v1.8.1

Fixed

• Critical: captcha_settings.ts Timestamp Format: Salesforce expects a Unix timestamp in milliseconds (JSON.stringify(new Date().getTime())), not ISO 8601 (new Date().toISOString()). Incorrect format caused Salesforce to silently reject all W2L submissions with reCAPTCHA enabled.
• build_w2l_data() WP_Error Leak: When OID is not configured, build_w2l_data() returns WP_Error. Previously this was sent raw in the JSON response to the frontend. Now properly checked with is_wp_error() and logged via error_log().
• reCAPTCHA v2 Widget Initialization: Added grecaptcha.ready() wrapper around grecaptcha.render() call for proper compatibility when v3 script is loaded with ?render=SITE_KEY. Added max retry limit (20 attempts / 10 seconds) to prevent infinite retry loops if the script fails to load.
• Pre-Submit v2 Validation: Added validation check before form submission — if W2L reCAPTCHA is active but user hasn't clicked the "I'm not a robot" checkbox, form submission is blocked with an error message instead of silently skipping the Salesforce submission.

Full Changelog: v1.8.0...v1.8.1

v1.8.0

Changed

• Salesforce W2L reCAPTCHA — Confirmed Incompatibility: After extensive research against official Salesforce documentation and Google reCAPTCHA specs, confirmed that Salesforce Web-to-Lead reCAPTCHA is architecturally incompatible with server-side (wp_remote_post) form submissions. Salesforce W2L only supports reCAPTCHA v2 (browser checkbox), tokens must be submitted directly from the browser, and the W2L endpoint does not accept forwarded tokens from a proxy server.

Improved

• Admin Warning (Refined): Web-to-Lead settings now display a clear red warning box explaining why Salesforce reCAPTCHA must be disabled, with step-by-step instructions: Salesforce Setup → Web-to-Lead → uncheck "Require reCAPTCHA Verification"
• README — W2L reCAPTCHA Section: Replaced setup guide with a prominent incompatibility warning, updated W2L setup table (removed captcha_settings field), and revised troubleshooting entries
• Plugin Spam Protection Clarification: Documentation now clearly states that the plugin's own reCAPTCHA v3, rate limiting, and email validation provide sufficient spam protection without requiring Salesforce-side reCAPTCHA

Full Changelog: v1.7.0...v1.8.0

v1.7.0

Added

• W2L reCAPTCHA Support: Send reCAPTCHA tokens with Web-to-Lead submissions when Salesforce's W2L reCAPTCHA is enabled. Configure by pasting the captcha_settings JSON from Salesforce's generated HTML. Supports three scenarios: plugin-only reCAPTCHA, Salesforce-only reCAPTCHA, or both simultaneously with dual token generation.
• captcha_settings Admin UI: New captcha_settings JSON textarea in W2L settings with step-by-step setup instructions, JSON validation, and pretty-print display
• Dual reCAPTCHA Token Generation: Frontend generates two separate reCAPTCHA v3 tokens — one for plugin's own verification, one for Salesforce W2L verification — using Promise.all() for parallel execution
• captcha_settings Timestamp Injection: Automatically injects current UTC timestamp into captcha_settings.ts field before sending to Salesforce, as required by W2L reCAPTCHA verification

Fixed

• reCAPTCHA Script Loading: Google reCAPTCHA script now loads when either plugin reCAPTCHA or W2L captcha is needed (previously only loaded for plugin reCAPTCHA, causing W2L captcha to silently fail)
• Variable Declaration Order: Fixed $w2l_captcha_needed being referenced before definition in script enqueue — moved calculation before reCAPTCHA script loading
• Frontend Token Flow: Fixed scenario where sfW2lCaptcha=true but recaptchaEnabled=false would skip Salesforce token generation entirely. Restructured to three independent scenarios with Promise.all()

Improved

• W2L reCAPTCHA Admin UI: Step-by-step numbered requirements list, real-time red ❌ warning when reCAPTCHA Site Key is missing, clear dependency explanation
• Documentation: README updated with detailed W2L reCAPTCHA setup guide (6-step process), scenario comparison table, and troubleshooting entries

Full Changelog: v1.6.0...v1.7.0

v1.6.0

Added

• Salesforce Web-to-Lead Integration: New "Web-to-Lead" authentication flow — the easiest way to send leads to Salesforce. No Connected App, no OAuth, no API credentials required. Just enter your Organization ID (OID) and configure field mapping.
• W2L Configurable Field Mapping: JSON-based field mapping editor for Web-to-Lead, supporting all standard Salesforce W2L fields (first_name, last_name, email, company, city, country_code, state_code, description, etc.) and custom field IDs.
• Static Value Support: __static:VALUE syntax for sending fixed values in field mapping (e.g., "lead_source": "__static:Web")
• W2L Field Reference Boxes: Interactive reference showing all available Salesforce Web-to-Lead field names and form fields with click-to-copy functionality
• W2L Developer Hooks: ptf_salesforce_web_to_lead_data filter to modify W2L data before sending, ptf_salesforce_web_to_lead_sent action fired after successful submission
• Dynamic W2L Field Mapping: Web-to-Lead send method now reads field mapping from settings instead of using hardcoded fields, supporting target_scope_text, answers_json, and all dynamic question fields

Fixed

• Settings Preservation on Update: Fixed critical bug where plugin settings were lost when plugin was updated. sanitize_settings now starts from current saved values (wp_parse_args($current, defaults)) instead of an empty array
• Double-Sanitization Bug: Fixed WordPress Settings API double-sanitization issue where sanitize_callback was called twice on first save (once from options.php, again from add_option). This caused field mapping JSON, webhook configurations, and checkbox values to revert to defaults on first save after installation
• Checkbox Revert: Fixed all checkbox settings (send_auto_reply, save_to_database, send_email_notification, enable_webhooks, enable_salesforce) that could flip from disabled to enabled during re-sanitization
• Webhook Data Loss: Webhooks configuration no longer wiped when invalid JSON is submitted — existing config is preserved
• Auth Flow Validation: Added whitelist validation for salesforce_auth_flow setting to prevent invalid values

Improved

• Test Connection: Test Connection button is now disabled when Web-to-Lead is selected (W2L is fire-and-forget with no confirmation from Salesforce)
• Admin UI: Auth flow selection dynamically shows/hides relevant configuration sections (W2L fields, OAuth credentials, API settings)
• Country/State Fields: W2L field reference now distinguishes between text (country/state) and dropdown (country_code/state_code) variants matching actual Salesforce-generated HTML

Full Changelog: v1.5.9...v1.6.0

v1.5.9

Added

• Answer Field Mapping: New target_scope_text field for Salesforce mapping — sends all question-answers as readable plain text
• Answers JSON Field: New answers_json field for Salesforce mapping — sends all question-answers as structured JSON with category names, questions, and answer labels
• Field Mapping Scenarios: Documentation with 5 common mapping configurations and usage examples

Improved

• Available Form Fields: Reference box now includes target_scope_text and answers_json fields
• Documentation: README updated with detailed field mapping scenarios and example outputs

Full Changelog: v1.5.8...v1.5.9

Improve Salesforce mapping UX

Added

• Form Fields Reference Box: Interactive collapsible box showing all available form fields for Salesforce mapping
• Click-to-Copy: Click any field name to copy it to clipboard for easy mapping
• Sample JSON Preview: Shows what an actual form submission looks like with real field values
• Dynamic Question Fields: All custom question fields from categories are now listed automatically

Improved

• Salesforce Mapping UX: Much easier to see which form fields are available when configuring field mapping
• Field Descriptions: Hover over field names to see what they contain
• Optional reCAPTCHA: reCAPTCHA is now truly optional - form works without any reCAPTCHA configuration
• reCAPTCHA Check: Frontend now properly checks if reCAPTCHA is enabled AND configured before requiring it

Fixed

• Field Mapping Persistence: Salesforce field mapping JSON now properly persists after page reload
• JSON Parsing: Improved JSON parsing using wp_unslash() for better WordPress compatibility
• Settings Loading: Field mapping now reads directly from database to avoid wp_parse_args shallow merge issues

Full Changelog: v1.5.5...v1.5.8

Salesforce OAuth token requests and enhance My Domain URL support

Fixed

• OAuth Token Request: Added Content-Type: application/x-www-form-urlencoded header to Salesforce OAuth token requests (required for Client Credentials flow)
• Custom URL Saving: Custom My Domain URLs now properly saved and persist after page reload
• Client Credentials Flow: Now works correctly with My Domain URLs

Full Changelog: v1.5.2...v1.5.5

Improve error handling

Improved

• Error Messages: Better, more actionable error messages for Salesforce External Client App configuration issues
• Documentation: Updated all references to use "External Client App Manager" instead of "App Manager"
• Run As User Instructions: Clearer step-by-step instructions for setting up the Run As user
• Troubleshooting: Added "Where to Find Things" reference table in documentation

Fixed

• Error messages now correctly point to External Client App Manager location in Salesforce Setup

Salesforce connection testing and logging

Added

• Salesforce Test Connection: New "Test Connection" button to verify Salesforce integration before form submissions
• Activity Log: Real-time activity log showing last 20 Salesforce events (successes and failures)
• Error Visibility: Detailed error messages displayed in admin panel instead of just debug logs
• Clear Logs: Ability to clear Salesforce activity logs from admin panel

Improved

• Error Logging: All Salesforce errors now logged to database for admin visibility
• Success Tracking: Successful record creations are also logged with Salesforce record IDs
• Troubleshooting: Expandable data view for failed submissions to see what was sent

Salesforce External Client App support

Added

• Salesforce External Client App Support: Now supports the new Salesforce External Client App structure with Client Credentials OAuth flow (recommended)
• OAuth Flow Selection: Choose between Client Credentials (recommended) or Password Grant (legacy) authentication methods
• Backward Compatibility: Existing Password Grant setups continue to work without changes
• Migration Guide: Documentation for migrating from Password Grant to Client Credentials flow

Improved

• Admin UI: Reorganized Salesforce settings with clear authentication method selection
• Status Indicator: Dynamic status indicator that adapts to the selected authentication flow
• Error Messages: More specific error messages for each authentication method
• Documentation: Comprehensive guide for both External Client App and legacy Connected App setup

Changed

• Client Credentials flow is now the default and recommended authentication method
• Salesforce settings section now shows/hides fields based on selected OAuth flow