Fluent Forms Pro 6.2.13: Signed updates now on 🔐

We are rolling out a signed updater to all the plugins and today, we shipped that for Fluent Forms Pro.

Your site checks the signature before WordPress installs anything. If the package was not built by us, or a file changed in transit, the update stops and tells you why. Nothing to turn on. This is our bigger goal about making our plugins more secure than ever.

We sent both the free and Pro plugins to Patchstack for an external review. Everything they reported back for the edge cases is fixed in this release.

Now your site checks four things before installing:

• The release is signed, and the signature verifies against a key compiled into the plugin.
• The signed package is actually Fluent Forms, not another product of ours replayed as an update.
• The version is not older than what you have, which closes the downgrade trick.
• The file hash matches the signed one. One byte out and the file is deleted, not installed.

Nothing to turn on, and nobody re-enters a license key. Licensed before the update means licensed after, multisite included.

Full write-up, including where it deliberately fails open and what it does not solve: https://fluentforms.com/signed-updates-for-fluent-forms-pro/

The rest of 6.2.13: uploads with uppercase extensions like .JPG are accepted, over-limit coupons are rejected properly, Google Maps stops saving coordinates to the wrong address field, shared form links no longer 404 sometimes, and Save & Resume works on fully cached sites.