Unified Changelog for s2Member & s2Member Pro v260312

• (Framework) Fix: Prevent a PHP 8.1+ deprecation notice from appearing above the admin Users table in some cases.

• (Framework) Security: Improved debug log sanitization.

• (Framework) Improvement: PayPal Checkout credential test and OAuth failure log entries now include client_len_hash / secret_len_hash values (length_hash, e.g. 80_4d9a7c1b2e8f4a21) to help compare attempted credentials during troubleshooting without exposing raw values.

• (Framework) Enhancement: Added a new No-Cache Headers Behavior option under General Options > Performance & Caching, making no-cache behavior configurable from the admin UI. It includes:

  • Always mode, the legacy safe default that prevents caching site-wide in case user-conditional output appears.
  • Selective mode, which was previously available only through a filter and may improve caching for guests, but can miss some runtime no-cache triggers.
  • The new Evaluative beta mode, which evaluates the page with more runtime information and may allow more pages to be cached safely for guests.
  • An optional debug header to help troubleshoot no-cache behavior.

• (Framework) UI: Clarified the Download Options text to explain that unique download limits are counted in the last X days (rolling window), reducing confusion about whether the limit resets on fixed calendar dates.

• (Framework) UI: Improved the PayPal Checkout credentials test failure message.

• (Framework) UI: Fixed the PayPal button encryption admin notice so that it shows only to administrators in the WP Admin area, not non-admin users.

Upgrading to the Latest Version

You should get a notification about the update in your admin area. WP Admin > Plugins

You can also download the zip file from your Account page, and upload it. WP Admin > Plugins > Add New > Upload

Unified Changelog for s2Member & s2Member Pro v260301

• (Framework) Bug Fix: Fixed mismatched <label for=""> and <input id=""> attributes for checkbox/radio options in Custom Registration/Profile Fields; this also restores proper client-side validation for required checkbox/radio groups.

• (Framework) Fix: Hardened the Edit User Profile screen on PHP 8+ to avoid errors if a user’s Auto-EOT time is stored as a date string (e.g. YYYY-MM-DD) rather than a Unix timestamp (as can happen after imports/migrations).

• (Framework) Fix: Fixed PHP 8+ "Undefined array key" warnings related to membership level label constants (including guest/non-logged-in access label handling).

• (Framework) Fix: Resolved an issue that prevented PayPal Buttons "Generate Button Code" from working in some installations.

• (Framework) Fix: Some PayPal Checkout log entries were missing the environment (sandbox/live), and now include it to help with troubleshooting.

• (Framework) Fix: PayPal Checkout webhooks can continue processing existing subscriptions even if new sales are switched back to PayPal Standard.

• (Framework) Fix: PayPal Checkout webhooks now also handle refunds, reversals, and additional subscription lifecycle events, improving user EOT/access updates and subscription state handling.

  If you already had a PayPal Checkout webhook configured before this update, use the “Create/Update Webhook Automatically” button once after upgrading (Live and/or Sandbox as needed). Existing webhook events will continue working, but PayPal will not send the newly added event types until the webhook subscription is updated.

• (Framework) Fix: Improved PayPal Checkout amount decimal normalization to prevent one-time payment validation mismatches.

• (Framework) Fix: Updated PayPal Checkout webhook handling to prevent one-time payment captures from being processed as recurring payments.

• (Framework & Pro) Fix: Prevent PHP 8.1+ deprecation warnings in gateway Pro-Forms and related checkout processing (Stripe, PayPal Pro, Authorize.Net), and in custom registration fields, by ensuring optional form/template values are cast to strings before escaping/processing.

• (Framework) Security: Improved debug log sanitization (passwords, API secrets, auth credentials) and reduced post-registration plaintext password exposure.

• (Framework) Improvement: PayPal Standard and PayPal Checkout cancellation buttons now use PayPal’s subscription management page when needed.

• (Framework) Improvement: Better HTTPS detection in s2Member’s PayPal Checkout setup for sites using Cloudflare (or other reverse proxies), reducing false setup failures when enabling or configuring PayPal Checkout.

• (Pro) Improvement: Hardened the Advanced Importer to normalize Auto-EOT values given as date strings (e.g. YYYY-MM-DD) into Unix timestamps when a date is used instead of the expected timestamp format.

• (Pro) Improvement: PayPal Checkout buttons now support accept="card" in Pro button attributes, enabling card funding/guest checkout where PayPal makes it available.

Upgrading to the Latest Version

You should get a notification about the update in your admin area. WP Admin > Plugins

You can also download the zip file from your Account page, and upload it. WP Admin > Plugins > Add New > Upload

Unified Changelog for s2Member & s2Member Pro v260215

(Framework) Bug Fix: Prevent PHP fatal error when multiple PayPal Checkout buttons appear on the same page (PHP 8+).

(Framework) Bug Fix: PayPal Checkout admin actions (Test Credentials / Webhook / Clear Cache) now submit via POST instead of redirecting (avoids “headers already sent” warnings).

(Framework) Bug Fix: PayPal cancellation notifications now backfill missing membership mapping fields (item_number, item_name, period1, period3) from stored IPN Signup Vars using the subscription ID ( recurring_payment_id / subscr_id ), so Auto-EOT is set correctly on cancel.

(Framework) Bug Fix: Auto-EOT PayPal status checks now query PayPal Checkout subscriptions via PayPal’s REST Subscriptions API (instead of PayPal's legacy “Recurring Payments” API), preventing “11592” errors and allowing Auto-EOT to detect inactive PayPal Checkout subscriptions.

(Framework) Security: PayPal Checkout webhook environment inference now validates the paypal-cert-url host before using it (hardens environment inference used during verification).

(Framework) Security: PayPal Checkout cancel redirect now validates the destination URL and safely falls back to the site home URL.

(Framework) Security: PayPal Checkout tokens now use s2Member’s hardened unserialize routine.

(Framework) Security: Harden unserialization of stored custom capabilities metadata when loading user access rules.

(Framework) Security: Harden the registration password handler.

(Framework) Improvement: Harden PayPal Checkout endpoint behavior on problematic hosts; return consistent JSON errors (HTTP 500) on notify-proxy failures.

(Framework) Improvement: Harden PayPal Checkout REST API/webhook handling for network failures and unexpected/non-JSON responses (avoids PHP 8+ warnings).

(Framework) Improvement: PayPal Checkout webhook setup now treats "no change" updates and existing webhook URLs as success (adopts the existing webhook ID automatically).

(Framework) Improvement: PayPal Checkout webhook signature verification now auto-detects Sandbox vs Live from inbound headers (so webhooks validate correctly even if the site’s current environment setting differs).

(Framework) Improvement: PayPal Checkout logging now includes env_setting (site setting) and env_webhook (inferred from inbound webhook headers) for clearer Sandbox/Live environment troubleshooting.

(Framework) Improvement: PayPal Checkout webhook idempotency cache (event/txn transients) now retains entries for 1 year (reduces long-term option bloat while preserving replay protection).

(Framework) Improvement: s2Member’s PayPal “Unsubscribe” button links to PayPal’s subscription management page, and with the new PayPal Checkout integration, when output="button" and a PayPal subscription ID is present, s2Member will attempt to cancel the subscription directly.

(Framework) UI: Add a description for paypal-checkout.log in the Log Viewer dropdown (so it’s not “No description available”).

(Pro) Improvement: PayPal Checkout buttons now support accept="card" to enable guest debit/credit card payment in the PayPal-hosted checkout experience when available (availability depends on PayPal settings/eligibility and browser privacy protections).

Upgrading to the Latest Version

You should get a notification about the update in your admin area. WP Admin > Plugins

You can also download the zip file from your Account page, and upload it. WP Admin > Plugins > Add New > Upload

Unified Changelog for s2Member & s2Member Pro v260127

• (Framework) PayPal Enhancement: Modernized s2Member’s PayPal integration by adding support for PayPal Checkout with their latest REST APIs, Smart Buttons, and webhook event handling. This introduces PayPal’s current Checkout platform as an optional, reliable alternative to legacy PayPal Standard buttons. Existing s2Member PayPal button shortcodes continue to work as-is (no edits required). See: WP Admin > s2Member > PayPal Options > PayPal Checkout (Beta). Thanks to the beta testers, especially Sim Architect.

Upgrading to the Latest Version

You should get a notification about the update in your admin area. WP Admin > Plugins

You can also download the zip file from your Account page, and upload it. WP Admin > Plugins > Add New > Upload

Unified Changelog for s2Member & s2Member Pro v260101

• (Framework) Security: Improved sanitization and normalization of attribute values for the s2Eot, s2Strem and s2Member-Security-Badge shortcodes.

• (Framework) Security: Improved sanitization of replacement values for confirmation and notification emails.

Upgrading to the Latest Version

You should get a notification about the update in your admin. WP Admin > Plugins

You can also download the zip file from your Account page, and upload it. WP Admin > Plugins > Add New > Upload

Unified Changelog for s2Member & s2Member Pro v251005

• (Framework) Security: Improved sanitization for Tracking API replacement values.

• (Framework) Fix: Use the site URL host instead of HTTP_HOST for proxy key when Skip Domain Check is enabled.

• (Framework) Fix: Ensure the Fallback IPN Signup Vars provide a valid item_number for cancellation handling.

Upgrading to the Latest Version

You should get a notification about the update in your admin. WP Admin > Plugins

You can also download the zip file from your Account page, and upload it. WP Admin > Plugins > Add New > Upload

Unified Changelog for s2Member & s2Member Pro v250905

• (Framework) Security: Improve handling of registration fields in multisite.

• (Framework & Pro) UI: Add a Help panel with contact form to all admin pages.

Upgrading to the Latest Version

You should get a notification about the update in your admin. WP Admin > Plugins

You can also download the zip file from your Account page, and upload it. WP Admin > Plugins > Add New > Upload

Unified Changelog for s2Member & s2Member Pro v250701

• (Framework & Pro) Enhancement: s2Member now supports sending emails in HTML format, allowing for richer, styled messages with formatting, links, and branding. You can enable this feature under General Options > Email Configuration > Enable HTML Emails. When disabled, emails continue to use plain text as before. This feature is currently in beta, so feedback is welcome!

Upgrading to the Latest Version

You should get a notification about the update in your admin. WP Admin > Plugins

You can also download the zip file from your Account page, and upload it. WP Admin > Plugins > Add New > Upload

Unified Changelog for s2Member & s2Member Pro v250607

• (Framework & Pro) Enhancement: Added a new option to skip the domain validation for notifications from the payment gateways. This allows continued processing of incoming notifications even if the domain in the custom value doesn't match the current site's. Useful for subscriptions originated outside of s2Member, or under a different domain. The setting is available under: WP Admin > s2Member > PayPal Options > PayPal IPN / Instant Payment Notifications

• (Pro) UI: Added the recent IPN Signup Vars Fallback and new Skip Domain Validation to all the gateway options pages.

• (Framework) Enhancement: Added the site's language code when loading the reCaptcha.

• (Pro) UI: Added a page refresh after the Pro Updater finishes installing the latest Pro release, to update the WP Admin interface and not show the Pro Updater again.

• (Pro) UI: Added a page refresh after the Other Gateways options are saved, to update the WP Admin left menu.

Upgrading to the Latest Version

You should get a notification about the update in your admin. WP Admin > Plugins

You can also download the zip file from your Account page, and upload it. WP Admin > Plugins > Add New > Upload

Unified Changelog for s2Member & s2Member Pro v250525

• (Framework & Pro) Fix: Some translations were being applied too early, causing PHP notices since WP 6.7. Now all translations are only loaded at the init hook or later. See thread 12813

Upgrading to the Latest Version

You should get a notification about the update in your admin. WP Admin > Plugins

You can also download the zip file from your Account page, and upload it. WP Admin > Plugins > Add New > Upload