Changelog

All notable changes to FalconCMS are documented here.
Format follows Keep a Changelog — versions are sorted newest first.

v2.9.2 Latest

Released: 2026-11-07

A steadier first paint on long pages, and safer dependencies. Released with Pro v1.5.7.

Fixed

The header no longer jumps while a long page loads. Builder elements print their styles beside their markup, and a long page is painted while it is still being read, so a menu or Motion Visual could appear without its styles and then move. With Critical CSS on, these styles now go to the head. See Critical CSS.

Security

Symfony versions with known advisories are refused: symfony/http-foundation, symfony/http-kernel and symfony/routing below 7.4.23 or 8.1.11, and symfony/mime below 7.4.22 or 8.1.10. The dashboard updater brings the patched versions along.

Changed

Manual updates use composer require falconcms/falconcms -W. composer update does nothing on a site whose composer.json holds an exact version, which is what the dashboard updater writes, and without -W Composer can stop on a conflict. See Upgrading.

In Pro v1.5.7

Falcon Shop Boost 1.0.2: with Skeletons on, every page animated and repainted on every frame. It no longer does.
Falcon Effects 1.0.3: a word marked with Highlight Draw did not show on a Title with a text animation or gradient. It now keeps a solid color.

v2.9.1

Released: 2026-11-06

A review step before anything goes live, locks so two people do not overwrite each other, and how long visitors stay on each page.

Added

Publish without review, a new permission on the Roles screen. A role without it sends what it writes with Submit for Review, and a publish from a bulk action, the API or a plugin becomes Pending Review. A role with it sees a Review count in the admin bar and chooses Approve & Publish or Request Changes, with an optional note. Reviewers and writers are emailed at each step. See Publishing and Review.
Edits to live content wait for review for those roles, and readers keep the current version until then. Review Changes shows each changed field, live and proposed. Only the changed fields are applied, so another edit made in the meantime is kept.
Edit locks. Someone opening an item another person is editing is told who has it, on posts, pages and in the builder.
Time on site on the Analytics page: average time per visit and per page, total time, Time by Page, and Time Spent in Recent Visits, the Visitor Log and its CSV. See Time on site.

Changed

Existing roles keep publishing. The update gives the new permission to every role that can write, except Contributor, Subscriber and Customer. A new role has it only if you tick it.
The Contributor role can now write posts and send them for review.
WordPress posts awaiting review stay Pending Review on import instead of becoming drafts.
The mobile admin menu is narrower, so more of the page stays in view.

v2.9.0

Released: 2026-11-04

Size fields that take any CSS value, "3 hours ago" dates for news, a menu per device, a sticky table header that works, and site moves that carry their links with them.

Added

Post Date → Show As: Time ago. "5 minutes ago", "3 hours ago", "2 days ago", in the site's language, with Latin, Bangla, Devanagari or Arabic digits. After a limit (7 days unless you set another; 0 = always) the date shows instead, in the element's format. The words are kept current in the reader's browser, so a page served from the page cache or a CDN never says "3 hours ago" the next day.
A menu per device. The Menu element's Menu has a responsive switch: tablet and mobile can each show a menu of their own. Left on "Same as …", they show the larger screen's menu.
php artisan falcon:replace-url [from] [to] [--relative] moves every link to an old address onto this site, for data copied over by other means than a restore. --relative keeps only the path, for a site opened at more than one address.

Changed

Padding and margin fields are text boxes, like Font Size, everywhere in the builder: containers, columns, nested columns, every element, and plugin elements' spacing fields. Type 20, 20px, 2rem, 5%, 10vh or calc(1rem + 2vw); a bare number is px. The unit dropdowns are gone. Pages saved before look exactly as they did.
Four sides wherever there were one or two padding boxes: Accordion title and content, Tabs content, Code Block, Content Box box and button, Table cells, Callout, Prev/Next and Table of Contents. A side left empty keeps the old value.
One kind of Font Size, Line Height and Letter Spacing field — a text box that takes any CSS size. A font size left empty follows the Customizer's typography.
Side-by-side fields are the same size in every panel (Icon Box, Content Box, Tabs, Ticker, Gallery, Menu). Menu → Mobile shows Trigger Text and Trigger Font Size side by side.
Image and Button: a border radius per corner.
Menus link to pages as they are now. A Menu element's page, post and term items are worked out from the item (a renamed slug or a translation follows), and links to the site itself are written as paths, so menus are right under every address the site is opened at.

Fixed

Restoring a backup on another site moved none of its links. A database brought from falconcms.com to a local copy kept its menus, buttons and settings pointing at falconcms.com. A backup now records its site's address, and a restore on a different address moves every link to the old site onto the new one — in menus, layouts, content, settings and revisions, inside JSON, PHP-serialized and URL-encoded values. Other domains, e-mail addresses, visit logs and Search Console figures are left alone. A backup made before this is read from its data.
Table → Header stays visible while scrolling did nothing on the page: the header could only stick inside the table's own scroll box. It now stays at the top of the window (below a fixed site header) while the table scrolls past, without shaking, follows a wide table's sideways scroll and keeps sorting. It also shows live on the canvas.
Missing word spaces. "Published: " before a Post Date lost its space when the page was saved ("Published:3 hours ago"), and Minify HTML removed the space between a label and its value ("CATEGORY:Flagship Phones"). Builder layouts are saved as written, and the minifier keeps a space between inline tags.
Device Visibility buttons of a container, column, nested row or element with no setting yet all looked switched off, and the first click sometimes did nothing. A nested row hidden on the device being edited is now dimmed on the canvas like every element.
Code Block keeps its line breaks when a builder post is saved from the post screen.
The builder's Preview shows the page through the theme instead of its JSON.
The post screen shows a post's real address in the search preview and permalink.
SEO analysis reads split-text headings and skips image placeholders; the post list's SEO score counts the focus keyword and the shared image, in characters.
Reading time no longer counts a rendered post's CSS and scripts.
Menu on the canvas is styled as a mobile menu only where it collapses; the Mobile tab is hidden for a menu that never collapses.

v2.8.19

Released: 2026-11-03

Fixed

Post Views in the Post Card builder. The Post Views dynamic source (and any source a plugin adds) was offered only in the page builder. The Post Card builder — where a view count on each card is most often wanted — and the Mega Menu and Off-Canvas builders now offer it too.

v2.8.18

Released: 2026-11-03

Post views on every site, editors in the page builder, and a round of security, SEO and reliability fixes from a full code audit. (v2.8.17 was a single fix to the Table of Contents sticky settings panel.)

Added

Post Views, built in. The builder's Dynamic Source → Post → Post Views shows how many times a post was read, on any title, text block or button — the post's own page or each card of a Card grid. Choose the period (all time, today, last 7 or 30 days), the number style (12,345 · 12.3K · 12345), a label (views, or Read {count} times), Latin, Bangla, Devanagari or Arabic digits, and a threshold below which the fallback shows. Also as {lazy:post_views}.
- Views are counted by the reader's browser, so pages served from the page cache or a CDN count too. Bots, drafts and signed-in editors are not counted.
- The Card element can order posts by views: all time, today, the last 7 or 30 days.
- It used to need the Falcon News plugin (Pro). A site that counted with it keeps its figures.
Sticky → Stop sticking for columns, nested columns and containers: at the end of the section (as before), after scrolling a number of pixels, or when a chosen element (#id, .class, footer or a heading's text) reaches it. The box moves up with the page rather than vanishing. Not offered in header, footer and other layout sections, where it would do nothing.

Fixed

Editors can use the page builder. With page permissions, it opened only for administrators; it now opens for the types a user may write, and each save is checked against the post's type, as the classic editor does.
Security. A theme named .. could delete resources/views; only a Super Admin can change the Super Admin role; HTML files can no longer be uploaded to the media library; a plugin installed from a URL is fetched only from public http(s) addresses; the page cache no longer keeps a copy per query string.
Saving a page clears the page cache. Edited pages could serve their old copy for a day.
SEO. Category and tag archives print their own description (tags are titled “Posts tagged …”); a builder page with no SEO description no longer shows its layout JSON as the description; /index.php is no longer a second home page; Twitter card tags use name=; SVG images and archive cards carry their width and height.
Table of Contents → Sticky → Enable sticky on (Desktop, Tablet, Mobile) now works.
Category search in the admin no longer fails; the media month filter and shop reports work on SQLite; database backups stream instead of filling memory.

v2.8.16

Released: 2026-10-30

Choose where a sticky Table of Contents stops.

Added

Table of Contents → Sticky → Stop at. The heading where the sticky list lets go. Type the heading's text, for example Conclusion, or a CSS selector such as #comments.
- When the reader reaches that heading, the list scrolls away with the page.
- The heading stays in the list.
- Leave it empty and the list sticks until the end of the article, as before.

Changed

The end of a pinned Table of Contents. At the end of the article, a pinned list now moves up with the page. Before, it jumped off the screen.

v2.8.15

Released: 2026-10-30

A Comments element for your layouts. Also: one H1 on every single page, and a safer comment form.

Added

Comments element. The builder has a Comments element. It shows the approved comments of the post being viewed, their replies, and the form to add one. Put it in a Layout Builder Content section and every post that section is used for gets its own comments.
- Content tab: the heading, the count, the order, avatars, dates, replies, and the form's heading and button.
- Design tab: colours, corners, typography and responsive margins.
- After posting: the visitor returns to the comments and sees whether the comment is live or waiting for approval.

Fixed

One H1 on a single post, custom post type entry or product. With the Page Title Bar showing the title, the bar's title is the H1. With the bar off, or its title hidden, the template prints the title as the H1.
- Before, a builder post with the bar off had no H1.
- Before, a product with the bar on had two.
- In a custom Content layout, use a Title element with the dynamic source Post Title and the H1 tag.
Comments and the page cache. A comment you approve, or one that is posted or deleted, shows on its cached page straight away. Before, the cache kept the old list for up to a day. A visitor's "awaiting moderation" notice or form error is never stored for other visitors.
Table of Contents. The comment section's headings are no longer listed.

Security

Redirect. After posting, the visitor goes back to the post's own address. Before, it was an address taken from the request, which could point to another site.
Moderation. Before, typing a known commenter's email, or a member's, published a comment without moderation. Now a guest comment goes live straight away only when all of these hold:
- the same name and email already have an approved guest comment;
- the email does not belong to a member;
- the comment has no link.
Replies. Only an approved comment on the same post can be replied to.
Which posts take comments. Only published posts. A guest must give a name and an email.
Spam. A hidden spam-trap field turns bots away. The same comment twice in ten minutes is kept once.
Names. HTML tags and invisible or direction-flipping characters are removed. They could make a name look like someone else's.

v2.8.14

Released: 2026-10-30

Sticky that sticks: columns, and the Table of Contents on more layouts.

Fixed

Column → Sticky. With the row's default alignment the setting did nothing. A stretched column is as tall as its row, so it had nowhere to travel. Where a column sticks, it now keeps its own height and stays on screen beside its taller neighbour.
Table of Contents → Sticky. Some layouts put the list in a column beside an intro, with the article in the sections below. The list left the screen with its short section, even with the column's own Sticky switched on. Now it pins to the screen until the article ends.
Table of Contents → Sticky. A column counts as "beside the content" only when the headings it lists are in the same row.
Table of Contents → Sticky. A pinned list sits below a sticky site header instead of behind it.

v2.8.13

Released: 2026-10-30

Fixes for the Table of Contents, the Content element and pages that scrolled sideways.

Changed

Accordion. A panel slides open and shut instead of appearing all at once.
Table of Contents → Sticky. A list in a column of its own beside the content sticks its column, as before. Anywhere else, in a section of its own above the article or on a phone where the columns have stacked, it now pins to the top of the screen once it scrolls past and lets go when the article ends. A collapsible list folds to one line while pinned.

Fixed

The Content element runs every element in the post. Shown through a Layout Builder Content section, a post's Table of Contents did not appear, and the Accordion, Tabs, Table, Code Block and other elements that need a script did nothing.
Table of Contents. Sticky did nothing unless the list sat in a column beside the content.
Table of Contents. The section being read stays lit, whether the reader scrolled there or clicked its link, also near the foot of the page. Opening a #section link lights that section, and a long list keeps the lit entry in view.
Table of Contents. A heading placed straight above the list ("Table of contents") names the list. It is no longer counted as entry 1.
No sideways scroll bar. Several things widened the page. On a phone this showed a sideways scroll bar and a blank strip on the right:
- Scroll Motion's Slide in from the left / right
- entrance slides
- a full-width Content section (on desktop it was a scroll bar wider than the page)
- long unbroken text in a post
A blog post has its title as its H1 again when the Page Title Bar is switched off or hides its title. Before, such a post had no H1 at all.

v2.8.12

Released: 2026-10-29

Folders for the media library, everywhere files are uploaded.

Added

Media folders. Organise the library into folders, and folders inside folders — on the Media page, the upload page and the media window that opens from pages, posts, the builder and settings. Make a folder at the top level or inside another ("Where"), also right beside Upload to; rename it any time; move it into another folder or make it a main folder again (drag it, or use its Move button — the way on a phone). Move files by dragging them onto a folder, with Move to folder under Bulk actions, or from a file's details, and upload straight into a folder. See Media Library → Folders.
Folders only group files: a file keeps its address whichever folder it is in, so no page that shows it breaks, and deleting a folder never deletes a file (its files go back to Uncategorized, its folders move up one level).
The media window works on a phone: its Upload / Library tabs show across the top, and its folder filter and search now work (they were placeholders before).

Fixed

The cart badge stays round with a two-digit count (15 was a pill).
The admin bar stays on one line on a phone ("CMS Site" and "Howdy, …" wrapped onto two).

Updating

A new table holds the folders (cms_media_folders, plus folder_id on media); the update runs its migration. Until it has run, the library and uploads keep working without folders.

v2.8.11

Released: 2026-10-29

One pagination, the same and tidy on every page of the site.

Changed

One pagination everywhere. The blog, categories and tags, custom post type archives, the shop and its categories, search results, builder post grids and the shop account's orders each had a pagination of their own, and the shop's showed Laravel's default with a "Showing 1 to 12 of 13 results" line squeezed beside it. They now all show the same one: rounded buttons in the theme's primary colour, Previous and Next, the current page filled, long runs shortened with "…", and on a phone only the pages next to the current one, so it never wraps onto a second line.
A theme's or a plugin's plain $items->links() renders it too on any page outside the admin, so custom themes match without changes; the_falcon_pagination($items) renders it anywhere. The admin keeps its own. To change the colour, set --falcon-pg-accent on a parent.

v2.8.10

Released: 2026-10-28

A cart of several products no longer breaks the site with 502 Bad Gateway.

Fixed

No more 502 Bad Gateway with a full cart. The cookie that keeps a shopper's cart between visits held the whole cart (names, prices, picture links), encrypted. After a few products it outgrew the web server's buffer for response headers, and nginx answered every page of that shopper with 502 ("upstream sent too big header"). The cookie now holds only each line's product, variation, quantity and custom fields; names, prices and pictures are read from the shop when a returning browser gets its cart back. A cart too big even for that (about 18 lines) stays in the session, so the headers always fit nginx's default 4 KB buffer. A browser that still has an old, large cart cookie gets its cart back and a small cookie in its place.

v2.8.9

Released: 2026-10-28

Write with AI, free: Falcon AI writes whole articles in the post editor with Claude, OpenAI or Google Gemini (which has a free tier). Also shop hooks for plugins, and cached pages that no longer break add to cart.

Added

Falcon AI (free, bundled, on by default). A Write with AI button beside the Page Builder tab of the post editor:
- Give a topic (plus an optional focus keyword, audience, length, tone and notes) and get an outline you can edit, then the article, written section by section as you watch, then its SEO title, description, excerpt and tags.
- Improve selection rewrites, expands, shortens, simplifies or translates the selected text.
- SEO suggestions (titles, descriptions, image alt text) in Falcon SEO and its Site Analysis.
- About 80 writing languages, in a searchable list.
- Works with Claude, OpenAI or Google Gemini on the site's own API key, set under AI → Settings & Usage. Gemini's Flash models have a free tier; new Google AI Studio keys starting with AQ. are accepted. A busy Gemini model (503) is retried automatically.
- A monthly token limit, a usage record (counts only, never the text) and a choice of which roles may write with AI. Keys are stored encrypted and never sent to the browser, and every AI answer is cleaned before it reaches the editor. See AI Writing.
falcon_admin_post_editor_tabs, a hook in the post editor's tab row.
Shop hooks for plugins: falcon_product_card_actions (a button on product cards), falcon_shop_settings_tabs and falcon_shop_settings_toggles (a tab of Shop → Settings), falcon_cart_shipping_bar (a line above the cart and in the mini-cart), falcon_shipping_zone_for_country(), and LazyCart.added() / window.FalconShopUx for add-to-cart feedback. Falcon Shop Boost (Pro) is built on them. Documented in Hooks.
settings_params in plugin.json: the Plugins screen's Settings link can open one tab.

Changed

AI writing moved out of Falcon SEO into Falcon AI, and is now free. A saved Claude key and model are carried over on update; SEO → Settings no longer has an AI section.
The shop archive's "Add to cart" opens the mini-cart, like product cards elsewhere.

Fixed

Add to cart on a cached page no longer fails with 419. With static page caching on, a cached page used to hand its first visitor's CSRF token to everyone after them. Each visitor now gets their own token. Pages cached before the update are rendered afresh.

v2.8.8

Released: 2026-10-28

Your own fonts, builder hooks for plugins, an uninstall that keeps a plugin's data, and product galleries that change their picture again with AVIF on.

Added

Custom fonts (Customizer → Typography → Custom Font). Upload your own font files from the Media Library, one box per font face; the weights are read from each file, and a variable font is offered as a range. A custom font can be chosen in every typography setting, in the builder, and in Motion Visual text.
Builder extension hooks. A plugin can add its own settings to the Extra tab of elements, containers and columns (nested columns too), show its effect in the builder canvas, and add attributes to the page markup of what it touches. Documented in Hooks.

Changed

Uninstalling a plugin keeps its data. Plugins → Delete now opens a dialog: the plugin's files are removed, but its settings and its own tables stay, so activating it again (or installing it again) brings everything back. To delete the data too, tick Also delete all of its data and type the plugin's slug; the dialog says what that data is. Uninstalling several plugins at once never deletes data. A plugin that comes with FalconCMS Pro reappears in the list on the next page load, ready to activate.

Fixed

Product gallery thumbnails change the main picture again when AVIF is on. With Falcon SEO's AVIF images, library pictures are wrapped in <picture> with an AVIF source; a gallery thumbnail (or a variable product's option) changed the image underneath, but the browser kept showing the first picture. The AVIF source now steps aside once a script changes the picture.

Security

The repository's GitHub Actions are pinned to exact versions, Dependabot keeps them and the Composer packages up to date, and a security policy says how to report a problem.

v2.8.7

Released: 2026-10-27

Motion Visual — animated dots, shapes, text and pictures across a whole column or container — smooth scrolling for every link to a section, and two SEO fixes.

Added

Motion Visual (Column / Container → Extra; free). A layer across the whole column or container, behind its content or in front of it, switched on and off with one switch (off puts no markup, style or script on the page, and keeps every setting):
- Dots drawn on a canvas — how many, size, speed, color, fine lines between near dots, and what the mouse does to them (push away or pull in).
- Shapes, text and pictures — 39 shapes, your own uploaded images, and text (fill, outline or gradient; sized as a share of the layer, so it keeps its place on every screen). Each item has its own position, size, turn, color, opacity, blur and mouse depth, and one of seven animations: float, drift, rotate, pulse, swing, orbit, bounce.
- Seven presets to start from (Floating Dots, Connected Dots, Soft Bubbles, Geometric, Blobs, Big Word, Custom), and Main / Accent / Random colors on the builder's own color picker — Random keeps changing by itself.
- In the builder the canvas shows the real layer, for top-level and nested columns and for containers, with handles to drag, resize and turn each item.
- Light on the page: shapes animate with CSS alone; one small script, loaded only on pages that have a visual, draws the dots and follows the mouse, and stops while the layer is off screen. Visitors who ask for reduced motion always get it still; tablets and phones can be set to full, calmer, still or hidden.
- Plugins and themes can add shapes and presets (falcon_motion_visual_shapes, falcon_motion_visual_presets).
Smooth scrolling for every link to a section — builder buttons, text links and image links to #section now glide there and stop just under the sticky header, like the landing-page menu. The scroll is measured again on every frame, so images loading on the way or a header that changes size cannot make it miss; a wheel or touch takes over at once. The address bar reads /page/#section.

Fixed

SEO changes reach cached pages. Saving SEO → Settings, Bulk SEO or a Site Analysis fix now empties the page cache; before, cached pages kept the old head (a new default share image stayed off them until the cache was cleared by hand).
Weekly SEO email: "Send a test now" keeps the addresses typed beside it. The button sent to the old addresses and the field came back empty, so the address looked unsaveable.

v2.8.6

Released: 2026-10-24

The core side of Falcon Security 1.1 (FalconCMS Pro 1.4.0): a baseline Content Security Policy, plugin hooks on the orders list and the shop's sign-in form, and signing in that lands on the page you asked for.

Security

A baseline Content Security Policy on every page. It blocks nothing the builder relies on (inline scripts and styles, fonts, embeds) but stops framing by other sites, <base> hijacking and plugin objects; on an https site it also upgrades plain-http requests. Replace it or turn it off with the falcon_content_security_policy filter ('' sends none). A site on plain http (a local install) is not told to upgrade, so its admin buttons keep working.
X-Powered-By is really gone. PHP adds it itself, outside the response; it is now removed from PHP's own headers too.

Added

Hooks on the admin orders list — falcon_admin_orders_toolbar beside the search, and falcon_admin_orders_columns / falcon_admin_orders_column for a column of a plugin's own. Falcon Security's Check a number and Risk column use them.
Other ways to sign in on the shop's account page — its sign-in form fires falcon_login_form_after with 'shop', so a plugin can offer one there (Falcon Security's "Sign in with a code to your phone").

Changed

Signing in lands on the page you asked for. An admin page opened without a session still answers 404 — the sign-in address stays hidden — but the page is remembered, and signing in opens it instead of the dashboard.

Pro: Falcon Security 1.1

Two-factor by SMS and WhatsApp, OTP gateways (Twilio, WhatsApp Cloud API, Bangladeshi SMS providers), sign-in with a phone code, cash-on-delivery phone confirmation, a fake-order risk score with courier history (Steadfast, BD Courier) and an order blocklist, "confirm it's you", impossible travel, a Content Security Policy builder, a spam guard, known-vulnerability alerts, signed release integrity in the malware scanner, a security score and monthly report, Telegram and WhatsApp alerts, and an agency dashboard. See Falcon Security.

v2.8.5

Released: 2026-10-21

A security release first: every login form now shares one lockout, an endpoint that let anyone check passwords is gone, and emailed links can no longer be pointed at another domain. Plus read/write permissions per menu, the Instagram Feed element, a working custom-field filter for post loops, reading time in any language, and the hooks Falcon News and Falcon Security build on.

Security

No more password checking without a lockout. POST admin/login/check told any visitor whether an email and password matched — the "funny" login theme asked it on every keystroke — without the sign-in form's five-try lockout: unlimited password guessing, and a list of which emails have accounts. The endpoint is gone; the theme's running button now waits only for both fields to be filled in.
One sign-in lockout for every login form. The shop's My Account sign-in signs in any account, administrators included, but had no lockout and no rate limit. The dashboard's lock now lives in LoginGuard, which the dashboard, the shop and plugins' own login forms (the wholesale login) share: five wrong passwords lock the account for 30 minutes whichever form they were typed into, so switching forms buys no extra guesses; an address the dashboard blocked is refused everywhere; too many failures from one address make it wait; the shop form takes 10 tries a minute and gives one message whether or not the email has an account.
Emailed links stay on your domain. Password-reset, magic-login and email-verification links are built on APP_URL, so a request sent with another site's name in its Host header can no longer mail a real token on that domain. Analytics also skips requests for host names that are not the site's (scanners and bots on the bare IP were 60% of the demo's visits); add extra domains with the falcon_site_hosts filter.
Analytics referrers become links only when they are http(s): a javascript: referrer, which any visitor can send, would have run in the admin's session.

Added

Read and write, per menu. In Users → Roles, a section with a list and an "Add New" — posts, pages, every post type, products, media, users, forms, and any plugin menu shaped the same way — is now read with the list's permission and changed with Add New's. A role with the list alone sees the rows but no Add New, checkboxes or edit and delete links. Every submenu has its own permission (ticking one Wholesale screen no longer ticks them all), roles saved before keep working, switched-off plugins' menus are left out and keep their grants, and a plugin runs only while the plugins it depends on run.
Instagram Feed element (Pro): show the connected Business or Creator account's posts (Customizer → Instagram: the token is checked, stored encrypted and renewed weekly), public posts by link from any account, or pictures you choose. Everything is kept on your site and refreshed in the background, so pages never wait on Instagram. See Instagram Feed.
Post loops by custom field. get_falcon_posts() now applies meta_key / meta_value — the Card element's "Posts By: Custom Field" — and plugins can add orderings (falcon_posts_orderby, falcon_post_orderby_options) and preload data for a whole loop (falcon_posts_fetched).
Reading time in any language. Words are counted in every script (a Bangla article used to read as "1 min") and in builder content; the Reading Time source takes a label, a reading speed and digits (Bangla, Devanagari, Arabic).
Analytics: Referrer column in the visitor log — Google, Facebook, X, another site by domain, or Direct — matched on whole host parts (as a substring, "t.co" credited fast.company.com to X).
Hooks for plugins: dynamic content sources (falcon_dynamic_sources, falcon_dynamic_value), admin list columns (falcon_admin_list_columns, falcon_admin_list_cells), builder elements previewed from their own template, and falcon_login_form_after under both login forms. See the hooks reference.

Fixed

A posts loop ordered by views threw on the front end; an order nobody answers now falls back to the date.
The admin loaded a count per menu on every request (about 80 queries); the admin posts and pages "show" routes answered with a server error.
SEO page scores were kept for the whole process, so a long-running worker kept showing the first list's scores.

Pro: Falcon News and Falcon Security

Released with Pro 1.3.2: Falcon News (view counter, Most Viewed, RSS, Google News sitemap) and Falcon Security (two-factor and passkeys, firewall, malware scanner, temporary access, lockdown, security log and more). See News sites and Security.

v2.8.4

Released: 2026-10-16

What updating to 2.8.3 turned up on falconcms.com and the demo: a plugin update that never finished, a config cache that was still dropped, and Site Health errors from the update itself that stayed critical. Plus a roomier Title editor and documentation for the new builder tools.

Fixed

Plugin updates that arrived with Pro but never finished. Pro copies its bundled plugins (Falcon Wholesale, Slider, Search Console) in as the site boots, which during an update happens inside Composer's own run, and finishes their update there. When that step failed, nothing showed it and nothing tried again: on the next boot the files already matched. On the demo, Falcon Wholesale's files were 1.0.1 while the site still recorded 1.0.0 and kept offering the update. falcon:update now finishes every active plugin whose files are newer than its recorded version (new migrations, its upgrade step, the new version) in a clean process after Composer, and prints the outcome.
The config cache was still lost on update. 2.8.3 rebuilt the caches a site had before the update cleared them, but Composer deletes the cached config even earlier, while it installs, so only the route cache came back. The dashboard updater now notes whether the config was cached before it runs Composer and passes that to falcon:update. From a shell, a route cache that survived counts for both.
Site Health: errors logged during the update itself stayed critical. While Composer swaps the files, Laravel can fail to set up its logger and log Unable to create configured logger. The real cause, a file missing for a moment, is inside the exception behind that line, which Site Health did not read. It does now, so the error counts as fixed once the file is back.
Site Health: OPcache read "off" when the checks ran from the command line. OPcache is normally off for the CLI (opcache.enable_cli), which says nothing about the web server. From the CLI the web setting now decides.

Changed

Title element: a taller editor. The toolbar wraps to two rows in the settings panel, which left room for one line of text; a two-line title was cut off. The editor is now 260px tall.

Documentation

Builder Elements: the Title section describes the rich editor and the H1 default (it wrongly said the element always shows the current page's title); the Item List section covers duplicating and reordering items; and there is a new Table section with pasting, the Cells grid and the row controls. With screenshots from the demo.
Upgrade Guide: what falcon:update now does with plugins and caches, and why errors logged during an update clear themselves in Site Health.
Media: changing a file's title no longer renames the file.

v2.8.3

Released: 2026-10-16

A rich editor for the Title element, duplicate buttons for list items and table rows, and three fixes found on falconcms.com: images that broke when a file was renamed, the config cache that every update dropped, and Site Health errors that stayed open after an update had fixed them.

Added

Title element: a rich editor. The Title field is the same editor as the Text Block's, with the tools a heading can hold: bold, italic, underline, strikethrough, text and background colour, link, clear formatting and the code view. Enter starts a new line inside the heading. Paragraphs, lists and tables are left out on purpose, because a heading cannot contain them. Existing titles open exactly as they were saved; a title is only rewritten when you edit it.
Title element: new titles start as H1. The HTML Heading Tag of a newly added Title is H1. Titles saved before this release keep rendering as H2, as they always have, so no existing page changes its heading outline. Their tag box now says H2 instead of being blank.
Item List: duplicate an item. A copy button next to delete duplicates the whole item (icon, colour, text, link) right below the original.
Table: duplicate a row. Each row of the Cells grid has a copy button; the copy lands right below the original, and the header row stays first.

Changed

Table: drag to sort rows. The up and down arrows in the Cells grid are replaced by a grip: drag a row by it and drop it where it should go; the row under the pointer is outlined. The grip, duplicate and delete controls are now one clean column of matching icons. Only the grip starts a drag, so selecting text inside a cell works as before.

Fixed

Renaming a media item's title broke the images that used it. Changing the title in the Media Library also renamed the file, so its address changed, and every page, section or setting that showed the image kept pointing at the old address and showed a broken image. The title is now only a label and the file keeps its name, as in WordPress. Files already renamed by an earlier version keep their new name; re-pick the image where it shows as broken.
Every update dropped the config and route caches. The update's last step cleared all caches and nothing rebuilt them, so a cached production site ran uncached after each update (and Site Health said Configuration is not cached) until someone ran php artisan optimize. The update now rebuilds the config and route caches the site had before. A site that never cached stays uncached, and a rebuild that fails is cleared rather than left half-written.
Site Health: errors an update fixed no longer stay open. An error that surfaced inside Laravel itself (a database insert, for example) or a file that an update moved away was never counted as fixed, because the file it named never changes. It now counts as fixed when new code was installed after it last happened. If it happens again, it is open again.

v2.8.2

Released: 2026-10-16

Fixes from the week after 2.8.1: analytics visits that were lost, two Site Health false alarms, the Cloudflare token you can now recognise, and two hooks the Pro Wholesale plugin uses.

Added

Cloudflare cache: the saved API token shows half masked. Settings → Integrations → Cloudflare cache shows the first half of the saved token and masks the rest, so you can see which token is in use without the whole token ever going back to the browser. Save the form as it is and the token is kept; click into the field to paste a new one.
falcon_pending_promotion_offers filter. The cart's "You qualify: free X" prompt goes through a filter, like the promotions themselves (falcon_cart_promotions). A plugin that switches a customer's promotions off now switches the prompt off too — the Pro Wholesale plugin does, so wholesale customers are no longer told they qualify for a gift they will not get.
falcon_show_sale_badge() and the falcon_product_sale_badge filter. The "Sale!" badge on the product page, the shop, product cards and each variation asks first. A customer's own price arrives as a sale price (so it reads "was / now"), but it is not a sale; the Pro Wholesale plugin keeps the badge only when the retail product is on sale itself.

Fixed

Analytics lost visits from browsers with a long user agent. Some in-app browsers (Facebook, Instagram and others) send a user agent longer than the 255 characters the analytics table holds. The insert failed with Data too long for column 'user_agent', and the visit was not counted. The stored copy is cut to 255; the browser, system and device are still read from the whole string.
Site Health: no false file-inclusion finding for a fixed view. The code scan reported @include('a.view', ['x' => request('x')]) as File include from user input (critical). A fixed view handed a value from the request loads no file the visitor chooses. The rule still fires when the view name itself comes from the request, and for PHP include/require as before.
Site Health: errors from an update caught half-way count as fixed. For a few seconds during an update, files can be missing. The Failed to open stream errors that leaves count as fixed once the file is there again, and so does the error Laravel hits drawing its own error page because of them (Target class [translator] does not exist). They no longer sit in the error list for a week.

v2.8.1

Released: 2026-10-15

Cloudflare Turnstile on the site's own forms (free), a security fix for administrator roles, the shop hooks the new Pro Wholesale plugin is built on, and a Rank Tracker in SEO (Pro).

Added

Cloudflare Turnstile on the site's forms (free). Settings → Integrations → Show on switches it on for the login page (password and magic link), registration, forgot password and the shop's My Account sign-in, each on its own, once the keys are saved. The answer is checked before anything else happens; if Cloudflare cannot be reached the form goes through, so no one is locked out. The widget follows light/dark and turns compact on a phone. Plugins add their own forms (the Pro Wholesale plugin adds its login and application forms).
SEO → Rank Tracker (Pro, with DataForSEO). Follow keywords in Google by country and device, checked weekly or daily: position, ranking page, change, best position, trend, monthly searches and difficulty. Competitor gap lists the keywords a competitor ranks for that you do not.
SEO Audit finds redirect loops and chains, pages hidden by a redirect, links to redirected addresses and canonical problems.
Users → filter by role counts and lists people who hold a role as an extra one.
Shortcodes as pairs: [tag]content[/tag] passes the content to the shortcode.

Fixed

Security: administrators are known by their role's slug, never by its id. Role ids 1 and 6 were treated as administrator without looking at the role, so where those rows were missing a later role (a plugin's customer role) could make everyone given it an administrator. The administrator and super-admin roles now keep their slugs when edited (their names can change).
The page cache no longer stores the My Account page (its sign-in failed with "Page expired" for the next guest) or cart, checkout and wishlist pages at addresses of their own (one visitor's basket shown to the next). Clear the page cache once after updating.
Shortcode attributes keep their spaces (title="Trade login" arrived as Trade).
Checkout only accepts a payment method that is turned on; a cart quantity must be a whole number above zero; line subtotals update after a quantity change; a variation with a sale price of 0 is no longer free.
SEO API keys (Claude, DataForSEO, Bing) are clear about being saved, can be tested, and are no longer overwritten by a browser filling in the admin password; AI writing says when the Anthropic account has no credit.

For developers

E-commerce logic hooks through pricing (falcon_product_prices, one door for every price), cart, coupons, promotions, shipping, tax, checkout, payment gateways and the order lifecycle, and admin hooks for the product editor, variations (a new meta column), categories, users and orders. See the hooks reference.
New hooks: falcon_turnstile_locations, falcon_turnstile_enabled, falcon_turnstile_verified, falcon_page_cache_is_personal, falcon_customer_addresses, falcon_admin_order_sidebar, falcon_show_prices, falcon_product_price_filter / _sort. Helpers falcon_turnstile() and falcon_turnstile_check().
New migrations (variation meta, Rank Tracker tables): the dashboard's Update runs them.

v2.8.0

Released: 2026-10-14

SEO gets a menu and a plugin of its own, a check-up with a score for every page, and in Pro: AI writing, Google keyword data, one-click fixes and a weekly email. See the SEO guide.

Added

The SEO menu. SEO leaves Settings for a menu of its own with tabs: Settings, Site Analysis, SEO Audit, Bulk SEO, Search Console (Pro) and Redirects. Old addresses redirect. Each screen can be granted on its own in Users → Roles → SEO; roles keep what they had.
Falcon SEO, a bundled plugin (free, on by default) holds the SEO and speed tools. Switched off, the CMS keeps the basics (title, description, canonical, Open Graph, sitemap, robots.txt, redirects) and nothing saved is lost.
Page analysis with a score in the editor (SEO → Analysis): headings, the focus keyword, title and description, images, internal and external links, broken links, structured data, and keyword advice. It reads the published page as visitors get it, theme included.
Every country, several at once, for keyword demand, with Select all. With a Bing key each country gets its own bar; with Search Console (Pro), Google's own figures by country.
Site Analysis. Every page checked in the background, with its score, every problem across the site with the pages that have it (every broken link, every image without alt text…), and each page's score in the Posts and Pages lists.
WordPress import keeps your rankings: SEO settings from Yoast SEO, Rank Math, All in One SEO and SEOPress, and a 301 from each old address.
Pro: AI writing with Claude (titles, descriptions, alt text), Google keyword numbers and difficulty by country through DataForSEO, one-click fixes in Site Analysis, and a weekly SEO email.
Compiled CSS covers classes that come with the content, so a page looks the same with it on or off.

Fixed

The editor's SEO tabs (Keywords, Internal Linking, Analysis) work for editors, authors and contributors, not only administrators.

For developers

New hooks: falcon_seo_tabs, falcon_admin_path_access, falcon_keyword_countries, falcon_robots_txt, falcon_seo_robots, falcon_seo_head_links, falcon_seo_schema, falcon_optimize_html, falcon_customizer_sections and more (hooks reference). Plugins add SEO screens with falcon_add_submenu_page('seo', …).
New dependency: anthropic-ai/sdk. Run composer update (the dashboard's Update does it).

v2.7.11

Released: 2026-10-13

The shop makes its own pages, and two fixes found by turning every speed option on at once.

Added

The shop makes its own pages. When Falcon Shop is activated (or on its first run after an install or update), it creates the Shop, Cart, Checkout, Account and new Wishlist pages and assigns them. A page already at the usual address is used rather than duplicated. A page you delete later stays deleted.
Shop → Settings → Product & Inventory shows each shop page's state (Live, Not published, In the trash, Missing). Create missing pages brings back what is missing: it restores a deleted page from the trash, publishes an unpublished one, and creates any that is gone. It never changes a page's content. There is also a new Wishlist page setting.
Media → Generate AVIF copies. Makes the AVIF copy of every image already in the library, in small batches, with progress shown. Originals and their addresses are never changed. Shown while Serve AVIF Images is on.

Changed

Serve AVIF Images is locked off, with the reason shown, on a server whose PHP cannot write AVIF, instead of being "on" and doing nothing.
The CMS no longer creates the shop pages itself. It used to do so even with the shop off, and every update brought back a page you had deleted.
Shop links (cart, checkout, shop, account) only point at a published page. A draft or deleted page used to send visitors to a 404.

Fixed

Minify CSS broke calc(). It removed the spaces calc() needs around +, so browsers dropped the theme's fluid heading sizes and headings in content fell back to the body size.
Compiled CSS changed some colours. Shop product names turned to the link colour, because the compiled stylesheet loaded before the theme's styles. It now loads where the runtime build puts its styles, and pages look the same with it on or off.

v2.7.10

Released: 2026-10-13

An SEO release. Most of it runs on its own with nothing to set up; the rest is off until you turn it on. Nothing changes the SEO title, description or other data you have already written.

Added

SEO Audit (Settings → SEO Audit). A site-wide check-up with a score. It finds missing and duplicate titles and descriptions, empty pages (what Google calls "Soft 404"), pages nothing links to, images without alt text, short posts, posts without a featured image, and pages hidden from search. Each finding names the page, with View and Fix links.
Bulk SEO (Settings → Bulk SEO). Every page's SEO title, meta description, focus keyword and noindex on one screen. Filter to what is missing. Character counts include the site name Google shows. Only the rows you change are saved.
Keywords tab in the editor's SEO panel. It suggests the phrases a page is about and shows where each is still missing (title, headings, first paragraph, URL, description). Search demand shows how many people search for a keyword, from free sources:
- a Google Keyword Planner CSV you import (SEO Audit tab);
- Bing Webmaster Tools, with your own free API key;
- Google's search suggestions, which are optional and off by default.
Hide this site from search engines (Settings → SEO), for a demo, staging copy or unfinished site. Every page says noindex, the sitemap is withdrawn and IndexNow stops. The SEO Audit warns while it is on.
Breadcrumbs as structured data. One trail (Home › Blog › Category › Post) for the theme's title bar, the breadcrumb component, the builder element and a BreadcrumbList in the page's JSON-LD.
Linked structured data. Organization or LocalBusiness (Settings → SEO), WebSite, the page, and the post's real author as a Person, as one JSON-LD graph. Also VideoObject for YouTube and Vimeo videos, and an optional author box on posts.
Image sitemap. Each page in sitemap.xml lists its images for Google Images. Sites with more than 1,000 addresses get a sitemap index of numbered files. The address stays /sitemap.xml.
hreflang links between translations on multilingual sites, with x-default.
IndexNow (Settings → SEO, off by default). Bing, Yandex and others hear about new, changed and removed pages at once.
Google Discover. max-image-preview:large, and the editor warns when a featured image is narrower than 1200px.
AI crawlers (Settings → SEO). Block AI training and AI search crawlers separately, in robots.txt. Google and Bing search are never affected.
404 log on the Redirects screen, with one click to redirect a broken address.
Internal link suggestions both ways: pages to link to, and pages that mention this one without linking to it, each with the reason.
Analytics → Web Vitals. Real visitors' LCP, INP, CLS and TTFB, by page, for mobile and desktop, at the 75th percentile as Google judges it. Turn on Measure Real Visitor Speed in Customizer → Performance. A small script with no outside service.
Cloudflare cache purge (Settings → Integrations). Cloudflare's cache is emptied whenever the site changes, once per save, after the page is sent.
Customizer → Performance: Serve AVIF Images and Instant Page Loads (Speculation Rules). Both are off by default.
New hooks for plugins: falcon_seo_metabox_after, falcon_admin_list_seo_cell, falcon_dashboard_widgets, and the filters falcon_seo_audit_checks, falcon_link_suggestions, falcon_keyword_suggestions, falcon_seo_noindex, falcon_breadcrumbs, falcon_template_page_ids and falcon_structured_data.

Changed

Optimise Images also preloads the hero (an image or a section background) and reserves the space of library images, so the page does not jump while it loads.
Pages no one should land on from a search say noindex and stay out of the sitemap: site search results, empty archives, and the shop's cart, checkout and account.
The canonical address drops sort, filter and tracking parameters, and keeps ?page=N.
A new post or page can take its title from ?title= in the address.

Fixed

& in SEO titles and descriptions showed as &, and the site name could be added twice.
Posts were listed twice. The sitemap listed posts at /slug while the site links to /post/slug. The sitemap now uses the real address, and /slug redirects there permanently.
Structured data credited every post to "Admin" instead of its author.
Two menu items lit at once: the SEO menu on SEO Audit, and a plugin's Overview together with its Settings. Only the page you are on is lit now.
SEO Audit's sections opened and closed unreliably, and closing one could close every section with the same badge.
Lucide icons: lucide.min.js is no longer loaded on pages without a Lucide icon.

v2.7.9

Released: 2026-10-07

A speed release. Three new options under Customizer → Performance, all off by default, and a new Performance page explaining every speed setting.

Added

Inline Only the Icons in Use. Icon libraries such as Font Awesome, Bootstrap Icons, Remix, Boxicons and Lucide each load a whole stylesheet of 70–140 KB, and the page waits for it before it shows. With this on, the page carries only the rules for the icons it shows, usually a kilobyte or two. Libraries the page doesn't use are dropped. Works with any theme.
Critical CSS. Works with Compiled CSS. Each page carries, inline, only the styles it uses, typically 10–20 KB of the 68 KB file. The full stylesheet loads without holding up the first paint, so styles added later by JavaScript still apply.
Host Google Fonts Locally. The fonts are copied to your own server and served from there. Visitors' browsers never contact Google, which also helps with the GDPR. The copy is made in the background, and the page falls back to Google until the copy exists.

Changed

Lazy-load Images keeps the top of the page eager. The first three images load straight away, and the first image after the header (usually the hero) is fetched first.
Builder images reserve their space. Images from the media library carry their width and height, so the text below doesn't jump. If an image element has no alt text of its own, it uses the media library's alt text.

Fixed

No JavaScript errors on a variable product page. Before a variation was chosen, the availability row and the SKU threw "Cannot read properties of null" errors.
falcon:update restarts queue workers, so they don't keep running the old code.

Accessibility

The mobile menu button has a name. It is labelled "Menu", and it reports whether the menu is open.

v2.7.8

Released: 2026-10-06

Fixes from putting 2.7.7 on real servers.

Fixed

The shop's CSS and JavaScript load on every server. Plugin files were served only through the CMS at /plugin-assets/…. Many nginx setups answer every .css and .js URL straight from disk, so on those servers the mini-cart, wishlist, filter and shop admin scripts returned 404. Active plugins' static files are now also copied to public/plugin-assets/{slug}, at the same URLs:
- falcon:install, falcon:update and activating a plugin publish them
- deactivating a plugin removes them
- only static web files are copied, never PHP
No server configuration needs to change.
An order or report that includes a deleted product opens. The order page, Shop → Reports and the dashboard's top products linked each line to its product. Once a product was deleted there was no product to link to, and the page failed with a 500. The line now shows the product's name without a link.
Analytics labels a homepage visit with the domain it came in on, not the one in APP_URL. A site that moved to a new domain without updating APP_URL no longer lists its homepage visits under the old domain. A homepage visit with a query string reads /?author=1 rather than ?author=1.

v2.7.7

Released: 2026-10-06

The shop becomes a plugin. It ships with the CMS as Falcon Shop, stays free and stays on, so a site that updates sees no difference. What is new is that it can be switched off, and that a theme can restyle every shop page without losing track of later fixes. See Shop Plugin & Templates.

Changed

The shop is a bundled plugin, Falcon Shop. Admin → Plugins → Falcon Shop has a Settings link to the shop's settings and a Deactivate link. While the shop is off:
- no shop code, CSS or JavaScript loads, in the storefront or the admin
- Shop and Products leave the admin menu, and their screens answer 404
- products leave the site, its search and the sitemap
- /cart, /checkout and the other shop URLs act as though there had never been a shop: a page of your own with that slug shows, otherwise the theme's 404
- themes that link to route('shop.cart') or call the cart helpers keep working
Products, orders, customers and settings are never touched. Switch the shop back on and everything is where you left it. FALCON_DISABLED_PLUGINS=falcon-shop in .env forces it off from the server.
falcon:update clears out old shop templates. Earlier releases published the shop templates into the site's copy of falcon-theme, where they would have shadowed the plugin's templates indefinitely. The update removes them from falcon-theme only. That theme is replaced on every update anyway, and child themes are never touched.
A route cache built with the shop in the other state is detected and rebuilt, instead of sending shop URLs to code that is no longer loaded.

Added

php artisan shop:template shows which shop templates the active theme overrides, and php artisan shop:template ecommerce/cart copies one into the theme to restyle.
Template versions. Each shop template starts with an @version comment. Settings → Site Health and shop:template flag a theme copy that has fallen behind the shop's template.
For theme and plugin developers:
- hooks falcon_header_actions, falcon_after_footer, falcon_frontend_page_response, falcon_single_view, falcon_archive_view, falcon_plugin_post_types, falcon_site_health_checks and falcon_placeholder_image
- helpers falcon_plugin_active(), falcon_plugin_asset(), falcon_post_type_available() and falcon_placeholder_image()
- a settings_route key in plugin.json, which adds a Settings link on the Plugins screen

Fixed

Shop pages wear the active theme. They always used falcon-theme's header and footer. They now use the active theme's layout.
A child theme gets its parent's shop templates, rather than skipping straight to falcon-theme's.
Four variable-product hooks fire (falcon_variable_before/after_product_images, falcon_variable_before/after_product_description), and falcon_product_description_title applies to variable products too.
No more broken placeholder images. Imageless products and posts pointed at a placeholder.jpg that never shipped, and imageless cart lines pointed at a dead external service. Both now show an inline placeholder.
No PHP deprecation notices when mail is sent on PHP 8.2 and later.

v2.7.4

Released: 2026-09-22

A release about the gap between what the builder shows you and what the page renders. Several settings took a value, looked right in the editor, and then did something else — or nothing — once published.

Fixed

A section's Link Color and Link Hover Color reach the links they are set on. Both lost to the theme's own rich-text link styling, which is more specific than a single class, so a link inside a Text Block — the commonest place to have one — kept the theme colour. The container's rules match that specificity now. A Text Block with a hover colour of its own was also forcing every link inside it to follow along, with !important; links are excluded from that.
Container Link Hover Color is a new field, under Link Color in the Design tab. Left empty, links keep their own colour on hover, as they always did. :focus-visible follows :hover, so the same feedback reaches a keyboard.
Container Border Color keeps its opacity. The editor had drawn it correctly for a while; the page was still using the bare hex, so a border set to any transparency published solid. Untouched sides also stopped emitting a stray, invalid border-…: px solid declaration.
A gradient background with one colour paints that colour. Both the start and the end were required before anything was drawn at all, so choosing one and leaving the other empty gave no gradient and no colour. One colour is a flat fill of it; two still make the gradient. Applies to containers, columns and nested columns.
Row layout wraps on the page, the way it always has in the editor. A row that overflowed could not break, so its items shrank past their own content and printed over one another.
The editor renders in the site's typography. Every element defaults to font-family: inherit, and the canvas was inheriting the admin's system font while the page used the theme's body font — the same weight came out visibly lighter in the editor than on the page.
Icons from every library show in the builder. The picker offers Bootstrap, Remix, Boxicons and Lucide alongside Font Awesome, but the three builder screens loaded only Font Awesome, so an icon from any of the other four was an empty box in the canvas and in the picker. Nothing was ever lost from the saved page.
Table row hover works under every preset. Bordered and Minimal ship with hover off, and choosing a Row hover colour on either did nothing. Choosing a colour now switches it on. The tick box also reports the state actually in effect rather than sitting unticked under a preset that hovers.
/admin is a 404 for every browser without a session again. v2.6.13 let a browser that had signed in before through to the login page, which handed the address back to the one browser most likely to be used to check that moving it had worked. An admin who cannot reach the panel goes to the address in Settings → Login URL.
A settings cache that cannot be cleared is reported at error, not warning. A production .env routinely carries LOG_LEVEL=error, so the one message that explains why saved settings keep serving their old values was being filtered out.
Link, border and gradient opacities survive a shortcode round-trip. The container wrote its background opacities and not these, so a container carried through shortcodes came back with a solid border and solid links.

Improved

Paste lands beside what you right-clicked. Paste at Start and Paste at End put the copy at the very top or very bottom of the page; they now go immediately before or after the container, column, nested column or element the menu was opened on, and read Paste Before / Paste After when that is what they will do.
The canvas follows what the Navigator opens. Clicking a node in the Navigator moved the settings panel and left the canvas where it was, so on a long page you were editing something you could not see. It scrolls to the node — only when it is off screen, and never mid-drag.
The drop marker shows where a drag will land. On the canvas it was drawn as a border, which a container's and a column's own inline border width overrode, so dragging either showed nothing at all. In the Navigator it was a border with a 150ms transition on it, so it trailed behind the pointer and nudged the row 2px taller each time. Both are overlays now.

v2.7.3

Released: 2026-09-20

Fixed

Updating from the dashboard could refuse to start, and staying that way was the CMS's own doing. Running falcon:update from a shell — on a Docker host, usually as root — left vendor/falconcms/falconcms owned by root. The site kept serving, because reading is all it needs, and the damage only showed at the next update, whose pre-flight check correctly stopped rather than let Composer half-replace the package. It told you to chown the files, you did, and the next update from the command line undid it again. The command now hands ownership back to the user the site runs as — worked out from the owner of public/index.php, not a guessed name — and only when it is actually running as root.
A page a plugin's menu points at could not be opened by anyone but an administrator. The middleware works out which menu owns the path being requested and checks that menu's permission, but it looked in the menus table alone — and a menu registered with falcon_add_menu_page() is not in it. So the menu appeared in the sidebar, its permission could be ticked in Roles, and opening it still answered 403. Registered menus and their submenus are matched now, and one declared 'public' => true opens for any signed-in user.
Clicking Shop went to Orders instead of Overview. A migration corrected that route in June and the seeder put it back on the next update, because it truncates the menus table and rebuilds it every time — so the fix was undone by every falcon:update for three months.
Two columns were written and silently dropped. Eloquent discards a value for a column outside $fillable without a word. menus.params carries the type=product that is the only thing telling Products → All Products apart from Posts; seeding kept it by accident, so sites looked right while any other code path lost it. cms_forms.lang_code was passed on every form create and saved as nothing.

Changed

Nothing in the public API. This release is corrections to 2.7.2.

v2.7.2

Released: 2026-09-20

For theme and plugin developers

The helper functions and hook tags that still said lazy_ are now falcon_, and the stored settings keyed under the old name have moved with them. Nothing you have written stops working: every old helper name remains as a forward, every renamed hook fires for callbacks registered under either name, and a value saved under an old key is still read. Old [lazy_*] builder shortcodes still render. The new names are what the documentation teaches from here; the old ones are kept for code already in the wild.

Added

A mega menu the theme header builds itself. Customizer → Menu → Mega Menu turns on a per-item checkbox under Appearance → Menus: a top-level item with sub-items can show them as a multi-column panel instead of a dropdown, with a column count up to six and a panel width of full, site, or one you name. Eight item-border styles — a rule under each item, a dashed one, a rule under each column heading, vertical rules between columns, a full table grid, and two that reveal on hover — each with its own colour at rest and on hover. Desktop only, and only for the theme's own header; the Layout builder is unaffected, and with the switch off nothing changes at all.
A custom post type can choose where it sits in the sidebar. ACPT → Post Types → Advanced Configuration → Menu Position lists every menu in the dashboard; the type appears directly below the one you pick and the choice is remembered.
The icon picker offers every icon the dashboard can draw — all 4,237 in the bundled icon font, read out of the font itself so nothing renders as an empty box, with a search box over the whole set.
Forms can be renamed. The builder's heading is the field: click it and type. The shortcode's slug deliberately does not follow, so pages the form is already on keep working.
A child theme inherits its parent's templates. make:theme --child said it did and it did not — a child holding no copy of a template fell through to the default theme rather than to the parent it was made from.
The taxonomy archive bases are settings. /category/… and /tag/… were written into the route file; they are on SEO Settings → Permalinks now, so a site can serve /topics/food without editing the package and losing it on the next update.
The loop can order by published_at, and its paginator keeps the rest of the query string — a reader who searched and then turned the page no longer lands on the unfiltered list.
Renaming a term leaves a redirect behind, the way renaming a page always has. A category slug is an address; editing it used to 404 every link to the old one.
Menus registered by a plugin or theme appear in Users → Roles. falcon_add_menu_page() could put an entry in the sidebar that no administrator could grant to anybody, because the capability existed only in the package's source. They are listed now, under the same groups the sidebar uses. Two keys opt out: 'public' => true for something every signed-in user should reach, and 'show_in_roles' => false for a capability granted elsewhere. A menu registered without a capability gets one of its own rather than borrowing the dashboard's.

Changed

Shop and Products have a sidebar section of their own, headed eCommerce, the way ACPT heads Advanced.
A subscriber holds the Dashboard and its Overview, and nothing else. The role was seeded with manage_users, which drew a Users entry in the sidebar of everyone who had just registered — and every page behind it answered 403. The customer role is narrowed the same way. A role an administrator has edited is left exactly as they set it.
The Post Types and Taxonomies lists use the full width, like Field Groups beside them.

Fixed

One unguarded mega-menu property took the whole header down. Every property but mega_columns was read defensively; a menu row saved before that column existed threw, and the header is on every page, so the site 500'd rather than one menu rendering plainly.
Static page caching could serve one visitor's basket to another. The cache keys a finished page on its URL alone, /cart and /checkout sat inside that route group, and every page's header carries a basket count. Silent, because every response was a valid 200.
Products sits under Shop again, and this time it stays there. A post type's menu position was computed from its database id — 40 + id on three code paths and 60 + id on three others — so a type with the wrong id collided with Shop and the sidebar drew the tie in whichever order the database felt like. Nothing derives a position from an id any more.
Analytics drew an empty chart on Today, its default range: a single day is a single data point, and a line through one point with no markers is nothing at all. Today is plotted by the hour now, in the site's own timezone.
An options page, its menu and its guard now name the same permission.falcon_add_options_page() gave its menu manage_settings while the middleware guarded the page with manage_options_<slug> and the Roles screen listed neither — so a role holding Settings saw the menu and got a 403 from clicking it.
Role grants made under the old permission spelling are carried across. Two rules derived a menu's slug and disagreed about every child menu, so a permission could be granted that nothing ever checked. The migration only ever adds, never removes, and declines the handful of old names that two menus shared rather than guessing which was meant.
A term link follows the configured archive base, instead of the one written into the helper — which, on a site that had changed a base, sent every link the long way round through a redirect.
A menu item pointing at a category points at where that category lives now. The address was stored the day it was added; renaming the category left the menu on the old one.
Two menus may share a name. The slug was built straight from the name, so naming a second menu after an existing one put a duplicate-key stack trace on the screen.
Two forms with the same name no longer share a shortcode. The slug was made from the title without checking for a collision.
Product page scripts survive an out-of-stock product. The inline script bound a handler to an add-to-cart form that is not rendered when a product cannot be bought, and the throw took the description tabs down with it.
Two admin screens misdescribed a custom post type — the field-group location rule listed Post and Pages twice, once hard-coded and once from the table.

v2.7.1

Released: 2026-09-15

Added

A custom post type can choose where it sits in the sidebar. ACPT → Post Types → Advanced Configuration → Menu Position lists every menu in the dashboard; the type appears directly below the one you pick, joining that menu's section. The choice is remembered, so re-saving the type does not quietly send it back to the bottom.
The icon picker offers every icon the dashboard can draw. The Icons tab had 36 hard-coded pictures. It now has all 4,237 icons the bundled icon font can actually render — read out of the font itself, so nothing in the grid can come out as an empty box — with a search box over the whole set. A post type saved with a custom SVG keeps it until someone picks something else.
Forms can be renamed. The name was set once, on the create screen, and there was no way back to it, so a form called "test" stayed that way. The builder's heading is the field now: click it and type, and it saves with the rest of the form. The shortcode's slug deliberately does not follow the name — it is what every [falcon_form slug="…"] already on a page points at, so a rename leaves those pages working.

Changed

Shop and Products have a sidebar section of their own, headed eCommerce, the way ACPT heads Advanced. Selling is a job of its own: a site that sells nothing reads the heading and skips both items.

Fixed

Products sits under Shop again, and this time it stays there. A custom post type kept wedging itself between the two. The position of a post type's menu was computed from its database id — 40 + id on three code paths, 60 + id on three others — so a type with the wrong id landed on the same number as Shop, and the sidebar drew the tie in whichever order the database felt like. Nothing derives a position from an id any more: a menu is inserted after a neighbour that is actually there, which keeps every position unique, and Shop and Products are treated as one block that cannot be opened. Existing sites are repaired on update.
Analytics drew an empty chart on Today. Today is the default range, a single day is a single data point, and a line through one point with no markers is nothing at all — so the Traffic Overview card was blank however busy the site was. Today is plotted by the hour now, midnight to midnight in the site's own timezone, with the hours that have not happened yet left out so the line stops at the current hour instead of dropping to the floor.
Two forms with the same name no longer share a shortcode. The slug was made from the title without checking for a collision, so a second "Contact Form" got the same slug as the first and [falcon_form slug="contact-form"] rendered whichever of the two the query happened to return first.
The post and product editors said nothing when a save was refused. A failed validation redirects back with the reasons in the session, but neither editor printed them: the form came back filled in, nothing was saved, and the only clue was that the page had reloaded. A 150-character SKU went nowhere and said nothing. Both now show the list the page editor already did.
A variable product could not be published at all. The editor demanded a Regular Price for every product, and a variable product hides that field — each variation is priced — so Publish refused and pointed at a control nobody could see. Past that, the insert threw a 500 after the post row had already been written, leaving a product with no shop data priced at zero on the storefront. The parent now takes the cheapest variation's price, which is the figure the archive sorts and filters on, and the sale price follows only a discount on that variation. An empty variable product now says what is missing.
Per-variation weight and dimensions were lost when creating a product. store() dropped what update() kept, so a measurement typed while creating had to be typed again later.
The last shipping zone and the last tax rate could not be deleted. Both are repeaters, and a repeater with nothing left in it posts no fields at all; the save read that as "this form carried no zones" and kept the old ones. They now carry the same marker coupons already had, so an empty list arrives as an empty list.
Media URLs were rewritten relative to the editor's own address, which broke the moment the same content was viewed anywhere else. The editors keep the URLs the library hands them.
A closed coupon took as much height as an open form row — a 40px circle, a badge stacked above an 18px code, six units of air between cards. It is one line of information, so it now takes one line.

v2.7.0

Released: 2026-09-08

Added

Custom column widths. Column and Nested Column → Design → Use Custom Width opens a slider for any width the preset fractions cannot express. The presets and the slider are the same setting, so only one is shown at a time, and going back picks the nearest preset rather than leaving the row with nothing selected. Per device, like the presets — a column can be 1/3 on desktop and 45% on mobile.
A Today range on Analytics, and it is now the default. The question that page is opened to answer is almost always "what is happening now"; a week's total is the wrong shape for it. The other ranges are unchanged and still one click away.
Landing-page menus follow the reader. A menu built from #pricing-style links now marks the item whose section is at the top of the viewport, scrolls smoothly when one is clicked, and stops short of a sticky header instead of leaving the heading underneath it. Both the theme header and the Layout builder's Menu element.
Hover Border and Hover Animation on the Button element. The border gains a hover width per edge and a hover colour, kept directly under the border they change — blank keeps the resting value, and 0 is a real answer. The animation offers Lift Up, Sink Down, Grow, Shrink, Glow and Pulse, and none of them for a reader whose system asks for reduced motion.

Changed

Analytics counts a visitor once a day, and again the next day. Counting distinct addresses across a whole range had fixed one fault and introduced its opposite: someone who came back on ten different days was still one address, so a month looked no busier than a day. Every figure now counts distinct (address, day) pairs, so the cards agree with each other. Over Today it is the same number it always was — which is why this only ever showed on the longer ranges.
Longer ranges will therefore read higher than before on the same data. That is the correction, not a new fault.
New vs Returning is answered across the range. The old query only asked whether an address had been seen before the range began, so a reader who first arrived on Monday and came back every day counted as new all week. Their first day is new, the rest are returns, and the two still add up to the headline.
Active Pages lists every page the people here now have read, not only the page each of them is on at this instant. Each row counts people, so re-reading a page never counts twice.
Alignment on a full-width Button moves its label. A Full Width button already fills its row, so there was nowhere for Alignment to move it and the control looked broken. It now sets the text alignment inside the button. A button sized to its label is still placed within the row exactly as before.

Fixed

Importing layouts failed with a database error on any site that had ever deleted a header or footer. posts is unique on (slug, type, lang_code), but the import matched only slug and type and did so through the soft-delete scope — so a section in the bin was invisible to the check while still holding its key, and the insert was refused. The full key is matched now, a section in the bin is restored and reused, and a section that still cannot be placed is reported and skipped rather than taking the whole import down.
Every custom link in a menu was marked as the current page. An item saved as #pricing has no path of its own, and reading that as / made all of them match on the home page. The theme header and the builder's Menu element also answered the question separately and disagreed with each other; they now share one answer.
The unsaved-changes warning appeared when you pressed Save. Most of the admin saves by calling form.submit() from script, which fires no submit event — so the guard never saw the save and asked Leave site? at the exact moment the work was being written. It still warns when a tab with unsaved edits is closed, which is all it was ever for.
A Button's border could be invisible. Border Color was the only colour field in the panel that hid its opacity, so a border stored at 4% read as #aaa and drew nothing — and the canvas ignored opacity altogether, showing a solid border for one the site would not draw. Section borders had the same fault on the canvas.
Menu hover settings describe the current item too — border and border colour, as text and background already did.
The builder canvas and the site now draw a menu identically. Five properties were computed differently on each side, a cleared number field was handled differently, the canvas link inherited the line-height: 0 the editor puts on every element wrapper, and the editor's own padding and dashed border pushed the menu 5px in from where the site draws it.

v2.6.16

Released: 2026-09-08

Fixed

Changing the navigation font under Typography → Navigation had stopped working. v2.6.15 gave the Menu section its own Navigation Font Size and Font Weight; to have any effect those had to out-specify the typography rule, and doing so silenced it. Both Menu fields are gone again and Typography → Navigation is once more the single place the navigation font is set. Menu keeps what typography does not own: text colour, hover colour, item padding and the dropdown colours.

v2.6.15

Released: 2026-09-08

Fixed

Navigation Font Size and Font Weight work. v2.6.14 removed them instead of repairing them; both are back and applied. (Superseded by v2.6.16, which moved the navigation font to Typography → Navigation for good.)
Dropdown Text Color reaches the mobile menu's sub-items, which were painted a fixed grey.

v2.6.14

Released: 2026-09-08

Fixed

The Customizer's Menu settings did not reach the theme header. Navigation Text Color was emitted only once a Navigation typography had also been saved, so on most sites it had no rule at all; Menu Item Padding could not do anything because the navigation carried a fixed 32px gap; and the mobile menu was painted with hard-coded classes, so every one of these settings stopped at the desktop breakpoint. Defaults are unchanged, so a site that never opened these controls looks the same.
A layout slot switch asks for a state instead of a flip. A double-click, a retried request or a tab opened before the slot changed elsewhere could land on the opposite value — read as "I switched it on, reloaded, and it was off".
Falcon Builder → Sections could fail with Undefined variable $errors, taking the whole page down with a 500.

v2.6.13

Released: 2026-09-07

Fixed

A browser that has signed in before is no longer met by the 404. Since v2.6.7 /admin answers a visitor without a session with a 404, so that guessing the obvious path cannot reveal where the login page was moved to. That is right for a stranger and wrong for the site's own administrator: sessions last hours, work in a builder tab lasts longer, and nothing on the site links back to a login page they may never have written down. A bare 404 at that moment reads as a broken site rather than "sign in again".
A browser that has completed a sign-in here is now sent to the login page instead, with Your session has ended. Please sign in again. It already knows the address, so it learns nothing it did not have; a browser that has never signed in still gets the 404.
The marker is an ordinary Laravel cookie — encrypted and signed with APP_KEY, so it cannot be produced by anyone without the key — and it only changes what an unauthenticated visitor is shown. It never signs anyone in.
On a shared computer it does mean the next person to open /admin reaches the login page. Signing out does not remove it, on purpose: after signing out deliberately, the next visit should still find the way back in.
Three pages sent new installs to the wrong address. The installation guide, the introduction and the home page all still said to visit /admin after installing — which, since v2.6.7, answers 404 and looks exactly like a failed installation. They now name the login URL the installer prints (/falcon-admin on a fresh install).

v2.6.12

Released: 2026-09-06

Fixed

The per-minute graph in the Real-Time panel counted page views. It was the last figure on the analytics page still counting rows, so one person opening four pages inside a minute drew a bar four times too tall — beside a counter that correctly said one visitor.
It counts distinct visitors per minute now, like everything else on the page, and the caption says Visitors per minute rather than Visits.

v2.6.11

Released: 2026-09-06

Changed

Analytics counts people, everywhere. One visitor is one visitor, however many pages they open. That rule now holds across the whole page rather than in the few places it already did.
Visitors, Visitors Today, Visitors This Month, the period-over-period change, Top Pages, Top Referrers, Traffic Channels, Traffic Sources and the Browser / Device / Operating System breakdowns all counted rows — one row per page view — so somebody reading four pages arrived as four. All of them count distinct visitors now, by IP address, which is the basis Unique Visitors always used.
Page views have not been thrown away, because "how much was read" is a real question: the second tile is now Page Views, and the traffic graph still plots page views against visitors. It previously repeated the Unique Visitors figure, which became a duplicate of the headline once that started counting people.
Tiles are named for what they hold — Visitors, Page Views, Visitors Today, Visitors This Month — so no figure claims to be people while counting pages.
Which pages, referrers and sources appear is unchanged. Only the multiplied people are gone.

v2.6.10

Released: 2026-09-06

Fixed

The Real-Time panel put one visitor on every page they had read. It said "1 active user right now" while the table beneath it listed six pages with one user each — the same person, placed on all six at once, reading as six people.
A visitor is in one place at a time, so the panel is now built from one row per visitor: their most recent page view. Each person is counted once, on the page they are actually on, and the headline count and the table are derived from the same rows — so the column always adds up to the number beside the dot. Which pages are listed is unchanged; only the double-counted people are gone.
This completes what v2.6.9 started: that release stopped a page being counted twice for one person, but still listed that person on every page they had passed through.
created_at on analytics rows compared as text, not as a moment, because the model disables timestamps and never cast it. Anything filtering those rows in PHP rather than SQL was comparing strings.

v2.6.9

Released: 2026-09-06

Fixed

Analytics counted one person as many. Every card is fed from one row per page view, and four of them counted rows where they meant people: Visitors by Country, Top Countries, Active Pages, and the Live Visitors list — which showed the latest eight rows, so somebody reading eight pages filled it on their own and read as eight separate visitors from eight places.
Those four now count distinct visitors. Nothing was slightly off: each figure was multiplied by however much each person happened to read, which is precisely the number a site owner uses to judge whether anything is working. Unique Visitors, New vs Returning and the live "active now" count were already right.
Visits stay a count of page views, because that is a different and equally real question — Top Pages, Recent Visits and the traffic graph are unchanged.
A settings change could appear not to save at all. When the shared settings cache cannot be invalidated, the write lands in the database but every later request keeps reading the old value, so the setting silently reverts on the next page load — and starts working an hour later when the cache expires on its own. That failure was being swallowed. It is now logged, naming the usual cause: a cache file left owned by another user, which is what happens the moment anyone runs php artisan as root over SSH on a site that runs as www-data.
If settings seem not to stick, check storage/framework/cache ownership — and prefer running artisan as the web user.
The real-time analytics feed could not run on SQLite, because its per-minute grouping used a MySQL-only date function while the rest of the page had already been written for both.

v2.6.8

Released: 2026-09-06

Fixed

A site with an active plugin returned 500 on every front-end page after updating to v2.6.7. Plugins moved into resources/views/plugins in that release, and a security check that only allows a view under resources/views to render if it sits in themes/ or vendor/ had not been told about the new location — so the first plugin view a page rendered aborted the request mid-layout.
It never showed up in development because that check quietly disables itself on a site with no resources/views/vendor directory: realpath() returns false for a directory that is not there, and PHP compares that false against '', which every path starts with. A site that has published views — which is any site that has been updated — had the check switched on and went down. Plugin views are now allowed explicitly, and the tests around it create that directory so this cannot pass unnoticed again.
Turning a layout slot off did nothing, and came back on after a reload. In Falcon Builder → Sections, the switch for a slot with no section assigned to it reported success and drew itself off, but there was nothing to store, so the next page load showed it on again. The endpoint could not tell "nothing is assigned here" from "it is now off" — both were the same false. It now says which, so the switch stays honest, and a slot that has a section assigned toggles and persists as it always should have.

v2.6.7

Released: 2026-09-06

Security

/admin no longer gives away the login page. The login URL can be moved off a guessable path in Settings, but any anonymous request to /admin was answered with a redirect to wherever it had been moved to — and /admin/login redirected there too. The one address an attacker is guaranteed to try was handing over the one address the setting exists to hide. To a visitor without a session the admin now simply returns 404.
A signed-in administrator sees no change. The trade-off is that a session which expires mid-edit now ends in a 404 rather than the login form, so keep the login URL somewhere you can find it.
The wishlist no longer leaks the admin login URL either. Its "please log in" reply carried route('admin.login') — in JSON, to every anonymous visitor who clicked the heart. Shoppers sign in on the storefront account page, so that is where the wishlist now points, and it passes redirect_to so they come back to their wishlist afterwards instead of being stranded on the account page.

Added

A warning before you lose unsaved work. Close the tab or navigate away with changes you have not saved and the browser asks first. It covers the page builder, where it follows the same state the Save button does, and every admin screen — post, page, product, settings — through the shared layout.
Deliberately quiet: only POST forms count, so typing in a search box never triggers it; only real typing counts, not values scripts set while the page loads; submitting clears it; and rich-text editors are asked directly whether they are dirty, since they type inside their own frame where those events never reach.
Nested columns are edited in place, and closed when you are done. A nested row now draws closed, with the same edit/add panel a container or column carries sitting on it. The pencil opens it; a Finished tick closes it again. While it is open the rest of the canvas dims and stops responding, so a click meant for the nested column cannot land in the section behind it, and no new container or column can be started on top of half finished work. Save arms when you finish, not on every keystroke inside.
Closing puts the editing chrome away, never the design: a row with content in it keeps showing that content, and only an empty one falls back to a placeholder bar. Preview mode ignores all of it and draws the real page.

Fixed

The Card element ignored its Layout setting on the canvas. Grid, List, Masonry and Carousel all render through a stylesheet the element emits, and the builder sanitises the preview HTML before inserting it — which dropped that stylesheet on the floor. Every layout therefore looked identical while the front-end rendered them correctly. The CSS is now lifted out before sanitising and mounted as the preview's own stylesheet, so the canvas changes the moment you switch layout.
The Falcon Slider element showed nothing once a slider was chosen. Same cause, one step further: the live preview is an <iframe>, and the sanitiser removes those outright, so the canvas was left with an empty box. The preview frame is now rendered as a real element rather than passed through as markup.
A menu item that is only an anchor broke the header on PHP 8.1+. #section has no path for parse_url() to return, and the result went straight into ltrim() — a deprecation notice on every page with such an item. Along the way the active-state check learned three things it had never known: the Home item now highlights on the home page, a menu URL written with a trailing slash matches the page it points at, and a link to another site can no longer light up as the current page.

Changed

Plugins live in resources/views/plugins, alongside themes, instead of a plugins/ directory at the project root. php artisan falcon:update moves an existing install across — keeping each plugin's active state, data and migrations — and until it runs the old location keeps working, so updating the package on its own breaks nothing. Nothing at the destination is ever overwritten: a name that already exists there is left alone and reported.

v2.6.6

Released: 2026-09-06

Added

Callout element Pro. The boxed aside that documentation runs on — note, tip, success, warning, danger and four more — in nine variants and six presets, from a plain accent bar to a solid header. It can be made collapsible, and when it is it uses a real <details>: it opens with the keyboard, and a browser's find-in-page opens it to show a match rather than reporting nothing. The body takes the same small markup the Table's cells do, so a callout can hold a bulleted list, `code`, a link or a button, and it holds text rather than HTML, so one can never carry a script.
Table of Contents element Pro. It reads the headings out of the page itself, so nothing has to be listed by hand and nothing goes stale when a section is renamed. Choose which levels to include, five presets, optional numbering, collapse by default, and a sticky mode that follows the reader down the page. The entry for the section being read is highlighted as it scrolls, and can carry its own background colour.
Anchors are built from the heading text, including scripts whose letters carry combining marks — Bengali headings get real anchors rather than a string of dashes.
Previous / Next element Pro. Links to the pages either side of this one, ordered by a navigation menu or by date, with either side overridable by hand. It stays inactive on a page that has no Table of Contents, because "previous" and "next" only mean something inside a sequence a reader is actually following.
A button in a table cell. [button Buy now](/pricing), with :primary, :ghost and :soft variants — the missing half of a pricing or comparison table, which otherwise ends in a row of plain links.
Image Lightbox, in the Image element's General tab. The image opens full size on click, using the Gallery's lightbox rather than a second one. Turning it on puts the Link URL field away, and the page ignores any URL already saved there — an image that quietly went on navigating would look like the lightbox was broken.
Back to Top button, in Customizer → Performance. On by default, with twelve settings: how far down the page it appears, which corner, size, corner radius, three icons, its own colours, an optional reading-progress ring and an option to hide it on phones. Turning it off sends nothing to the page at all — no markup, no stylesheet, no script.
Text Animation, in the Extra tab of the Title, Text Block, Button and Callout. Sixteen looping animations in three groups — motion, emphasis, and light and colour — with the speed, delay, repeat count, easing and accent colour all adjustable, and a default speed per animation rather than one speed for all of them. It is distinct from the Scroll Entrance Animation beside it, which plays once on arrival; the two can be used together.
Drag anywhere in the navigator. The tree lets a node be moved across branches now — an element from one column to another, a column into a different container, an element in or out of a nested column. A drop that would do nothing, or that would put a node inside itself, is refused rather than silently ignored.
Paste wherever the clipboard can land. What a copied node is now decides where it can go, rather than where it happened to be right-clicked. An element copied from a plain column goes into a nested one and back; a container can be pasted onto the bare canvas of a page that has nothing on it yet. The menu says what will land where, or why it cannot.

Changed

Email verification is off on a new install. A fresh install can be logged into straight away instead of waiting on a verification email from a site that has not been given a mail server yet. Turning it on afterwards works as it always did; existing sites are untouched.

Fixed

Letter spacing did nothing, anywhere. A bare number reached the stylesheet as letter-spacing: 2, which is not a length, so the declaration was dropped — the control had never worked on any element, the Table included since v2.6.4. Units for the shared typography controls now live in one place, so line height keeps being unitless while sizes and spacing get their px.
A quotation mark in any text setting truncated it. A caption reading He said "hi" was cut off at the first quote when saved. This was in the shortcode converter itself, so it affected every element with a text field, not one of them.
The Gallery and Image lightboxes did not cover the screen. A position: fixed overlay is only fixed to the viewport while no ancestor has a transform, a filter or a will-change — any of those makes that ancestor the containing block instead. The builder's own entrance animations set one on a wrapper around every animated element, so an image inside one opened into an overlay the size of its own column: the backdrop covered a corner of the page and the picture spilled out of it. Measured on a real page, 593px wide inside a 1200px window.
Maintenance mode did not hide the site. The check for who may still see it asked for a permission that is not a staff signal, and on a site whose subscriber role holds it, that was everyone. It asks whether the visitor is an administrator now, and admins browsing the site are shown a bar telling them maintenance mode is on, so it cannot be left running unnoticed.
The Heading element's settings panel was empty. Both tabs. It now has the content and design settings every other element has, and can be set to full width.
Anchor links now keep the trailing slash, so a link to a section reads /page/#section rather than /page#section. This covers every place a menu is drawn — the builder's Menu element, the navigation widget, and the theme's header, dropdowns and footer.
The Table of Contents entry being read is tracked by position rather than by an intersection band, which highlighted the second heading at the top of a page, never followed a click, and went blank in the middle of a long section. Its sticky mode works now too: it is applied to the column rather than to the element, which cannot travel outside its own box.
Callout lists render the same in the editor and on the page. The admin's stylesheet strips list markers and paragraph margins from everything, so bullets previewed flat and then arrived bulleted. Both renderers now load the same rules.
The Callout's icon is chosen from the icon picker rather than typed in as a class name.

Internal

Eleven new test files, and 147 more tests than v2.6.5 — 718 in all. Among them, the builder's inline script is now parsed by node on every run, and the parts of it that decide where a drag or a paste can land are lifted out and run against a real layout, which is coverage nothing in the suite had before: PHPStan does not read Blade templates, so none of that code was seen by anything until now.

v2.6.5

Released: 2026-09-04

Fixed

The page builder returned a 500 on servers with short_open_tag enabled. The Code Block element added in v2.6.4 ships a sample snippet, and the sample was PHP, so the builder's script file contained the characters that open a PHP tag. Blade compiles a template by running PHP's tokenizer over it, so on a server where a bare <? opens code, everything below that point was handed back as PHP and passed through without being compiled — and the builder died with unexpected identifier "App" before drawing anything. Sites where the setting is off, which includes every development machine we build on, were never affected.
The snippet is now joined at runtime, and the test that has guarded against this since v2.6.3 no longer only reads the templates: it compiles every one of them with the setting on and checks the result parses. That is the check that would have caught this, and it would equally have caught the sitemap fault behind v2.6.3.

v2.6.4

Released: 2026-09-04

Added

Table element Pro. A real table in the page builder, with six presets, per-column alignment and width, an optional header row and header column, a caption, sticky headers and a max height. Readers can sort by clicking a header — numbers and versions sort as values, so 10 does not land before 9, nor v2.10.0 before v2.9.0. On phones a wide table either scrolls or turns each row into a card carrying its column names, because side-scrolling hides the first column, the one that says what the row is about.
Cells take a small markup — `code`, **bold**, *italic*, [text](url), <br> — and [check], [cross] or [icon fas fa-star] for icons, which is what a comparison or pricing table is mostly made of. Cells hold text, never HTML, so one can never carry a script.
Paste a Markdown table and it imports, alignment row and all, along with CSV and a spreadsheet paste, which is the difference between adopting the element and retyping a documentation site by hand. Rows and columns can be picked out with their own colour, and the header and body each take the same typography controls as every other element.
Code Block element Pro. Syntax highlighting for thirteen languages in five colour themes, with line numbers, highlighted lines, a window bar with the file name, word wrap and a max height. A copy button puts the original source on the clipboard rather than the numbered lines beside it, and says so when a browser refuses to copy instead of sitting there looking dead.
Highlighting happens on the server, so a visitor with JavaScript off still gets a coloured, selectable block. Two reveals are available on top of the builder's own entrance animations: a typewriter that types the snippet out character by character, and a line-by-line fade. Both stand aside for prefers-reduced-motion.
Head HTML in Appearance → Customize → Custom Scripts. The two existing script fields take JavaScript and are wrapped in a <script> tag, which left nowhere to put the things a site needs in its head that are not script: a Search Console or Facebook verification <meta>, a <link>, or a loader that arrives as <script src="…"> — which is how Google Tag Manager, Meta Pixel and Lemon Squeezy are all published. Sites had to edit a theme file, and the next update overwrote it.

Fixed

DOMPurify was missing from the package. The builder loads it and guards against its absence, so nothing ever appeared broken — it simply fell back to unguarded innerHTML, which means client-side sanitising in the canvas has never actually run, on any site. The library is now shipped, and reaches existing sites on the next update.
Changing the login or registration URL did nothing on a live site. Both slugs are read while routes are being registered, and a site with cached routes never runs that file — so the setting saved, the new URL returned 404 and the old one carried on working, with nothing to say a cache was in the way. Every production install caches its routes, so this affected all of them. Saving either slug now rebuilds the route cache, and a site without one is left alone.

v2.6.3

Released: 2026-09-04

Fixed

The sitemap returned a 500 on any server with short_open_tag enabled. Blade does not read a template as plain text — it runs token_get_all() over the source and applies its directives only to the inline-HTML tokens that come back. Where short_open_tag is On, PHP's tokenizer treats the <? that opens an XML declaration as the start of PHP code, so the rest of the template was handed back as PHP tokens and written to the compiled view uncompiled. Visitors got a parse error instead of a sitemap. The declaration is now assembled from pieces so those two characters never sit together in the file. The template renders identically either way; only servers with short_open_tag=On were affected, which is why it never appeared in local development.
A guard now scans every Blade template in the package for the same hazard, so no future template can be served uncompiled on those servers.

v2.6.2

Released: 2026-09-03

Fixed

The sitemap returned a 500 for the whole site when it met a post with no timestamps.lastmod was written unconditionally, so updated_at being null ended the response — and with it every URL in the file. Content that arrives through the WordPress importer, a seeder, or a raw insert can have no timestamps at all. lastmod is optional in the sitemap spec, so it is now emitted only when there is a date, falling back to created_at before being left out entirely. Nobody sees this failure while it is happening — it is fetched by search engines, not people — so the site simply stops being crawled.
A post with an empty slug no longer appears in the sitemap. Its <loc> resolved to the site root, so the home page was listed once more for every such row.
The category and tag sections are skipped when a site has removed those archive routes, rather than failing to generate a URL for a route that is not there.
The sitemap query now selects only the columns the file actually uses, instead of hydrating every column of every published post on the site.

v2.6.1

Released: 2026-09-01

Added

Section Separator element. A divider you can drop into any column, with 61 styles in three families: 8 CSS line styles, 15 repeating SVG patterns, and 37 full-width shape dividers (waves, hills, clouds, mountains, grass, arches, aurora and more). Text or an icon can sit on the line, positioned left, centre or right. Shapes take a height, can be flipped horizontally or inverted, and layered shapes carry their own opacities.
Custom SVG shapes. Pick an SVG from the media library and its artwork is inlined on the element, so the separator colour, height and flip reach it. The markup is sanitised on the way in and again on render.
SVG uploads are now a site decision. SVG was refused outright before, even though Customizer -> Performance -> Allowed Upload Formats offered it. It is now governed by that setting, is off unless a site names it explicitly, and whatever is kept has been rewritten through the sanitiser first, so an SVG in the library cannot carry a script, an event handler or a javascript: link. The same rule applies to a backup restore.

Fixed

The builder canvas added height a published page never had. Blade partials that began with a UTF-8 byte-order mark emitted it into the page; a BOM is not whitespace, so each one formed a text line inside the element wrapper. A nested row was pushed about 24px down its column and the column's background showed as a band above it, with every padding set to 0. The mark is gone from 29 templates, and the wrapper is now a flex container so stray whitespace cannot do the same again.
A column's hover effect (Lift, Zoom, Glow, Fade) was applied to the outer box while the card's background, radius and padding live on the inner one. The lift shadow was drawn square around a rounded card, and hovering the empty area beside the card still triggered it.
A nested row carried a 1px transparent border and a flex-basis: 100% that, in a column-direction flex parent, asked it to be as tall as the whole column.

v2.6.0

Released: 2026-08-28

Changed

Requirements are now Laravel 13+ and PHP 8.3+. The package previously declared support for Laravel 10, 11 and 12 and PHP 8.1, but only Laravel 13 was ever exercised by the test suite. The Composer constraints, the CI matrix and the documentation now all state the versions FalconCMS is actually built and tested against. Existing sites on an older Laravel are not broken — Composer simply keeps them on the last release that matched their framework.
The CI test and syntax matrices run on PHP 8.3 and 8.4, and orchestra/testbench is pinned to ^11.0, the release line that targets Laravel 13.

Fixed

Every documentation page rendered a literal %s in its browser title (for example Installation | %s | FalconCMS). The site's titleTemplate used printf syntax instead of VitePress's :title placeholder.

Documentation

The documentation homepage now links into the docs from every feature card, and adds sections covering installation, custom post types, the builder, e-commerce, plugins, the hook API, requirements and a grouped documentation map.
Added a Plugins feature card, a Live Demo call to action, and a card-based "Explore the Documentation" link map.
Added page metadata across the site — canonical URLs, Open Graph and Twitter tags, and SoftwareApplication / WebSite structured data on the homepage.
Enlarged the homepage hero image and reduced the hero heading size.

v2.5.0

Released: 2026-08-28

Added

Column Order field — rearrange a column, or a nested column, visually per breakpoint from the General tab. Desktop, Tablet and Mobile can each have their own order without moving the column in the document, so tab order and screen readers are unaffected.
Full icon library in Menu Item Options — the icon picker for menu items now offers every icon the builder ships (Font Awesome, Bootstrap, Remix, Boxicons, Lucide — ~10,000 icons) instead of a curated subset of about a hundred, with paging so the grid stays fast.

Fixed

The builder canvas could render a menu's text in the wrong font — both a broken Google Fonts request for a custom font, and reading the theme's body font instead of its Navigation font for "Inherit".
Desktop preview in the canvas could be narrower than a real desktop, so content spilled past its own column; the canvas now matches the theme's real desktop breakpoint.
Cart / Search / Wishlist menu items ignored a custom icon chosen for them, and the count badge ignored the Customizer's Primary Color.

v2.4.0

Released: 2026-08-12

Added

Shop archive filters — a sidebar with product search (title, excerpt and SKU), a dual-handle price range slider, categories, attributes, In stock only and On sale. Filtering happens over AJAX and rewrites the address bar, so a filtered view is a real shareable URL and the back button behaves. With JavaScript switched off the panel is a plain GET form and every filter still works.
Attribute filters — whatever attributes your products declare appear in the sidebar automatically, with counts. Each attribute gains a Show in filters switch next to Visible on the product page, so a noisy attribute can be kept out of the sidebar while still showing on the product page.
"Visible on the product page" now does something — ticked attributes appear in the Additional information table. The setting was previously stored but never read.
Weight-based shipping — shipping zones gain a Weight Based (Per Weight Range) calculation type, banded exactly like the quantity rates. Product weights finally feed into the shipping cost.
Customer address book — customers save addresses under My Account → Addresses, with separate defaults for billing and shipping. Checkout is pre-filled server-side, and a picker appears when more than one address is saved.
Upsells and cross-sells — chosen per product in a new Linked Products tab. Upsells show on the product page, cross-sells in the cart. Related products are now drawn from the product's category instead of "the four newest products in the shop".
Product structured data — product pages emit schema.org JSON-LD: Offer for simple products, AggregateOffer for variable ones, plus availability and star ratings. This is what puts price and stock into a Google result.
falcon:reindex-attributes — rebuilds the attribute filter index. Only needed after a bulk import or a direct database edit; ordinary saves keep it current.

Fixed

Cart prices are re-read from the catalogue on every cart, checkout and order. They used to be frozen at the moment an item went in, so an ended sale — or a price the shop owner had since corrected — never reached a basket that already existed.
An expired sale stops applying the moment it ends, rather than whenever falcon:expire-sales next runs. The stored sale price is left untouched, so the figure is still there when the shop owner extends the sale.
Variable products report stock from their variations. Selling the last of every size no longer leaves the product advertising itself as in stock. The In stock only filter follows the same rule, so the badge and the filter cannot disagree.
Variable products show a price range (৳1,500 – ৳2,500) instead of the parent row's 0.00.
The shop grid applies the tax display conversion. With prices entered without tax and displayed with it, a product used to cost one thing on the shop page and another on its own page.
Product type is no longer split across two columns. shop_products.type and .product_type had drifted apart — the editor only wrote one of them — so a product could read as variable on the storefront and simple in the admin. Both are written now and a migration reconciles existing rows.
"Enable tax rates and calculations" could not be ticked from the General tab: the same field was posted twice by one form and the Tax tab's hidden value won.
Unchecking "Show in filters" now sticks. An unchecked box submits nothing, and the stored '0' reads as truthy in JavaScript.
Shop sits directly under Products in the admin menu, and custom post types are numbered above the pair so a new one cannot come between them.
Cart layout: Update cart keeps its place when coupons are switched off, and the cart and checkout buttons share one hover treatment.

Upgrading

Run php artisan migrate after updating. Ten migrations ship with this release; eight only add tables or columns. Two adjust existing rows — the product type reconcile and the admin menu order — and both are reversible. Nothing is demoted: a product that was being treated as variable stays variable.

v2.3.0

Released: 2026-08-05

Added

Content Box element — a repeater element with eight layouts: Classic Icon With Title, Classic Icon On Top, Classic Icon On Side, Classic Icon Boxed, Clean Layout Vertical, Clean Layout Horizontal, Timeline Vertical and Timeline Horizontal. Each box carries its own icon (or image), title, rich content, background and Read More link; the element adds column count, alignment, link type (text or button), link area (the Read More link or the whole box), and full typography, box and timeline-rail styling. Layouts collapse to two columns on tablet and one on mobile.
Four more icon libraries — Bootstrap Icons, Remix Icon, Boxicons and Lucide join Font Awesome, taking the picker from 2,060 to 10,115 icons. They cost nothing until used: the builder fetches a library's icon list and stylesheet only when its tab is opened, and a page loads a library's stylesheet only when that page actually contains one of its icons.
Font Awesome icons are findable by their older names. Font Awesome keeps every previous name working as an alias of the current one, but the picker only listed current names — so searching "ambulance", "trash-alt" or "shopping-cart" found nothing even though the icon was right there. 1,102 alias names are now searchable, read from the shipped stylesheet.
Taxonomy dynamic sources. A new Taxonomy text source prints a post's terms — pick a post type, then one of its taxonomies, with separator, term limit and fallback — and a matching Taxonomy URL link source points an element at the term's archive. The post type and taxonomy must both match, so one template can be reused across post types safely.
Icon Box — Read More typography. The Read More link now has its own font family, size, weight, line height, letter spacing, transform, colour, hover colour, arrow toggle, and controls for its distance from the description and the gap before its arrow.

Fixed

Every font picker in the builder is searchable. Icon Box, Accordion, Tabs, Ticker, Post Meta and every ACPT custom field still used a plain dropdown of ~1,700 fonts; they now use the same searchable picker as the Title element.
Front-end now loads every font the builder can choose. Font collection ran off a hard-coded list of setting keys, so fonts picked for Read More, sub/mobile menus, Post Meta and custom fields were never loaded and silently fell back to the theme font. Detection is now by key name and walks nested layouts, header/footer sections are included, the full 100–900 weight range is requested (Thin and Extra Light used to be missing), and families the bundled catalog doesn't know are dropped — one unknown family made Google reject the whole request, which had been taking every font on the page down with it.
Post Meta no longer 500s a page. Placed directly on a page or post, the element hit an undefined $post and Blade's error handling reported it as "Cannot end a section without first starting one", which pointed nowhere near the cause.
Hover colours are visible in the builder again. Icon Box's Read More hover colour and Breadcrumb's link hover colour rendered on the front-end but looked dead in the canvas, since an inline style can't express :hover.
Element panels always open on their first tab. After working in one element's Design tab, the next element you opened — a duplicate most visibly — also opened on Design.
The icon picker's search box no longer carries over. A query typed for one element used to filter the icon grid of the next element you opened.
Boxes with a background or border get room inside them. Content Box items whose padding was never set sat flush against their own border, with the icon and Read More link crossing it.

v2.2.7

Released: 2026-08-04

Fixed

Pro builder options no longer show as locked on a licensed site. The builder's Pro-edit flag was set only by the page/section builder screen, so the Post Card builder and Mega Menu builder — which share the same builder scripts — read it as missing and locked every Pro element (accordion, tabs, counter, gallery, ticker, breadcrumb, star rating, HTML, card, icon box, icon list, menu, advanced search), dynamic content and global sections even with a valid license. The flag now lives in the shared builder partial, so every builder screen answers from the license.
Card element now fills its column on the front-end. A column's inner box is a column-direction flex container whose default content alignment is flex-start, so the card element was sized to fit-content: the cards collapsed to their text width and the row left dead space on the right — while the builder canvas (which wraps the same markup in a full-width div) looked correct. The card element now stretches to the column like every other layout block, for grid, list, masonry and carousel alike.

v2.2.6

Released: 2026-08-01

Changed

Pro is a one-time, perpetual license. Paid Pro features never expire — a purchase is owned forever. A license's expiry now only limits updates: when the update window ends, the site keeps every Pro feature and simply needs a renewal to pull newer Pro releases. Refunded/disabled licenses still revoke access. The free core (including e-commerce) stays free for everyone, always — licensing never touches it.
The License and Updates pages now show "Update window ended — features stay active, renew for updates" instead of looking locked out, and the Pro update button is gated by the update window rather than by raw license validity.

v2.2.5

Released: 2026-07-31

Added

Icon Box — Read More link. A Read More / Learn More link can now be shown under the description (text + URL), rendered only when set.
Icon Box — Link Mode. Choose what the link applies to: Full Box, Only Icon, or Only Title. Defaults to Full Box, so existing icon boxes are unchanged.

Fixed

Counter animation no longer disappears. The count-up script is now emitted with every Counter and self-dedupes in JavaScript, instead of being gated by a render-once guard that a hidden/earlier render pass (Layout Builder sections, meta/excerpt, nested renders) could consume — which stripped the script from the visible page and left the number static.
Pro update stops cleanly on read-only vendor files. The Pro updater's pre-flight check now also verifies vendor/falconcms/pro is writable, so a containerised install with a root-owned vendor tree aborts up front (with the exact chown fix) instead of letting Composer half-modify composer.json mid-update.

v2.2.4

Released: 2026-07-31

Fixed

Boot-seeder no longer crashes when a storefront page was trashed. The default-content seeder now matches on the full unique key (slug + type + language) and ignores global scopes, so a soft-deleted Shop/Cart/Checkout/Account/Blog page is found (and restored) instead of re-inserted. Previously a trashed shop page made the seeder hit a duplicate-slug constraint on boot — on containerised installs this could crash-loop the app container (502 Bad Gateway). Each create is now wrapped so the seed can never fail the boot.

v2.2.3

Released: 2026-07-31

Added

All Google Fonts everywhere. Typography pickers now list the full Google Fonts catalogue (~1,900 families, grouped by category) instead of a short hand-picked set — in the Customizer and in every Falcon Builder element. Each font shows its own real weights, and fonts load on demand.
Searchable font picker in the Builder. The element font-family control is now a searchable dropdown (like the Customizer), so you can type to find any font.
One shared font source. A single falcon_google_fonts() catalog feeds every typography UI — add a font once and it appears everywhere, no per-place lists to sync.
Title element supports inline HTML. Markup typed into a Title (e.g. <b>, <span style>, <br>) now renders on the canvas and the front-end instead of showing as text.

Changed

Customizer URL simplified — /admin/appearance/customizer is now /admin/customizer.

Fixed

E-commerce is part of the free core (carried from v2.2) — no Pro licence required.

v2.2.2

Released: 2026-07-31

Fixed

Update no longer reports "completed with errors" when the shop pages already exist.falcon:update's e-commerce page creation now matches on the full unique key (slug + type + language) and ignores language scopes, so existing Shop/Cart/Checkout/ Account pages are found instead of re-inserted (which hit a duplicate-slug constraint).

v2.2.1

Released: 2026-07-31

Added

In-dashboard Pro updates. Dashboard → Updates now shows a FalconCMS Pro card alongside the core one: it detects a newer Pro release (via a public version manifest, since Pro is a private package), flags it with a NEW badge in the sidebar, and offers a one-click Update Pro Now button. The update is licence-gated — a valid, in-date subscription is required; an expired licence is prompted to renew instead of updating. On success, Pro's boot-time sync delivers any newly-bundled code and plugins (e.g. Falcon Slider) automatically.

v2.2

Released: 2026-07-30

Changed

E-commerce is now part of the free core. The complete shop system — products, variants, cart, checkout, orders, coupons, reviews and wishlist — no longer requires a Pro license. It works on every FalconCMS site, free forever. (Multi-language, analytics, the advanced builder, custom fields and Falcon Slider remain Pro.)

Added

Falcon Slider — a new Pro plugin: a layer-based, Slider-Revolution-class slider builder. Design slides on a full-screen visual canvas with:
- Layers — text (with SEO h1–h6 tags), image, button, shape, icon, video (self-hosted / YouTube / Vimeo), audio, live countdown, and raw HTML/embed.
- Per-layer timeline animation — 15 entrance/exit presets, text reveals (typewriter / split chars / split words), idle loops (float / bob / pulse / sway / spin), and per-layer delay · duration · easing.
- Backgrounds — colour, gradient, image, background video, colour & gradient overlays, Ken Burns and mouse parallax.
- Responsive — position, size, font-size and visibility per device (desktop / tablet / mobile), plus layer groups and global (every-slide) layers.
- Navigation — arrows, bullets, progress bar, thumbnails, autoplay, loop and pause-on-hover; auto / full-width / full-screen sizing.
- Productivity — pre-built template gallery, save-as-template, duplicate, import / export, version history (auto-snapshot on every save, 20 kept), full-screen live preview of unsaved changes, and whole-slide links.
- Performance — LCP background preload, layout-shift-free reservation, lazy media, and subset font/icon loading for Core Web Vitals.
- Embed with the [falcon_slider id="…"] shortcode or the Falcon Slider Falcon Builder element. Governed by the manage_sliders permission.
See the Falcon Slider documentation.

v2.0

Released: 2026-07-14 · current release v2.1.0

FalconCMS is now open-core. The core stays free and MIT-licensed; a new Pro edition unlocks the commercial features (e-commerce, multi-language, analytics, the advanced page builder, custom fields and advanced login). Existing sites keep working — nothing is taken away — and there is a launch grace window during which every Pro feature stays free. Features a site already used are grandfathered free on that site forever.

Added

Pro License page (Falcon Builder → License). Paste your license key to activate Pro, deactivate to release it, or hit Re-check now to re-validate on the spot. Each key is enforced per site (Pro = 1 site, Agency = unlimited).
One-click Pro install. Paste the access token from your purchase and FalconCMS writes auth.json and installs the falconcms/pro package for you — no terminal needed. Manual Composer instructions remain as a fallback.
In-app updater (Dashboard → Updates). Check for and install the latest release from the browser, with a backup confirmation and a clear progress dialog.
Freemium grace — a single fixed cutoff date (not a rolling per-site window), so the transition happens everywhere at once.

Changed

The "now freemium / upgrade to Pro" banners (admin and cart) disappear once a site holds a valid Pro license.
Renamed the internal version constant to FALCON_CMS_VERSION.

Fixed

Reliable updates & version reporting. The updater installs the exact latest release and reports the installed version correctly — no more "update available" immediately after updating.
Shop product category now shows on the shop listing (some products previously read "Uncategorized"), with the category eager-loaded to avoid N+1 queries.
Clear license messages — invalid key, activation-limit-reached and expired keys now say exactly what's wrong and how to fix it, instead of a generic notice.
Updating core ahead of the Pro package no longer causes a fatal error.

Extensibility update. FalconCMS also gains a full plugin system — the functional counterpart to themes — plus a runtime API for adding admin menus, settings pages and settings fields without writing controllers, routes or views, and a security hardening pass on how settings are saved.

Added — Plugins & extensibility APIs

Plugin system — see Plugins

Drop-in plugins. A plugin is a folder in plugins/ with a plugin.json manifest and an optional plugin.php bootstrap. Free and unrestricted — anyone can write, install and share them.
Plugins admin screen with two sub-pages: Installed Plugins (filter by All / Active / Inactive, search, and Activate / Deactivate / Update / Uninstall from row actions) and Add New (drag-and-drop .zip upload, or install from a direct URL).
Convention-based loading. src/ is PSR-4 autoloaded, routes/web.php is registered, resources/views/ becomes a slug:: namespace, and database/migrations/ runs on activation — no ServiceProvider needed (though one can be declared).
Lifecycle hooks — optional activate(), deactivate(), uninstall() and upgrade($previousVersion) on a class named in the manifest.
Dependencies — declared plugins must be active first, are loaded in dependency order, and can't be deactivated or uninstalled while depended upon.
Update detection — a newer version on disk than the one activated shows Update available; applying it runs new migrations and records the version.
Requirement checks on activation for requires_php and requires_cms.
Fatal-safe loading — a plugin that throws while loading is automatically deactivated and logged instead of taking the site down. A plugin that fails to load is never marked active.
CLI: plugin:list, plugin:activate, plugin:deactivate, and make:plugin "Name" to scaffold one.
manage_plugins permission, assignable to any role.

Admin Menu API — see Admin Menu API

falcon_add_menu_page() / falcon_add_submenu_page() register sidebar items at runtime, merged into the DB-driven sidebar so they survive falcon:update.
falcon_add_options_page() renders a complete settings page — fields, saving and all — from an array. Supports a tabbed layout with deep-linkable ?tab=.
New falcon_admin_menu action for deferred registration.

Settings Fields API — see Settings Fields API

falcon_add_settings_field() injects fields into the existing settings screens — General, SEO, REST API, Integrations and Shop — rendered as native rows and saved by that screen's own Save button.
falcon_add_settings_tab() adds a new top-level tab to the Settings nav, with its own page at /admin/settings/{id}.
18 field types: text, number, email, password, url, textarea, checkbox, select, radio, color, date, range, multiselect (searchable, chip-based), tags, image, file, wysiwyg and repeater.
Shop fields can target a specific Shop settings tab.
New falcon_register_settings action, plus form hooks for the REST API, Integrations and Shop screens.

Changed — Plugins & extensibility

Plugin routes are registered before the frontend catch-all, so plugin URLs resolve instead of falling through to a 404.
Themes and plugins now load at the same point in the boot cycle, giving plugins access to every hook a theme has — including register-time filters.
The dashboard's built-in documentation viewer was removed; the documentation site is the single source of truth.

Security

Protected options. Internal keys — falcon_license_* and falcon_grandfathered_features — can no longer be written through settings saves, injected fields or options pages. Previously a crafted settings request could overwrite the cached license state and unlock Pro features.
URL scheme validation on image and file fields: only http, https and relative paths are rendered, blocking stored javascript: payloads.
Identifier sanitisation — field and tab ids are restricted to A–Z a–z 0–9 _ - before reaching markup or inline scripts.

Fixed — Plugins & extensibility

Shop settings nav highlighted two tabs at once (a static class fought the reactive one).
The Installed Plugins sidebar item no longer stays highlighted while on Add New.

v1.8.3

Released: 2026-07-04

A Layout Builder fix: every layout's every section now toggles fully independently.

Fixed

Layout sections are now independent per layout. Enabling a section (notably Content) in one layout no longer makes it appear active in the Global Layout too. The Layout Builder was falling back to "the first published section" for any slot the Global Layout hadn't explicitly assigned, which made a section enabled elsewhere show up as active on Global. Each slot of each layout now reflects only its own assignment and on/off state — matching what the frontend renders.

v1.8.2

Released: 2026-07-04

A Layout resolution refinement: header, title bar and footer now cascade cleanly from the custom layout down to your defaults, so content is never left without chrome.

Changed

Layout slots now cascade: custom layout → Global Layout → theme default. For content matched by a custom layout, if its Header/Title Bar/Footer is toggled off or left unassigned, the slot now inherits the Global Layout's header/footer for that content. If the Global Layout has nothing selected either, the theme's built-in default renders — everywhere (frontend and the builder canvas preview). This supersedes v1.8.1's "disabled slots render nothing": a slot with no active assignment always falls through to the next level rather than showing blank space.

v1.8.1

Released: 2026-07-04

A builder-experience & polish release: the page/post builder canvas now previews the real header, page title bar and footer around your content, plus fixes for headings in the classic editor and the admin Customizer menu placement.

Added

Live header / title bar / footer preview in the builder — when you design a page, post, CPT or product (not a Layout template), the canvas now shows the actual Header, Page Title Bar and Footer that the applicable Layout assigns to it, rendered through the real theme so it looks like the live page. They're read-only here — hover shows an Edit … Layout Section button that opens that section in the Layout Builder. A slot is previewed only when it's enabled in the layout.

Changed

Rich Editor headings — the Paragraph / Heading 1–6 dropdown is back in the classic editor (it was using a removed TinyMCE 5 control name).
Customizer now lives under Falcon Builder on existing sites too — a migration moves the Customizer menu item out of Appearance and under Falcon Builder (fresh installs already got this); a legacy "Lazy Builder" menu is renamed to Falcon Builder.
Disabled Layout slots render nothing — when the Layout Builder is in use, a header/title-bar/footer that is toggled off or unassigned no longer falls back to the theme's built-in chrome (on the frontend and in the builder preview).

Fixed

Classic-editor headings now use your Customizer heading sizes instead of shrinking to paragraph size (Tailwind's preflight was overriding bare h1–h6; the page builder was already unaffected).
Hairline gap between the page content and a full-width footer (a 1px sub-pixel seam showing the body background) is gone.
Fixed an infinite recursion that could return a 500 when a page is rendered as its own content (e.g. the Home page inside its assigned footer).

v1.8.0

Released: 2026-07-03

A major builder release: a dedicated Layout Builder for site-wide templates, a new Bread Crumb element, dynamic image backgrounds for containers and columns, and a far more consistent Site Width / Full Width system.

Added

Layout Builder — design site-wide Header, Footer, Page Title Bar and Content templates in the Falcon Builder and assign them globally or by condition. Includes an in-card layout picker, a conditions modal (target a custom layout to specific pages, post types or archives), a per-layout enable/disable toggle (AJAX), and Export / Import of layouts.
Custom 404 page — build your own "Not Found" page in the Layout Builder; the theme renders it automatically.
Bread Crumb element — a new builder element that outputs the current page's breadcrumb trail (Home → post type / category → current page), with full typography, colour, separator and alignment controls, plus Schema.org BreadcrumbList structured data for SEO.
Dynamic image backgrounds — containers, columns and nested columns can now use a dynamic source (Feature Image, Author Avatar or Site Logo) as their Background Image, resolved per-post on the frontend. It layers correctly beneath a Background Gradient, and the builder canvas previews it too.

Changed

Consistent Site Width / Full Width — a container set to Site Width now always constrains to your Customizer Site Width (centered), independent of the Customizer's Boxed/Wide layout, and matches the builder canvas exactly. Full Width containers always span edge-to-edge.
Customizer moved under Falcon Builder — Appearance → Customize now lives in the Falcon Builder menu; the sidebar's "Lazy Builder" was renamed to Falcon Builder with corrected submenu links, and the standalone Header/Footer builder entries were removed (they live in the Layout Builder now).
Product sorting on the shop and product archives only appears when products actually exist.
Hardened ACPT import/export — re-imports are idempotent, taxonomy terms keep their cpt_slug, and post export is more complete.

Fixed

The Post Content element set to Full content no longer breaks plain/classic content out to the viewport edge — it now respects its parent container's width (it still full-bleeds when the content is itself a builder layout with self-boxing sections).
Dynamic backgrounds render inline (no lazy-load dependency) so they paint reliably; the builder canvas shows a neutral "Feature Image" placeholder when editing a template that has no specific post, instead of an unrelated image.

v1.7.4

Released: 2026-06-30

A portability & accounts release: import/export for forms and builder-library items, an email-verification toggle, and a much smarter media backup/restore. Now officially runs on Laravel 13 as well.

Added

Form import/export — every form can be exported to a portable .json file (structure + settings) and imported on any FalconCMS site as a new form, straight from the Forms list
Post Card & Mega Menu import/export — builder-library items export to .json and import back as new items (with fresh IDs), so designs move easily between sites
"Require email verification" toggle — Settings → Membership now lets the site owner choose whether new users must verify their email before signing in, or are logged in immediately after registering

Changed

Smarter media backup & restore — a media-only backup now bundles the Media Library records too, so restoring brings the library entries back (not just the files); restore also auto-detects and strips a wrapper folder (e.g. when a downloaded backup was unzipped and re-zipped), and preserves the full Year/Month folder structure
Deleting a media item now removes its generated size variants too (e.g. image-300x200.jpg), matching WordPress — files that are tracked as their own media item are left alone
Honest registration feedback — if the verification email can't be sent, registration now says so plainly instead of falsely claiming a link was sent
Laravel 13 support — added to the documented requirements (Laravel 10, 11, 12, or 13)

Fixed

Media-only restore now places files at their correct paths (including the media/ sub-folder) instead of flattening them

v1.7.3

Released: 2026-06-30

A tooling & migration release: a new Export/Import pair, one-click Clone for every content type, a smarter Backup tool, plus several builder, security and migration fixes.

Added

Tools → Export — a feature-driven export screen: it lists every registered post type, taxonomy and the media library automatically (so future exportable features appear on their own) and downloads a WordPress-compatible .xml (WXR) file. Pick All content or a single source
Tools → Import — the counterpart to Export: upload an export .xml and it restores posts, pages, custom post types and taxonomy terms (also accepts standard WordPress WXR files)
Clone for posts, pages, products & CPTs — every list row now has a Clone action (next to View) that duplicates the item — and its taxonomies, custom fields and (for products) shop data, variations & downloads — into a fresh draft
Duplicate menu — the menu editor gains a Duplicate Menu action that copies a navigation menu with its full item hierarchy (the copy is never auto-assigned as header/footer)

Changed

Backup tool reworked — one Create Backup button with three choices: Only Database, Only Media, or Database + Media (a single archive carrying both). Restore is now content-aware — it detects from the file itself whether to restore the database, the media, or both, so a whole site can be moved to another install with one file. Uploaded backups are detected the same way
Live gallery hover effect on the canvas — the Gallery element's Zoom hover now previews in the builder, matching the front end
Column / nested-column hover effects now work on the front end — Zoom / Lift / Glow / Fade hover types rendered only in the builder before; they now render on the published page too
Buttons without a link render cleanly — a Button with an empty Link URL no longer outputs an empty <a> tag or a pointer cursor; any value (including #) makes it a real link again
Clearer import results — re-importing items that already exist now reports them as skipped (including taxonomy terms) with an explanatory note, instead of showing all zeros

Fixed

Stored-XSS hardening — classic (non-builder) post/page content is now sanitised on output (scripts, on* handlers and javascript: URLs are stripped), closing a gap that affected imported HTML content
Menu save error — saving a menu no longer fails with Unknown column mega_menu_id; the relevant migration now runs, and several migrations were made idempotent (guarded with hasTable/hasColumn) so php artisan migrate runs cleanly on fresh, partially-migrated or already-migrated installs — without any data loss
Menu selector — choosing a menu from the dropdown no longer auto-opens it; the Select button is the trigger
Nested-row layout consistency on the builder canvas

v1.7.2

Released: 2026-06-27

A builder polish & tooling release: every Font Awesome free icon in the icon pickers, a media-files backup option, plus several nested-layout and colour-picker fixes that make the builder canvas match the front end.

Added

Media files backup — Tools → Backup now has a Backup Media Files button that zips everything under storage/app/public (uploads, generated images, etc.) into a downloadable archive, and restores media archives back into place. Database snapshots are unchanged
Every Font Awesome free icon in the builder — the icon pickers (Icon Box, Button icon, Icon List and custom icon fields) now list the full Font Awesome 6 free set — 2,060 icons across Solid, Regular and Brands (up from a few hundred). A search box reaches any icon, with the grid capped for snappy scrolling

Changed

Icon Box font size accepts any CSS unit — the Title and Description Font Size fields lost their px/rem dropdown and now take a free-form value (px, rem, em, %, vw, vh, calc()), matching the Title element
Nested-column Border & Box-Shadow colour pickers unified — they now use the same round-swatch + editable hex design as every other picker, show the opacity-aware #RRGGBBAA code, and the colour renders with its opacity on canvas and front end (responsive per-device)

Fixed

Nested rows match the front end on the canvas — a nested row no longer shows a permanent whitish box; it renders transparent (like a normal element) and reveals its outline + ROW badge only on hover, with no extra padding gap between the row and its parent
No more phantom vertical gap inside nested columns — columns with default alignment no longer stretch their inner content to a taller sibling's height in the builder, so spacing inside nested columns now looks exactly like the published page

v1.7.1

Released: 2026-06-26

Changed

Analytics "Page" column shows the site domain for homepage visits — homepage hits (including bots that reach the site by raw IP) now display the configured site domain (e.g. demo.example.com) instead of a bare /. Other pages still show their request path

v1.7.0

Released: 2026-06-26

A builder & design-tooling release: one unified colour picker everywhere, responsive background hover colours, full CSS-unit support for font sizes, plus several builder and analytics fixes.

Added

Background Hover Color for Containers, Columns & Nested Columns — a new responsive hover colour (separate desktop / tablet / mobile values). It previews live on hover in the builder canvas and renders as a real :hover rule (with media queries) on the front end
Custom Text Color for Buttons — when Button Style → Custom is selected, a dedicated text-colour picker sits with the gradient colours; the default style keeps its own text colour

Changed

One unified colour picker across the whole CMS — the main builder, the mega-menu & post-card builders, the Theme Customizer and the Form builder now share a single clean picker: a round swatch, an editable hex field, and a compact popup (saturation square + hue + alpha sliders) with the alpha bar tinted to the current colour. The Form-builder picker also gained an opacity slider
Opacity-aware colour fields — fields that store opacity separately now show the full 8-digit #RRGGBBAA code, and the alpha slider opens at the correct position
CSS units for every font size — all typography / font-size inputs across builder elements (and inside header / footer / nested layouts) now accept px, rem, em, %, vw, vh and calc(). Values apply on both the canvas and the front end and survive the shortcode round-trip
Title element typography now mirrors the Text Block (font family, weight, size, line-height, letter-spacing, transform) for a consistent editing experience

Fixed

Column / nested-column background colour ignored responsive values — tablet/mobile background colours were rendered with the desktop value on both the canvas and the front end; per-device colours are now honoured
A per-device colour was discarded when switching device — picking a tablet/mobile colour and then toggling the device preview reverted it; the colour is now committed instead of reverted
Analytics "Page" column showed the raw server IP — visitors who reached the site directly by IP (bots/scanners) appeared as https://<ip>; the column now shows a clean request path
Documentation clarifies that MySQL / MariaDB are the only fully supported databases (SQLite is partial and not recommended; PostgreSQL / SQL Server are unsupported)

v1.6.3

Released: 2026-06-25

Fixed

Reinstalling over an existing database failed with "table already exists" — Running falcon:install (or falcon:update) on top of a database that still had some tables — after falcon:uninstall-db, or when installing onto an existing Laravel app whose users / cache / jobs tables remained — made migrate try to recreate them and abort. The commands now reconcile first: any migration whose created tables already exist is recorded as run, so migrate skips it and only creates what is genuinely missing. This works for both the app's own and the package's migrations, without editing any migration file

v1.6.2

Released: 2026-06-24

Fixed

Uninstall could leave a broken User model — falcon:uninstall removed the HasCmsPermissions import but only stripped a standalone use HasCmsPermissions; line. When the trait was declared in a combined list (e.g. use HasFactory, Notifiable, HasCmsPermissions;), the reference was left without its import, crashing the app — and any later reinstall's migrations — with "Trait App\Models\HasCmsPermissions not found". The revert now also removes the trait from a combined use list (verified valid for leading/middle/trailing positions)

v1.6.1

Released: 2026-06-24

Fixed

Dashboard showed a stale "Installed Version" — After updating, the dashboard kept showing an old installed version (e.g. v1.4.2) even though the new code was in place. The version check preferred Composer's reported version, which can be a pinned alias (notably on path-repository installs) and lags behind. It now reads the version from the package's version.json first (bumped on every release), so the dashboard reflects the version actually installed

v1.6.0

Released: 2026-06-24

A consolidation milestone that brings together everything shipped across the 1.5.x line.

Highlights

Dashboard — Redesigned e-commerce KPI cards with month-over-month trend deltas; Top Selling Products, Low Stock and Recent Orders widgets; and an interactive Orders by Country world map (zoom, pan and per-country hover). The whole e-commerce section is now gated behind the access_shop permission
Analytics — A Visitors by Country world map, a named Traffic Sources breakdown (Google, Facebook, Instagram, YouTube, … Direct, and other sites), and hover tooltips on the real-time active-users sparkline
Shop — The Conversion Funnel (visitors → product → cart → checkout → orders) now lives on the Shop Overview
Security & reliability — Internal AJAX fragment endpoints redirect on direct visits instead of leaking raw JSON; reliable geolocation via the shared falcon_geoip() helper; a richer IP blacklist (location, ISP, first/last seen)
Lifecycle — New falcon:uninstall (full, leaves the app booting cleanly) and falcon:uninstall-db (database-only) commands, plus idempotent core migrations so a reinstall always succeeds

For the granular history of these changes, see the 1.5.x entries below.

v1.5.10

Released: 2026-06-24

Fixed

App crashed after a database reset — The redirect middleware queried cms_redirects on every request and returned a 500 ("Base table or view not found") once the tables were dropped (e.g. after falcon:uninstall-db). It now checks the table exists first and degrades gracefully when it doesn't
Reinstall failed with "table already exists" — Uninstall keeps the shared Laravel tables (users, sessions, cache, jobs) but clears the migration records, so re-running falcon:install / migrate tried to recreate them and failed with "Table 'users' already exists". The bundled users / cache / jobs migrations are now idempotent (Schema::hasTable guards), so a reinstall succeeds no matter which tables remain

v1.5.9

Released: 2026-06-24

Fixed

Uninstall left a stale provider cache — falcon:uninstall removes the package with composer remove --no-scripts, which doesn't regenerate Laravel's package-discovery cache. bootstrap/cache/packages.php / services.php therefore still referenced FalconCmsServiceProvider, so the app booted with "Class FalconCms\Core\FalconCmsServiceProvider not found". The command now clears those bootstrap caches as its final step. (If you hit this after a manual composer remove, delete bootstrap/cache/packages.php and bootstrap/cache/services.php, then run composer dump-autoload.)

v1.5.8

Released: 2026-06-24

Fixed

Uninstall left a broken User model — The earlier uninstall dropped tables and files but did not remove the HasCmsPermissions trait the installer added to App\Models\User, so after composer remove the app crashed with "Trait FalconCms\Core\Traits\HasCmsPermissions not found". The full uninstall now reverts that automatically

Added

falcon:uninstall — full removal (no leftovers) — Reverts the trait/import added to App\Models\User, drops tables + migration records, removes published files, and runs composer remove falconcms/falconcms — leaving the app booting cleanly. Options: --all (also drop shared Laravel tables), --force, --keep-files, --no-composer
falcon:uninstall-db — database-only removal — Drops just the FalconCMS tables (and migration records); the package code, files and User model trait stay in place (e.g. to wipe data and re-migrate). Options: --all, --force

v1.5.7

Released: 2026-06-24

Added

falcon:uninstall command — Cleanly removes FalconCMS: drops its database tables, deletes its rows from the migrations table (so a later reinstall re-runs cleanly), and removes published views, themes and assets. Shared Laravel tables (users, sessions, cache, jobs, …) are kept by default to avoid breaking the host app; --all drops them too for a full wipe. Options: --force (skip the confirmation), --all, --keep-files. Finish with composer remove falconcms/falconcms

v1.5.6

Released: 2026-06-24

Fixed

IP Blacklist — country always "Unknown" — Blocked IPs were geo-resolved with file_get_contents, which is disabled or blocked on many production hosts, so the country never resolved. A new shared falcon_geoip() helper now uses the Laravel HTTP client (with a timeout, cached 30 days); existing "Unknown" rows are backfilled when the blacklist page is viewed

Added

IP Blacklist — richer detail — The blacklist table now shows Location (country + city/region), ISP / network, and both First Blocked and Last Attempt times, with an attempts badge. New blocks capture city, region and ISP

Changed

Geo lookups unified — Visit tracking and the IP blacklist now share the same cached falcon_geoip() helper instead of separate, less reliable lookups

v1.5.5

Released: 2026-06-24

Security

AJAX fragment endpoints no longer expose raw output on direct visit — GET /cart/fragment (mini-cart) and GET /search/live are internal AJAX-only endpoints; opening them directly in a browser previously returned their raw JSON. Non-AJAX (direct navigation) requests are now redirected to the cart and search pages respectively, so the raw payloads are never shown. JS-driven calls (which send X-Requested-With) are unaffected, and only ever returned the visitor's own session data anyway

v1.5.4

Released: 2026-06-24

Added

Dashboard — Orders by Country map — An interactive world map highlighting the countries orders came from (shaded by volume), with zoom buttons, mouse-wheel zoom, drag-to-pan and per-country hover (country name + order count), plus a top-countries list. Country values are normalized to ISO-2 from mixed order data
Dashboard — Top Selling Products, Low Stock & Recent Orders — The redundant "Quick Stats" panel is replaced by a best-sellers list (units sold + revenue) and a low-stock alert list; a Recent Orders table now fills the space under the revenue chart
Analytics — Visitors by Country map — The same interactive world map for geo-located visits
Analytics — Traffic Sources — A named-source breakdown (Google, Bing, Facebook, Instagram, YouTube, X, LinkedIn, TikTok, … Direct, and any other site by domain) with visit counts, percentages and favicons
Analytics — Real-time sparkline tooltip — Hovering the real-time active-users bars now shows the visitor count for that minute

Changed

Dashboard — E-commerce KPI cards redesigned — Accent strip, soft-tint icon, month-over-month trend delta (↑/↓ %) and a contextual subtext per card
Dashboard — Shop section permission-gated — The whole e-commerce section (revenue, orders, customer names) now requires the access_shop permission (admins bypass), so it is no longer shown to every dashboard-accessing role
Shop → Overview — Conversion Funnel — The conversion funnel (visitors → product → cart → checkout → orders) and conversion rate now live on the Shop Overview, moved from Analytics to keep shop metrics together

v1.5.3

Released: 2026-06-23

Fixed

Registration — default role ignored — Self-registration now assigns the role configured in Settings → New User Default Role instead of always using subscriber. Selecting a different role (e.g. Editor, Author) now correctly applies it to newly registered users; if the configured role is missing it safely falls back to subscriber

v1.5.2

Released: 2026-06-23

Changed

Device limit — simpler on/off model — The multi-device setting is now a clear cap. Unchecked = unlimited devices; checked = limit concurrent logins to Max devices allowed. The -1 "unlimited" sentinel has been removed — the field is a plain positive number again (minimum 1), and the checkbox/help text now reflect the inverted meaning

v1.5.1

Released: 2026-06-23

Fixed

Multi-device login — unlimited (-1) — Setting Max devices allowed to -1 now correctly means unlimited concurrent sessions and never blocks sign-in. Previously the limit check (active sessions ≥ -1) was always true, so logging in from a second device failed with "Login denied: Only one active session is allowed per account." The -1 sentinel now applies regardless of the multi-device toggle; normal numeric limits and the single-session default are unchanged

Changed

Settings — Max devices allowed — The field now accepts -1 (minimum lowered from 1) with a helper note that -1 means unlimited devices

v1.5.0

Released: 2026-06-22

Fixed

Registration — duplicate username — Usernames derived from the email local part are now sanitized and made unique (john@a.com and john@b.com no longer collide → john, john1…), fixing the duplicate-username error on sign-up
Admin user create/edit — Validation errors are now displayed (a top summary plus per-field messages) instead of a database constraint crash; inputs repopulate on failure, and a success message is shown
User update redirect — Saving a user now returns to the same edit page with the success notice, instead of jumping to the user list

Added

Password strength & match — The admin user create/edit password fields now show a live strength meter and a password-match indicator, matching the registration page

v1.4.9

Released: 2026-06-22

Added

Analytics — major overhaul — Bot/crawler filtering, geo location (country/city with flags), real-time active users with a 30-minute sparkline and live tables, sessions, bounce rate, new vs returning visitors, traffic channels, e-commerce conversion KPIs and a visit→cart→checkout→order funnel, plus donut charts for channels, returning visitors and top countries
Analytics — data retention — New falcon:prune-analytics command with a daily schedule and a cron-independent fallback, with a configurable retention window

Fixed

Footer logo — The default footer logo now uses the white brand logo (the dark logo was invisible on the dark footer) at a larger size, automatically darkened on light footer backgrounds; a custom uploaded logo is always shown as-is

v1.4.8

Released: 2026-06-22

Added

Registration — email verification — New sign-ups are no longer logged in immediately; a time-limited (5-minute) signed verification link is emailed instead, and sign-in is blocked until the address is verified. Includes a notice page and a throttled resend flow. A migration marks all existing users as verified so no one is locked out

Fixed

Order status emails — Customers are now emailed on every order status change (pending, on-hold, processing, completed, delivered, cancelled, refunded, partially-refunded, failed), not just on delivery — for both single and bulk updates

Changed

Product Meta element — Now available only in post-card mode, like Post Meta and Content

v1.4.7

Released: 2026-06-21

Added

Builder — Product Meta element — A new element that displays a product's price (with sale), SKU, availability, stock quantity and type; each field toggleable, with stacked/inline layout, alignment, labels and full design controls
Builder — Ticker — Configurable item spacing, a duplicate-item button, and live scrolling in the builder canvas
Dynamic sources — Product group — Bind any text field to live product data (price, regular/sale price, SKU, stock status, stock quantity); dynamic fields now show a live preview right in the builder using the real value of the post being edited

v1.4.6

Released: 2026-06-21

Fixed

falcon:update — stale published view overrides — Update now removes the entire published resources/views/vendor/falcon-cms directory, not just the admin subfolder. A leftover published copy of a namespaced package view (e.g. frontend/builder/column.blade.php) silently shadows the real vendor view, so layout fixes never appear on the site no matter how many caches are cleared. Clearing the whole override namespace guarantees the package's own views are always used

v1.4.5

Released: 2026-06-21

Fixed

Dashboard Update — stale frontend after update — The dashboard "Update" now resets the php-fpm OPcache from the web request itself. Previously the falcon:update subprocess ran under CLI php, whose opcache_reset() only clears the CLI OPcache — the php-fpm workers that serve frontend pages kept executing the old compiled Blade views, so builder/layout fixes did not appear on the live site until a manual container restart
Dashboard footer — Default admin footer credit changed to "Theme developed by Falcon CMS"

Changed

Taxonomy screens — Removed the non-functional "Screen Options" and "Help" buttons from the top-right of all taxonomy list pages (Categories, Tags, Product Categories, Product Tags, and custom ACPT taxonomy terms)

v1.4.4

Released: 2026-06-21

Fixed

Dashboard Update — php-fpm binary — The dashboard "Update" button ran falcon:update with PHP_BINARY, which in a web (php-fpm) request points at the php-fpm executable and cannot run artisan (it printed FastCGI usage and aborted, so migrations/cache-clear/OPcache reset never ran). The updater now locates a real CLI php binary, checking absolute paths first since the php-fpm worker often runs with a stripped PATH

v1.4.3

Released: 2026-06-21

Fixed

Page Builder — Preview mode blank canvas — Toggling the builder's eye-icon Preview no longer blanks the whole canvas. In preview the canvas kept grid-area: auto, which auto-placed it into the now-hidden sidebar's 0-width grid column; it is now pinned to its named canvas area so the design stays visible

v1.4.2

Released: 2026-06-21

Fixed

Page Builder — Row content layout — Elements inside a column with Content Layout set to "Row" now stay side-by-side and never wrap to the next line (flex-wrap: nowrap); previously flex-wrap: wrap caused elements to stack when they did not fit
falcon:update — OPcache — OPcache is now reset after cache clearing so freshly compiled Blade views are served immediately without requiring a server restart

v1.4.1

Released: 2026-06-21

Fixed

Multi-device login — -1 value for Max Devices now correctly means unlimited; previously count() >= -1 was always true, blocking all logins even when unlimited was intended
Page Builder — Nested Column row layout — Elements inside a column with Content Layout set to "Row" now render side-by-side on the frontend; previously width: 100% on element wrappers caused items to stack vertically despite flex-direction: row

v1.4.0

Released: 2026-06-20

Added

Demo mode — Login page — Demo credentials box displayed above login form when APP_DEMO=true
Demo mode — User management — All fields on user create and user edit pages disabled with warning banner when APP_DEMO=true
Demo mode — Settings — register_url and login_url inputs disabled with warning banner when APP_DEMO=true
Docs — Demo page — Live demo request page with lead capture form; credentials sent to visitor's email via EmailJS after form submission

Fixed

Footer logo — Default FalconCMS logo always shown in footer column 1; embedded as base64 to remove file dependency; theme_footer_logo / theme_site_logo cleared from DB on falcon:update so stale overrides are never applied
falcon:update — Published admin views deleted on update so vendor views are always served fresh (no stale published copies)

v1.3.18

Released: 2026-06-20

Added

Customizer — Performance — "Clear All Cache" button for one-click cache clearing from the admin

Fixed

Product editor — Added x-cloak to product data metabox to prevent Alpine.js FOUC on page load
falcon:update — Admin views automatically re-published during update to keep published copies in sync
Sale end date — sale_ends_at datetime input minimum set using client-side local time instead of server UTC
Product archive — productCategories relation used in archive-product.blade.php; eager loaded on CPT archive queries to prevent N+1
Sale end date validation — Removed after:now rule causing false rejections in some timezones
PHP_BINARY — Correctly resolved to CLI php in web (php-fpm) context
Product categories — Category label display corrected on product cards and single product pages
Shop — Tab active-state bug fixed; hold_stock order cancellation implemented
Page Builder — Fixed offset constants in parseColumnsFromContent()
Hooks & helpers — Remaining lazy_ class and helper references renamed to falcon_

v1.0.0

Released: 2026-06-15

Initial public release of FalconCMS — a powerful Laravel CMS package with page builder, e-commerce, and a WordPress-like admin dashboard.

Core

WordPress-like Admin Dashboard — Sidebar navigation, top bar, role-based permissions, activity logs
Page Builder (Falcon Builder) — Drag-and-drop visual editor with rows, columns, and element blocks
Post & Page Management — Custom post types, categories, tags, featured images, SEO fields
Media Library — Upload, manage, and select images/files across the admin
User & Role Management — Granular permission system with custom roles
Multi-language Support — Built-in language management
Theme System — Installable themes with Customizer support (header, footer, colors, typography)
Hook Architecture — WordPress-style add_lazy_action / add_lazy_filter for extensibility
Custom Options Pages — Register custom settings pages via config

E-Commerce (Shop)

Product Management — Simple and variable products, SKU, stock, sale price with scheduled expiry (sale_ends_at)
Digital / Downloadable Products — Attach files from the media library; secure token-based download links with expiry and download count limits
Orders — Full order lifecycle (pending → processing → shipped → completed), order notes, status history
Cart & Checkout — AJAX cart, coupon codes, shipping zones, tax rules
Payments — Cash on Delivery, Stripe, SSLCommerz integrations
Customer Account — Order history, downloads tab, address management
Sales Reports — Revenue by period (daily/weekly/monthly), top products, customer LTV, CSV export
Shop Settings — Currency, inventory, email notifications, shipping, tax, coupon management

Admin UI

URL-aware Settings Tabs — Tab switches update the browser URL via history.replaceState
Sidebar Collapse — "Collapse Menu" button; icon-only mode persisted in localStorage with no flash on navigation
FalconCMS Branding — FCM logo in admin top bar

Security

HTTP Security Headers — X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, CSP, HSTS
Rate Limiting — Login, forgot-password, comments, cart operations, file downloads
CSRF Protection — All state-changing routes protected
Input Validation — Cart quantities, file uploads, comment length, user enumeration prevention
Secure Downloads — Token-based file delivery; tokens expire and have per-user download limits

Developer Tools

Artisan Commands — lazy:expire-sales (scheduled sale price cleanup)
REST API — Configurable API key authentication
Backup & Snapshots — Database and file backup tools
WordPress Import — Import posts from a WordPress XML export
Analytics Dashboard — Basic traffic and content stats
Maintenance Mode — Toggle from Customizer with custom message and countdown timer

Changelog ​

v2.9.2 Latest ​

Fixed ​

Security ​

Changed ​

In Pro v1.5.7 ​

v2.9.1 ​

Added ​

Changed ​

v2.9.0 ​

Added ​

Changed ​

Fixed ​

v2.8.19 ​

Fixed ​

v2.8.18 ​

Added ​

Fixed ​

v2.8.16 ​

Added ​

Changed ​

v2.8.15 ​

Added ​

Fixed ​

Security ​

v2.8.14 ​

Fixed ​

v2.8.13 ​

Changed ​

Fixed ​

v2.8.12 ​

Added ​

Fixed ​

Updating ​

v2.8.11 ​

Changed ​

v2.8.10 ​

Fixed ​

v2.8.9 ​

Added ​

Changed ​

Fixed ​

v2.8.8 ​

Added ​

Changed ​

Fixed ​

Security ​

v2.8.7 ​

Added ​

Fixed ​

v2.8.6 ​

Security ​

Added ​

Changed ​

Pro: Falcon Security 1.1 ​

v2.8.5 ​

Security ​

Added ​

Fixed ​

Pro: Falcon News and Falcon Security ​

v2.8.4 ​

Fixed ​

Changed ​

Documentation ​

v2.8.3 ​

Added ​

Changed ​

Fixed ​

v2.8.2 ​

Added ​

Fixed ​

v2.8.1 ​

Added ​

Fixed ​

For developers ​

v2.8.0 ​

Added ​

Fixed ​

For developers ​

v2.7.11 ​

Changelog

v2.9.2 Latest

Fixed

Security

Changed

In Pro v1.5.7

v2.9.1

Added

Changed

v2.9.0

Added

Changed

Fixed

v2.8.19

Fixed

v2.8.18

Added

Fixed

v2.8.16

Added

Changed

v2.8.15

Added

Fixed

Security

v2.8.14

Fixed

v2.8.13

Changed

Fixed

v2.8.12

Added

Fixed

Updating

v2.8.11

Changed

v2.8.10

Fixed

v2.8.9

Added

Changed

Fixed

v2.8.8

Added

Changed

Fixed

Security

v2.8.7

Added

Fixed

v2.8.6

Security

Added

Changed

Pro: Falcon Security 1.1

v2.8.5

Security

Added

Fixed

Pro: Falcon News and Falcon Security

v2.8.4

Fixed

Changed

Documentation

v2.8.3

Added

Changed

Fixed

v2.8.2

Added

Fixed

v2.8.1

Added

Fixed

For developers

v2.8.0

Added

Fixed

For developers

v2.7.11