FastoPop

FastoPop is a free popup and site toolkit purpose-built for high-risk merchants (adult, gambling, CBD, vape, nutra, crypto). It includes a popup engine with multiple trigger types, sticky top and bottom bars, traffic source targeting, A/B testing, an age verification gate, a template library (including a chargeback prevention template), and lead capture with optional HubSpot forwarding. Sticky bars Any standard popup can be shown as a modal, a top bar or a bottom bar. Bars are full-width strips that stay put while visitors scroll, with no backdrop and no scroll lock. They sit below the WordPress admin bar for logged-in users, can push page content aside or overlay it, wrap cleanly on phones, and always have a keyboard-accessible close button (Escape closes them too). Once a visitor closes a bar, it stays closed according to the popup's frequency setting, and no other bar takes its place on that edge for the rest of the session. At most one top bar and one bottom bar show per page, picked by priority; a bar and a modal can show together. The template gallery has a Bars category with an announcement bar, a call-to-action bar and an email capture bar (with GDPR consent, working through the normal lead capture and HubSpot flow). Custom HTML bars get a short guide and a ready-made AI prompt. Traffic source targeting Show any standard popup or bar only to visitors from particular sources: referrer domain (subdomains included, e.g. reddit.com covers old.reddit.com), UTM parameters, any query parameter (e.g. ref=partner123) or direct traffic. Rules can include or exclude, match any or all, and presets add the usual domains for Reddit, LinkedIn, X, Facebook and Google in one click. The source is recorded when the visitor arrives and kept while they browse, so rules keep matching on later pages. Arriving again with new UTM tags or from another website replaces it, the way analytics tools start a new campaign session. Rules are evaluated in the browser, so full-page caching keeps working. Each lead stores the referrer domain and UTM tags it came with; they appear in the Leads list and CSV export and, when your HubSpot form has hidden fields named utm_source, utm_medium, utm_campaign, utm_content and utm_term, they are passed to HubSpot as well. Note that some apps and browsers do not send a referrer (for example many in-app browsers), so such visits look like direct traffic. UTM tags on your links are the most reliable signal. Cookies, consent and browser storage

• fastopop_source (sessionStorage, this browser tab's session only): the traffic source of the current visit — referrer domain, utm_ tags and any query parameters your rules ask about. Nothing else from the URL is stored.
• fastopop_src (first-party cookie, up to the number of days you set per popup): the last non-direct traffic source, used only by popups set to "Remember the traffic source for N days". When the WP Consent API is active (for example with Complianz or CookieYes), this cookie is written only after the visitor consents to marketing or statistics cookies, is written as soon as they do, and is removed if they withdraw consent. Without consent, FastoPop uses sessionStorage only. The cookie is registered with the WP Consent API so consent plugins can list it. If no consent plugin is active, it is written as configured.
• fastopop_bar_{id} and fastopop_bar_edge_{position} (first-party cookies, or browser storage if you choose localStorage for a bar): remember that a visitor closed a bar.

0.10.0

• New: sticky top and bottom bars. A "Display position" setting on every standard popup: Modal (unchanged default), Top bar or Bottom bar. Bars are full-width and fixed, with no backdrop, scroll lock or blur; role="region" with an accessible name; a close button that is keyboard accessible, plus Escape and any element with data-fastopop-close. Existing popups keep rendering as modals.
• Bars sit below the WordPress admin bar (including on phones, where the admin bar scrolls away) and can push page content aside or overlay it. Their height is exposed as --fastopop-top-bar-height / --fastopop-bottom-bar-height for themes with fixed headers.
• Bars stay visible from page to page until closed; the frequency cap then decides how long a closed bar stays closed (session, N days, or not at all), in a cookie or localStorage. A signup counts as closing. Once a bar is closed, that edge stays empty for the session.
• At most one top bar and one bottom bar per page, chosen by priority. Overlap warnings only compare bars on the same edge; bars never conflict with modals.
• Branded-mode bars: compact one-line layout with an inline capture form (headline, email + Subscribe, consent on one row on desktop; stacked on phones) and inline thank-you.
• Templates: new Bars category with Announcement, CTA and Email Capture bars. Choosing a bar position defaults the trigger to page load delay 0. Custom HTML bars get a help note and a bar-specific "Copy AI prompt" button.
• New: traffic source targeting for every standard popup and bar. Rules on referrer domain, UTM parameters, any query parameter or direct traffic; Include/Exclude, Match any/all (Exclude always wins); presets for Reddit, LinkedIn, X, Facebook and Google. Evaluated client-side, so full-page caching keeps working.
• The landing source is kept in sessionStorage for the session and replaced when the visitor arrives again with new UTM tags or from another website; popups can optionally remember it for N days in a first-party cookie that respects the WP Consent API (marketing or statistics consent) and is registered with it.
• Leads now store the referrer domain and UTM tags (new Source column in the Leads list and six new CSV columns). UTM tags are passed to HubSpot hidden fields when the form has them; rejected fields are skipped for that form for 7 days.
• Fix: URL patterns without a "?" now ignore the query string, so "/contact/" also matches "/contact/?utm_source=reddit" and an exclude "/cart/" also covers "/cart/?add-to-cart=5". Patterns that contain "?" still match the full URL. Applies to every popup type.
• Fix: URL patterns are now tolerant of how they are typed: "/contact", "/contact/", "contact", surrounding spaces and a full URL on your own site (with or without www.) all match the same page. A full URL on another site never matches. The "Similar popup detected" warning uses the same matching, so it now also flags "/contact" against "/contact/".
• Templates now seed the device target ("Desktop + Mobile"), and the popup list shows an empty device target as "Desktop + Mobile".
• The "Powered by FastoPop" credit setting is relabelled and the editor no longer claims a credit is added automatically. It remains opt-in and off by default, and never appears on Custom HTML or template popups.
• Database version 6 adds the source columns to the leads table. Existing leads and stats are unaffected.

0.9.3

• The popup list title filter now escapes every value it returns. Core already escapes this downstream, and esc_html() does not re-encode existing entities, so titles containing apostrophes, ampersands or quotes render exactly as before.
• That filter is now attached only on the popup list screen, the one place it has ever done anything, so the escaping it applies cannot reach titles elsewhere on the site.
• AI prompt template: prose references to element names are written without angle brackets ("no script tags, no iframes"). The markup specimens further down are unchanged on purpose — they are the exact contract FastoPop auto-wires against.
• Template preview iframes: the srcdoc document is now composed by a small helper instead of one long inline concatenation. Output is byte-for-byte identical; the previews render exactly as before.
• No functional or visual change anywhere in this release.

0.9.2

• Escaping: every helper that returns markup is now escaped at the point of output with wp_kses() and an explicit per-helper allow-list. All 24 phpcs:ignore WordPress.Security.EscapeOutput annotations are gone — none remain anywhere in the plugin.
• The dashboard chart now emits its SVG directly with each value escaped inline, rather than returning a string. SVG carries case-sensitive attributes (viewBox, preserveAspectRatio) that wp_kses lowercases, so this keeps the markup exact instead of relying on browser attribute correction.
• Assets: all static inline CSS and JS moved out of PHP into real files under admin/css and admin/js, enqueued with wp_enqueue_style/wp_enqueue_script and versioned by FASTOPOP_VERSION. Fifteen blocks moved; the A/B tests, templates gallery, integrations, popup lock, status toggle, template editor, age verification, AV reject and HubSpot meta assets are now all cacheable static files.
• Runtime values that used to be interpolated into those blocks (the admin-ajax URL, the toggle action name, the Variant B lock tooltip) now travel via wp_localize_script instead.
• Documented two escaping false positives in code so future reviews do not re-flag them: the AI prompt template that mentions tag names as instructional copy, and the blocks inside sandboxed iframe srcdoc previews, which cannot be enqueued without defeating the isolation they exist for.
• No functional or visual change. Helper output was verified byte-identical or semantically identical (no tag, attribute, or text dropped) across all render paths.

0.9.1

• New: GDPR consent transmission to HubSpot. Enable "Send GDPR consent with submissions" on the Integrations screen and set a Subscription Type ID, and FastoPop sends a legalConsentOptions block with each submission. Contacts arrive Subscribed for that subscription type instead of "Not Specified", so portals with opt-in-required settings stop silently skipping marketing sends.
• New: the consent-to-process and consent-to-communicate texts are configurable, with sensible defaults.
• New: per-popup Subscription Type ID override in the popup's HubSpot meta box, so different popups can opt visitors into different subscription types. Empty inherits the global setting.
• Consent is only ever sent when the popup form actually presented a consent checkbox and the visitor ticked it. Custom HTML popups without a consent checkbox transmit no consent, because the capture endpoint accepts an assumed consent value in that case and an assumed consent is not a legal basis.
• A Subscription Type ID is required to switch consent transmission on — without one there is nothing for HubSpot to opt the contact into, so the toggle stores as off and explains why.
• Fix: submissions now include the visitor's IP address in the HubSpot context object, clearing HubSpot's "this custom form submission didn't include an IP address" warning. Raw IPs are sent to HubSpot only; the local leads table continues to store just a salted hash.
• HubSpot activity log and CSV export record whether consent was sent with each attempt. Entries predating this release show a dash and export blank.

0.9.0

• New: per-popup HubSpot form overrides. Each popup gets a HubSpot meta box in the editor sidebar. When the global integration is connected it shows the inherited destination and a "Send this popup's leads to a different HubSpot form" checkbox revealing Form GUID and Portal ID fields; when it is not connected it explains why and links to Integrations instead of offering fields that could not work.
• New: the Portal ID can be overridden per popup as well. Leave it empty to inherit the default portal — the common case is the same portal with a different form.
• Region detection now runs against whichever portal a popup actually sends to, and the cached region is keyed by portal ID so different portals never share a cached endpoint.
• HubSpot activity log records the Form GUID each attempt targeted, shown as a new column and included in the CSV export. Entries logged before this release export blank.
• Validation: saving a popup with the override on but no Form GUID stores it as inherit and explains why, rather than persisting a destination that cannot resolve.
• The global HubSpot integration toggle still gates everything — with it off, popups carrying overrides send nothing.
• Upgrade: popups that already had a per-popup Form GUID (where a non-empty GUID was itself the override signal) are migrated onto the new explicit override flag, so their destination is unchanged.
• Integrations page now points merchants at the per-popup setting instead of only implying it exists.

0.8.3

• Docs: Installation step now names the fastopop folder, matching the plugin slug.
• Internal: every phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped annotation now carries a -- reason: note naming the helper and the escaping it applies, so the suppressions are auditable at the call site. No behaviour change.

0.8.2

• UX: "Edit raw HTML instead" warning is now far more explicit about permanence. Previous wording underplayed the cost — the new dialog states plainly that the switch is permanent for the popup, that the simple template fields will be removed and cannot be restored for that popup, and points merchants at "create a new popup from the template" as an alternative if they're not sure.
• New: "Reset to template" escape hatch. When a popup gets switched to raw HTML mode, the strip handler now captures the originating template id into a new _fastopop_original_template_id meta before clearing the active template membership. Popups in raw mode that have this origin pointer show a small "Template" side meta box with a "Reset to template" button. Confirm dialog warns that raw HTML edits will be discarded. On confirm, the active template id is restored, tokens reset to defaults, _fastopop_custom_html is regenerated from the template (with {age} substitution for AV popups), and the editor reloads with the simple field editor restored.
• Popups created directly in raw Custom HTML mode (never from a template) do NOT show the reset link — there's no origin pointer to restore.
• If the original template is removed from code between switch and reset, the reset handler clears the dangling pointer and surfaces an explanatory notice rather than crashing.
• Internal: NOTICE_TRANSIENT messages from the strip/reset handlers now render on the popup edit screen via a new admin_notices hook. Gallery page still renders its own notice inline (no double-display).

0.8.1

• Fix: Template gallery card previews are now horizontally centered. The scaled iframe (1000×625 → 320×200) was anchored at top-left, so on grid columns wider than 320px the popup content drifted to the left of the card. Wrapped the iframe in a flex-centered "scale" container sized to the scaled dimensions; the popup now sits in the middle of every card regardless of column width. Switched the preview srcdoc to a html,body{height:100%} + body flex-center pattern so the same srcdoc renders correctly in both the thumbnail and the modal.
• Fix (related): Templates submenu was 404'ing at wp-admin/fastopop-templates because the submenu was being registered from the Templates class on admin_menu BEFORE Fastopop_Admin's add_menu_page() populated $admin_page_hooks. The hookname computed at registration time ('admin_page_') differed from the one WP recomputes at render time ('fastopop_page_'), so has_action() missed and WP fell back to using the bare slug as the link URL. Moved the registration into Fastopop_Admin::register_menus to match every other working submenu.
• New: Click-to-zoom preview modal. Each card's preview area is now a button — clicking it (Enter or Space also work) opens the template at full size in a scoped admin modal with a dark backdrop. The modal iframe width follows the template's default size (small/medium/large → 400/600/900 px). Close via the X button, clicking the backdrop, or pressing ESC. Focus returns to the originating preview when the modal closes.
• New: "Use this template" button inside the modal goes straight to popup creation with the same nonced URL the card button uses, so merchants can preview at full size and create in one click.
• Modal styles are all scoped under .fastopop-tpl-modal* and the modal itself sits at z-index 160000 (above WP's admin bar at 99999). Scrolling on body is locked while the modal is open so background scroll doesn't leak through.

0.8.0

• New: Template Library. FastoPop → Templates ships a gallery of professionally designed popups with live scaled-down previews, category filter tabs (All / Newsletter / Age Verification / Exit Offer / Chargeback), and a "Use this template" button that spins up a configured popup in one click.
• Four templates ship in the initial library: Newsletter Signup (two-column, exit-intent, name + email + GDPR consent), Age Verification (centered yes/no with {age} substitution), Exit Discount Offer (centered last-chance offer with discount code reveal + email capture), and Chargeback Prevention (amber-toned two-column warning that funnels into the Freeze Playbook lead capture).
• New token-driven editing model. Each template is HTML with {{token}} placeholders. The popup editor renders a form field per token (text, textarea, color picker, URL, email) plus a debounced live preview iframe that updates as the merchant types. The final HTML is generated by substituting tokens with safely-escaped values into _fastopop_custom_html, so frontend rendering uses the existing Custom HTML path with no engine changes.
• Token values are sanitized per declared type — text/textarea/email get HTML-escaped, URLs go through esc_url, colors are validated as hex and fall back to the template default if invalid. Template HTML itself is trusted (we ship it); only merchant-supplied values flow through the escape gate. Net effect: safer than raw Custom HTML because merchants edit values, not markup.
• "Edit raw HTML instead" escape hatch on template-backed popups. Confirms with a warning, strips the template metas, and leaves the generated HTML editable in the standard Custom HTML textarea. One-way door — flipping back means starting a new popup from the template.
• AV template support: the existing {age} placeholder substitution is preserved through the template flow. Editing the popup's minimum-age field re-renders the live preview in real time, and the saved HTML always reflects the latest configured min_age.
• Template-backed popups still participate in every existing feature: URL targeting, triggers, A/B testing, analytics, status toggle, HubSpot lead capture (auto-enables when the template's form class is detected).

0.7.4

• UX: A/B Tests page stat cards no longer show "—" when impressions are below the 20-impression floor. Below the floor, the actual conversion rate is rendered in muted grey with an italic "Early data" line underneath, so the cards feel populated instead of broken while signaling that the number is too noisy to act on. At/above the floor, rates render in normal text color as before.
• UX: Lift cell mirrors the same treatment. If either variant has 0 impressions the cell still shows "—" (lift is genuinely undefined). If both have impressions but at least one is below the floor, lift renders in muted grey with the "Early data" subline. Once both clear the floor, lift renders with the normal green/red semantic color.
• No change to the confidence pill — "Need more impressions" still appears there until both variants clear the floor.

0.7.3

• Critical fix: DivisionByZeroError in lift_pct() when Variant A had 0 conversions but ≥1 impression. Root cause was a strict-comparison check (0.0 === $a_rate) that failed because PHP's int-divided-by-int returns int 0, not float 0.0 — so the guard fell through and we hit the actual division by zero. Now guarded on the raw impressions + conversions counts, no float strict-equality trap.
• Fix: "A/B Winner +X%" badge no longer renders for popups with non-positive lift (e.g. a control that was manually declared winner despite losing on metrics). The sidebar A/B Test meta box shows a neutral "This popup completed an A/B test previously" line in that case instead of claiming a "win" the math doesn't support.
• Diagnostic: lift_pct() now logs a warning to the PHP error log when conversions > impressions for either variant (data inconsistency, typically pre-test leads on a popup that's now part of a test).
• Change: control popup pill label "A/B" → "Variant A" so the popup list reads symmetrically with the Variant B pill.
• New: Quick Edit and Trash row actions are suppressed on popups that are currently in an active A/B test. A custom "End A/B test" row action is added that routes to the A/B Tests page. Completed-test winners keep their normal row actions.

0.7.2

• Fix: A/B test stats now count only data captured after the test started. Previously, pre-existing impressions/conversions on the control popup gave it an unfair head start over the freshly-created Variant B.
• New: 20-impression floor per variant before conversion rates and lift are displayed. Below the floor, cells show "—" and confidence reads "Need more impressions". Prevents 1/1 = 100% noise from looking like a result.
• New: Variant B's rule fields (trigger, URL targeting, devices, frequency, priority) are now visually locked in the editor — disabled inputs with a 🔒 icon next to each label and a tooltip explaining they're inherited from the control. Server-side rule sync from 0.7.0 still enforces correctness; this is the matching UI lock.
• New: Lift display is now semantically colored — green ▲ +X.X% for positive, red ▼ -X.X% for negative, neutral grey ≈0% when |lift| ≤ 1%. Applied to the A/B Tests admin page (active cards + completed table) and the popup-list winner badge.
• New: A/B status pills next to titles in the popup list (using WP's native display_post_states): blue "A/B" for control, blue "Variant B" for variant_b, green "A/B Winner +X%" for past winners. The "(Variant B)" title suffix is stripped from the list view (kept everywhere else).

0.7.1

• Critical fix: "Start A/B test" button now actually works. The meta box rendered a inside WP's outer post-edit , which HTML5 forbids — browsers silently dropped the inner tag, so the button submitted the post-edit form to post.php with our action name instead of admin-post.php. The handler was never reached. The button is now a nonced link to admin-post.php.
• The start handler reads control_popup_id from $_REQUEST so it works for either GET or POST.
• Redirect to the new variant editor now builds the URL directly (admin_url('post.php?post=N&action=edit')) instead of going through get_edit_post_link(), which can return null in capability edge cases.
• Added error_log() calls at each failure path (wp_insert_post errors, missing control, already-in-test, missing request param) so future regressions are diagnosable from the PHP error log.

0.7.0

• New: A/B Testing feature. Test popup variants against each other to find what converts best — a real differentiator for high-risk merchants who can't use mainstream A/B tools.
• Two linked popup entities per test: a control and a Variant B, joined by a shared test ID meta. Variant B's rule fields (URL targeting, trigger, devices, frequency, popup type) are server-side synced from the control on every save so the variants only differ in content.
• New A/B Tests admin page with active tests (stats grid, confidence label, "End test" buttons) and completed tests history.
• 50/50 traffic split via sticky cookie (fastopop_ab_{test_id}, 30-day expiry). Visitors stay on the same variant across reloads.
• Statistical significance via z-test for proportions. Confidence labels: Need more data, Trending toward A/B, Winner: A/B with 95% confidence, No meaningful difference. Minimum 100 conversions per variant before significance is declared.
• Auto-end at 30 days via daily WP-Cron. Picks winner by confidence; falls back to control if no significance.
• Manual end via admin button: trashes the loser (impressions data preserved), marks winner with "+X% lift" badge and clears its test membership.
• Overlap warning suppression: popups in the same A/B test no longer trigger the similar-popup warning since they're meant to compete on the same URL.
• New ab_variant column on wp_fastopop_impressions for cleaner per-variant queries. Impression logging includes the assigned variant.
• AV popup A/B support: when an AV popup is in a test, the server returns all test members and JS picks the assigned variant.

0.6.3

• New: configurable Leave button destination on the rejection state. Per-popup choice of Previous page (default), Specific URL, or Site homepage. Fields appear in the AV meta box when reject behavior is "Show message".
• New: similar-popup detection. When editing a popup whose rules overlap with other popups (same type, overlapping URL patterns, overlapping device targeting, and — for standard popups — same trigger), an amber notice lists the conflicts with links to open them in a new tab. Non-blocking; the save still goes through.

0.6.2

• Styled rejection state. AV popups with "Show message" reject behavior now render a properly styled "Access denied" frame with a Leave button that navigates the visitor back (or to the site root if there's no history).
• Fix: page_load_delay and time_on_page popups now fire after AV verification when multiple standard popups match the same URL. The server was returning only the top-priority standard popup; now it returns every matching standard popup so all configured triggers can fire.
• New: Active/Paused toggle in the popup list and the Age Verification list. Clicking the toggle saves via AJAX (manage_options + nonce). Paused popups are excluded from frontend rendering without unpublishing. Same meta drives both lists, so toggling in either place affects both.

0.6.1

• Fix: AV popup reject behavior + reject message + remember days now save correctly. The nonce field lived inside the trigger meta box (hidden for AV popups), so the save handler silently bailed at the nonce check. Nonce now also rendered from the AV meta box.
• Fix: standard popups now resume after an AV popup is verified. The server returns both the AV winner and the standard winner when both match a URL; the JS engine binds AV immediately and defers the standard popup until verification. Triggers (exit intent, page-load delay, etc.) attach at bind time, so deferred popups get a fresh "page load" from the verification moment.
• UX: Age Verification settings page simplified to only site-wide preferences (background blur, storage method). Per-popup configuration (min age, reject behavior, reject URL, remember days) lives on each popup. New AV popups get hardcoded defaults: 18 / redirect / "" / 30 days.

0.6.0

• New: Age Verification popup type. Block content access until visitors confirm they meet age requirements.
• Age Verification admin page with global defaults (minimum age, reject behavior, redirect URL, remember period, storage method, background blur).
• Per-popup AV settings: minimum age, reject behavior (redirect / message / close tab), reject URL, reject message, remember days, storage method (cookie / localStorage), background blur 0-20px.
• AV popups always take precedence over standard popups when both match a URL.
• AV popups fire immediately on page load — no trigger configuration, no frequency cap, no close button, ESC + overlay click disabled.
• Page content blurred (configurable) and scroll-locked while AV popup is shown.
• Visitor verification persists per popup_id for the configured remember window.
• Default Custom HTML template pre-populated for new AV popups, with {age} placeholder substitution.
• New verification_status column on wp_fastopop_impressions tracks verified / rejected actions.
• Dashboard widget "Age verification performance" shows verifications, rejections, and verification rate (visible only when AV popups exist).

0.5.4

• Popup close button now uses an inline SVG cross for pixel-perfect centering, fixing the off-axis glyph caused by font-specific × offsets. Affects both Mode A and Custom HTML mode close buttons.

0.5.3

• Dashboard "Top converting pages" widget now filters out pages with zero conversions. Empty state shown when no page has converted yet.

0.5.2

• Integrations page: each integration card is now collapsible, closed by default. Click the header to expand.
• Integrations page: status badges next to each integration name (Connected / Disabled / Not configured).
• HubSpot card: download full activity log as CSV (with email, region, HTTP status, error message). Clear log button with confirmation.
• HubSpot log entries now capture the lead's email address.
• Timezone fix: leads and impressions are now stored as explicit UTC; dashboard timestamps display correctly regardless of MySQL server timezone.

0.5.1

• Fix: theme button styles (border, box-shadow, outline, background-image, text-shadow) no longer leak into popup buttons. Defensive reset scoped to .fastopop-overlay and .fastopop-modal.

0.5.0

• Dashboard with impressions, leads, conversion rates, and trends
• Submissions over time chart with per-popup filtering
• Top performing popups and top converting pages widgets
• Recent leads feed
• Integrations status widget with HubSpot connection indicator
• System health checks
• Impression tracking via session-based deduplication
• Custom HTML mode frame removal for edge-to-edge designs
• Auto-wire form submission for Custom HTML popups
• Hide-others-on-success behavior with fastopop-keep escape hatch
• Auto-enable lead capture when fastopop-custom-form class is detected
• AI prompt template for generating custom popup HTML

0.1.0

• Initial scaffold: plugin bootstrap, leads table via dbDelta, admin menu skeleton.