronological order, preserving delayed reports and recent-issue details without making normal frontend page-loads wait on Asset Health bookkeeping. - (Framework) **UI:** Refined the CSS/JavaScript delivery controls and status presentation. Renamed the beta section to "CSS/JS Delivery & Optimization (Beta)", improved the shared health-status colors used across s2Member status sections, clarified help text and status explanations, and corrected the disabled "Refresh Static Assets" button so it remains visibly disabled when unavailable because static assets are not enabled or a configuration change needs to be saved first. - (Framework) **Fix:** Corrected a compatibility issue that could cause a PHP fatal error when another plugin printed WordPress scripts unusually early, before s2Member had finished initializing. s2Member now handles that early script output safely. Thanks to Sim Architect for rep

- (Framework) **Major Improvement:** Rebuilt the Automatic End-of-Term processing engine so membership expirations are handled more reliably and promptly when due, even on busy sites or after delays, while making the system safer to administer and easier to review and troubleshoot. - **Faster, adaptive processing:** Instead of stopping after 6 users, the new engine uses the safe processing time available in each run and adapts to current speed, allowing it to handle hundreds of users in one pass. - **Rapid queue catch-up:** s2Member processes each member as promptly as practical after their actual EOT time is reached. If work remains, it continues about a minute later instead of waiting for the next regular 10-minute check. In our stress testing, a 1,000-user queue was processed in under 2 minutes, while the old 6-user limit would take almost 28 hours. - **More resilient processing:** Overlapping runs are prevented, interrupted or stale runs recover cleanly, and unfinished work remains available for the next pass instead of being lost or unnecessarily delayed. - **Safer "Delete" behavior and review:** Automatic Delete now removes membership access and moves the user account to Pending Deletion instead of permanently deleting it, preserving useful payment/subscription details for review before single/bulk deletion. Irreversible automatic deletion can still be enabled with the `ws_plugin__s2member_allow_eot_user_deletion` filter. _WP Admin > Users > Pending Deletion_ - **New End-of-Term user lists:** Added separate Current and Previous lists with EOT Time, Last EOT, and EOT Demotion columns. Current shows users with an EOT, earliest first; Previous shows prior EOTs, most recent demotion first. Older demotion times are recovered from Administrative Notes where possible. _WP Admin > Users > End-of-Term Current / End-of-Term Previous_ - **Better demotion history:** EOT actions, including moves to Pending Deletion, now leave more useful Administrative Notes with the role change, removed Custom Capabilities, subscription details, and the EOT that triggered the action. For example: _2026-08-31 00:03 EDT s2Member: Demoted from Level 1 to Subscriber (removed ccaps: courses). PayPal I-ABC123. EOT 2026-08-31 00:01 EDT._ - **Visible health and automatic recovery:** A new Automatic Behavior Status shows pending and overdue EOTs, recent processing activity, the next scheduled run, and the current processing runtime, making delays and other problems visible instead of silent. s2Member repairs a missing WP-Cron schedule automatically when possible, and alerts administrators when a problem persists and needs attention. - (Pro) **Major Improvement:** Rebuilt the End-of-Term Reminder Email processing engine so renewal notices have a better chance of going out promptly on their intended day, even after WP-Cron delays or temporary email sending problems that could previously prevent them from being sent. - **Fast, adaptive processing:** The new engine replaces the old 6-member limit with safe runtime-based processing, prevents overlapping runs, recovers interrupted ones, and continues about a minute later when more work remains. On our test server, 1,000 reminders were handed off through WordPress's mail system in about 42 minutes, while the old engine would need almost 28 hours. - **Independent reminder engine:** Reminders based on stored End-of-Term dates now have their own schedule and processing engine, so they no longer depend on membership-expiration processing completing first and aren't held up by a large or stalled End-of-Term queue. - **Forgiving timing and smart retries:** Reminder eligibility now uses calendar days, giving s2Member opportunities throughout the intended send day plus an extra recovery day in case of delays. Failed sends are retried after about 10 minutes, 30 minutes, 1 hour, and then every 3 hours while still eligible, with each recipient tracked independently to avoid duplicate resends. - **Visible health and automatic recovery:** A new End-of-Term Reminder Status shows scheduling activity, recent successful delivery, and recipients currently being retried, with additional failure and recovery details when something goes wrong. s2Member repairs a missing reminder schedule when possible, retries failed recipients automatically, and alerts administrators when problems persist and need attention. - (Framework & Pro) **Fix:** Fixed the long-standing issue where the Automatic End-of-Term setting could appear blank when its WP-Cron event was missing. The saved setting now remains visible while s2Member reports and repairs the scheduling problem separately. - (Pro) **Fix:** End-of-Term renewal reminders are no longer sent when membership access ended because of a refund, payment reversal, or chargeback. These payment exceptions are now distinguished from normal membership expirations so they don't trigger inappropriate renewal notices. - (Pro) **Enhancement:** Modernized s2Member Pro-Forms with PayPal Checkout, using PayPal's current REST APIs and Smart Payment Buttons for off-site payments. When PayPal Checko

- (Framework) **Improvement:** Better s2Member Security Encryption Key handling and related guidance in the admin panel. - (Framework) **Improvement:** Hardened input validation and sanitization for the `s2Key`, `s2File`, `s2Stream`, and `s2Member-PayPal-Button` shortcodes. - (Framework & Pro) **Improvement:** Renamed and expanded the `s2Get` shortcode's user-field whitelist into the shared _Shortcode User Fields Whitelist_ setting, now used for `s2Get`'s `user_id` attribute and `s2Member-List`'s `show_fields` attribute. Administrators are warned when either shortcode attempts to display an un-whitelisted field's value that doesn't belong to the current user viewing the page. - (Framework & Pro) **Security:** Improved validation and hardened handling of serialized data throughout s2Member. - (Pro) **Improvement:** Hardened input validation and sanitization for the `s2Member-Login`, `s2Member-Summary`, `s2Member-Gift-Codes`, `s2Member-List`, `s2Member-List-Search-Box`, and `s2Member-Pro-ClickBank-Button` shortcodes, as well as the Pro Login Widget. - (Pro) **Security:** Added stricter handling for `s2Member-List`'s `show_fields` attribute. s2Member will warn administrators about detected fields that still need review. Fields not whitelisted will not be displayed. Sites using `show_fields` should review _General Options > Shortcode User Fields Whitelist_ and allow the fields their Member Lists are intended to display. - (Pro) **Security:** Added safer handling and a whitelist for the `template` shortcode attribute, used by the `s2Member-List`, `s2Member-List-Search-Box`, and Stripe, PayPal, and Authorize.Net Pro-Forms shortcodes. s2Member will warn administrators about detected templates that still need review. Templates not whitelisted will not be used, and the standard template will be used instead. Sites using custom templates should review _General Options > Pro Shortcode Templates Whitelist_ and allow their custom template files. - (Pro) **Fix:** Prevented the Pro updater from offering or installing a Pro release newer than the installed s2Member Framework, avoiding compatibility issues until the Framework is updated first. - (Pro) **Fix:** Prevented Stripe payment processing from continuing after Pro-Form validation rejects a submission, avoiding misleading Stripe card-field errors when other required form fields are missing. - (Pro) **Fix:** Updated Stripe Pro-Forms to use the shortcode's `validate_zipcode` attribute correctly, so it can override the default setting to collect and validate the card's postal code.

- (Framework) **Improvement:** Replaced TinyURL-based shortening for generated Registration Access and Specific Post/Page Access URLs with new built-in s2Member short links, stored temporarily with WordPress transients. Existing TinyURL settings now use the built-in shortener automatically, avoiding TinyURL’s deprecated no-key API endpoint and extra third-party pages shown before the destination. - (Framework) **Improvement:** Better PayPal Checkout cancellation button handling when stored IPN Signup Vars are missing. s2Member now checks PayPal subscription details via API before cancellation, uses PayPal's next billing time plus the configured EOT grace period for the EOT time, and falls back to PayPal's subscription management page when a safe local cancellation cannot be completed. See [[thread 13462](https://f.wpsharks.com/t/13462)](https://f.wpsharks.com/t/13462). - (Framework) **Security:** Hardened the `[s2Stream]` shortcode against executable JavaScript injection by users with post-editing privileges. Attributes used to configure JW Player are sanitized and validated more strictly, and custom `player_path` values must now be explicitly whitelisted using the `ws_plugin__s2member_sc_get_stream_player_paths` filter. - (Framework) **Security:** Improved sanitization of sensitive data in s2Member debug logs. - (Framework) **Fix:** Prevented a PHP 8+ fatal error during PayPal Standard PDT/IPN return handling when PayPal reports an invalid or unexpected charset. PayPal return data is now converted to UTF-8 defensively, with fallback handling when the reported charset is not accepted by `mb_convert_encoding()`. - (Pro) **Improvement:** Added safer handling for rare Stripe Pro-Form subscription checkouts where the first payment or setup confirmation remains pending. s2Member now delays paid-access changes until Stripe confirms the subscription is ready, helping avoid premature access while reducing the chance of confirmed Stripe subscriptions not matching s2Member access. - (Pro) **Fix:** Fixed validation of zero-like trial period values such as `tp="0.00"`, so they are treated the same as `tp="0"` instead of being rejected as an invalid trial period.

- (Framework) **Fix:** PayPal Checkout cancellation shortcodes now keep `output="anchor"` clickable for logged-out visitors. Only `output="button"` requires the member to be logged in. See [thread 13450](https://f.wpsharks.com/t/13450) - (Framework) **Fix:** PayPal Checkout no longer aborts if the customer's IP address changes during checkout. IP mismatches are logged, but valid checkouts continue processing. - (Framework) **Fix:** Prevent false Auto-EOT demotions when a stored Auto-EOT time is `0`, and improve logging for invalid Auto-EOT values. See [thread 13412](https://f.wpsharks.com/t/13412) - (Framework) **Fix:** Prevented a PHP 8.1+ deprecation notice while reading registration times when the stored value is missing or false. - (Framework) **Improvement:** Improved PayPal Checkout button loading with a client-side fallback when the PayPal SDK is missing from the final page output. - (Pro) **Fix:** Prevented deprecation notices on newer PHP versions, which could interfere with automatic login/redirects after Stripe checkout. - (Pro) **UI:** Improved cancellation pro-form submit button text. Cancellation forms now say “Cancel Subscription” instead of the generic “Submit Form”. See [thread 13438](https://f.wpsharks.com/t/13438)

- (Framework) **Fix:** Reduced the upfront requirements for processing PayPal Standard `subscr_cancel` IPNs so valid cancellations are not ignored when supporting values are missing, stale, or non-membership-specific. - (Framework) **Fix:** Prevent incorrect s2Member notifications in some PayPal Checkout cases where several webhooks are received about the same subscription. - (Framework) **Fix:** Prevent duplicate processing and notifications when PayPal sends both a webhook and an IPN for the same PayPal Checkout subscription payment. - (Framework) **Fix:** Added subscription modification cancellation support to the Framework, which was previously only available in the Pro addon. - (Pro) **Fix:** Made subscription modification cancellation gateway-aware, preventing orphaned active subscriptions when a member starts a replacement subscription through a different gateway. - (Pro) **Fix:** Prevented rare cases where subscription modification processing could cancel the newly created subscription by mistake. - (Pro) **Fix:** Improved Stripe customer lookup during checkout retries by falling back to email when the stored Stripe customer ID is missing, stale, or no longer retrievable.

- (Framework) **Fix:** Improved PayPal Checkout webhook idempotency to prevent duplicate processing during repeated/concurrent webhooks, while preserving normal behavior. - (Framework) **Fix:** Resolved a PayPal IPN issue where some `subscr_cancel` notifications were ignored because the cancellation handler failed before it had fully identified the recurring subscription. - (Framework) **Improvement:** Added IPN Signup Var lookups for missing PayPal cancellation IPN values like `period1`, `period3`, `item_number`, `item_name`, and `payer_email`, preventing valid `subscr_cancel` notifications from being ignored. - (Framework) **Improvement:** Moved s2Member's translation files to `/languages`, following the WordPress standard, and updated `.mo` loading to support that directory while continuing to support the standard and legacy WordPress locations. - (Framework) **Improvement:** Hardened PayPal Standard IPN endpoint response handling and added debug logging for hosts/security layers that incorrectly return HTTP 403 after successful processing. - (Framework) **Enhancement:** Added `ukpostcode` as an expected-value option for Custom Registration/Profile Fields, with matching server-side and client-side validation for UK postcode input. The validation is designed to be reasonably broad, including standard UK formats and related special cases. Thanks to Gerard Earley for contributing the patch. See [thread 12200](https://f.wpsharks.com/t/12200) - (Framework) **Enhancement:** Added a new __General Options > s2Get Shortcode__ setting to allow `user_id` for whitelisted user fields, defaulting to current-user. Also updated the s2Get KB article accordingly. - (Pro) **Fix:** Updated Stripe card charge and PaymentIntent requests to use `statement_descriptor_suffix` instead of `statement_descriptor`, fixing card-payment errors where Stripe no longer accepts `statement_descriptor` for card payments. - (Pro) **Fix:** Corrected Stripe subscription checkout so resumed PaymentIntent flows no longer go through the wrong intent-status handler. - (Pro) **Fix:** Stripe now stops cleanly after card declines, instead of continuing into secondary intent/payment-method errors. - (Pro) **Fix:** Improved Stripe recurring-payment setup to better support future-charge authorization requirements, fixing failures in countries with stricter payment rules, including India. - (Pro) **Fix:** Stripe now updates recurring default payment methods only after a successful intent result, instead of earlier in checkout. - (Pro) **Fix:** Billing-update SetupIntent creation failures in Stripe now return the proper error response. - (Pro) **Fix:** Prevent duplicate/retried Stripe webhook events from being processed more than once, including near-simultaneous retries of the same Stripe event ID - (Pro) **Fix:** prevent Stripe billing modification/replacement from triggering EOT behavior for the cancelled old subscription while s2Member is still updating the member account with the new subscription. - (Pro) **Fix:** Removed a trailing-comma syntax issue in Stripe subscription update code that could cause PHP compatibility errors on older supported PHP versions. - (Pro) **Fix:** s2Member now cleans up incomplete subscriptions left behind by failed 3D Secure authentication attempts during Stripe checkout, and gives the customer a more clear payment failure message. - (Pro) **Improvement:** Added dedicated s2 Stripe log entries for non-fatal failures while updating the default payment method after successful intent completion.

- (Framework) **Fix:** Prevent a PHP 8.1+ deprecation notice from appearing above the admin Users table in some cases. - (Framework) **Security:** Improved debug log sanitization. - (Framework) **Improvement:** PayPal Checkout credential test and OAuth failure log entries now include client_len_hash / secret_len_hash values (length_hash, e.g. 80_4d9a7c1b2e8f4a21) to help compare attempted credentials during troubleshooting without exposing raw values. - (Framework) **Enhancement:** Added a new _No-Cache Headers Behavior_ option under _General Options > Performance & Caching_, making no-cache behavior configurable from the admin UI. It includes: - `Always` mode, the legacy safe default that prevents caching site-wide in case user-conditional output appears. - `Selective` mode, which was previously available only through a filter and may improve caching for guests, but can miss some runtime no-cache triggers. - The new `Evaluative` beta mode, which evaluates the page with more runtime information and may allow more pages to be cached safely for guests. - An optional debug header to help troubleshoot no-cache behavior. - (Framework) **UI:** Clarified the Download Options text to explain that unique download limits are counted in the last X days (rolling window), reducing confusion about whether the limit resets on fixed calendar dates. - (Framework) **UI**: Improved the PayPal Checkout credentials test failure message. - (Framework) **UI:** Fixed the PayPal button encryption admin notice so that it shows only to administrators in the WP Admin area, not non-admin users.