Changelog.

0.17.1 Latest

• Fix: With DISALLOW_UNFILTERED_HTML set, a change that Snipfire refuses now says so ("Snipfire is read-only on this site because DISALLOW_UNFILTERED_HTML is set…") instead of a general "access doesn't allow this" message.

Snipfire Pro

• Fix: With DISALLOW_UNFILTERED_HTML set, the Pro settings on Tools & Safe Mode (team access, cookie consent, snippet performance, Git sync) show a read-only notice and disabled buttons instead of failing with an error when saved.
• Fix: The LESS compiler's security-patch message, the @plugin and file-reading LESS function messages and the plugin description are now translated in German, French, Italian, Spanish and Greek.
• Fix: "ran 1 time" in the performance figures uses the number in every language.

0.17.0

• New: Export snippets as a standalone plugin (bulk action, a folder, or one snippet; wp snipfire export-plugin): PHP on any hook, shortcodes, HTML in every location, CSS and JS as files, SCSS/LESS as compiled CSS, settings filled in and the everyday conditions. A report lists what can't work without Snipfire first.
• New: Elementor widget "Snipfire snippet" for shortcode snippets, and a Bricks element (beta).
• New: CSS, SCSS and LESS autocomplete offers design tokens: theme.json presets, Elementor's and Bricks' global colours, fonts and variables.
• New: The editor works on narrow screens (phones and tablets): one pane at a time, full-width code editor and settings.
• New: Getting started screen for new sites (import, library, Header & Footer, start from scratch, a generator).
• New: System info (Tools, REST, wp snipfire info --system) with Copy to clipboard for support tickets. No secrets, code or email addresses, and never sent anywhere.
• New: Snipfire > Snippet library menu item.
• New: Signed updates. Snipfire installs an update from snipfirewp.com only if its Ed25519 signature matches the release key built into the plugin and the version is newer; anything else is refused and nothing changes. SNIPFIRE_UPDATE_URL for another update server (https only outside local/development sites). SECURITY.md explains how to report a vulnerability.
• New: Keyboard and screen reader access throughout the editor (menus, dialogs, focus, live announcements, labels), WCAG AA contrast in both themes, reduced motion and high contrast respected, usable at 200% zoom. Leave the code editor with Esc then Tab, or Ctrl+M.
• New: The WPCode importer converts WPCode's smart tags and WPCode Pro's CSS-selector locations.
• New: HTML snippets can be placed next to an element found by a CSS selector (runs with Snipfire Pro; kept without it). --hook=element:selector --selector=… on the CLI.
• New: PHP snippets can be set to run on a schedule (runs with Snipfire Pro; kept without it).
• New: REST GET /status (versions, counts, errors, safety switches) and GET /snippets?uid=…, for tools that look after several sites.
• Improved: Big sites: with 3,000 snippets the editor opens in about 2 s instead of 4, search is ~17 ms per keystroke, saving takes ~40 ms, and bulk actions on 500 snippets take under a second instead of a minute each. Snipfire now adds no database queries to the front end.
• Improved: Translations for German, French, Italian and Spanish reviewed and completed; every new string translated into all five languages.
• Fixed: wp snipfire create/update/generate stop with an error on invalid JSON in --fields, --values or --conditions instead of emptying them.
• Fixed: Changing settings form values only changes the keys given (--replace-values / values_mode: "replace" to replace them all).
• Fixed: The Google Analytics 4 generator makes a snippet without PHP, so people with CSS, JS and HTML access can use it. The GA4 purchase generator is locked without Snipfire Pro, and a snippet with unresolved order tags is never printed.
• Fixed: "Snippets on this page" also lists PHP snippets on early hooks and HTML in excerpts and post lists, in the block editor panel and now the classic editor box too.
• Fixed: GET /block-snippets shows writers without Snipfire access only switched-on shortcode snippets.
• Fixed: wp snipfire shortcodes checks every post (--limit=<n> to stop early); import-from help lists Post Snippets and Woody.
• Fixed: With DISALLOW_UNFILTERED_HTML, administrators keep Tools & Safe Mode and system info; snippet changes stay refused.
• Fixed: Importing a Woody PHP snippet limited to some WPML languages made a snippet that couldn't be switched on.
• Fixed: Multisite: uninstalling cleans every site; deleting a site deletes its snippets; the Redirects generator works on sites in a folder.
• Fixed: Listing generators needs view access over REST too; generator comments name the "Settings form" tab.

Snipfire Pro

• New: Scheduled PHP snippets (every N minutes, hourly, twice daily, daily, weekly, with a start time) with a run log of the last 50 runs, Run now, and wp snipfire schedule.
• New: Per-snippet performance figures (time and memory, including hooked callbacks) for admins' page views or a sample of visitors, off by default; admin bar item, list badges, a Performance panel and wp snipfire profile.
• New: Secrets vault (libsodium) and snipfire_secret( 'name' ) for PHP snippets; values never shown, exported, synced or logged. wp snipfire secret.
• New: AI assistant with your own key (Anthropic, OpenAI, OpenAI-compatible): Explain, Fix this error (as a diff you apply) and Write with AI. Requests only when you click; the key stays on the server. wp snipfire ai.
• New: HTML next to an element found by a CSS selector (before, after, inside, replace; placed on the server, or in the browser when needed) and Pick an element in the hook finder.
• New: Google Analytics 4 WooCommerce events generator and the {woocommerce_data} smart tag.
• New (Agency): Agency hub: connect client sites with WordPress application passwords, push snippets, see where each version runs, roll back, and a health overview. wp snipfire hub.
• New (Agency): Network snippets for multisite, with network safe mode, a "Site of the network" condition, required snippets and per-site switches. wp snipfire network.
• Security: SCSS and LESS snippets can no longer read files on the server (LESS file functions and imports of real paths); LESS partials are compiled from memory; Git sync webhooks are acted on once.
• Fixed: Language condition with WPML language codes that have a region (pt-br); Borlabs Cookie builds without the group helper; the server-side consent condition with an empty Borlabs group; the hook finder breaking the body tag when body_class() ran a query.
• Improved: Keyboard and screen reader access in every Pro view; faster performance measuring on big sites.

0.16.1

• Library: "Greeklish addresses for Greek titles" now changes only the addresses WordPress makes for new posts, pages, products and terms (long titles are transliterated in full); "Greeklish file names" changes only uploaded files, and only their Greek letters. "Hide the WordPress version" no longer uses one of the site's secret keys for its version code. Installed copies are offered the update.
• Snipfire Pro loads early from the folder Freemius' download unzips to (snipfire-pro-premium).

0.16.0

• New: generators. Custom post type, taxonomy, widget area, admin menu item, scheduled task, image size, menu location, redirects, schema (organization, local business, FAQ, article) and tracking codes, each a snippet with a settings form. Screen, wp snipfire generate and abilities.
• New: settings forms. Snippets can have fields; PHP reads $settings, HTML/JS/CSS use {setting:key}, SCSS/LESS get variables.
• New: smart tags ({post_title}, {user_email}, {page_url}, {custom_field:key}…) in HTML and JS snippets, Header & Footer and page code. wp snipfire smart-tags lists them.
• New: the Snipfire panel in the block editor (code for one page, snippets that run on it) and a box in the classic editor.
• New: the Snipfire block, for shortcode snippets with their attributes as block settings.
• New: WooCommerce's 2,700 hooks in the editor's autocomplete and the hook finder, with descriptions (WooCommerce's own, plus Snipfire's for the template hooks it doesn't document) and the functions WooCommerce hooks there.
• New: updates in WordPress. Snipfire checks snipfirewp.com twice a day and new versions show on the Updates screen, with automatic updates if you switch them on. Off with SNIPFIRE_DISABLE_UPDATE_CHECK.
• New: German, French, Italian and Spanish, next to English and Greek. Each person sees Snipfire in their own profile language.
• Fix: a link that opens the editor on a generator (or a snippet picked in the library before the list had loaded) could end up on an empty new snippet.
• Library (258 snippets): VAT note under prices for EU shops, and receipt or invoice in the block checkout. The Greek phone and postcode checks and the cash on delivery fee now work with the block checkout too.

Snipfire Pro

• New: live preview for CSS, SCSS and LESS snippets beside the editor.
• New: add settings form fields to any snippet; people with CSS/JS/HTML access can change a snippet's values without touching its code.
• New: WooCommerce order smart tags on the order-received page, including the items as JSON and "first view" for once-only conversion events.
• New: "Custom PHP" condition: a PHP expression decides where a snippet runs (full access only).
• In German, French, Italian and Spanish too.

0.15.1

• New: 186 more library snippets and 19 new packs (256 snippets in 29 packs): comments and spam, the block editor, images, admin columns, users, login security (limit login attempts, email-only logins), email and SMTP, SEO basics (meta descriptions, Open Graph, article schema), RSS feeds, search, design touches, shortcodes, speed, developer tools, WooCommerce shop, cart, checkout and account tweaks, and more tracking codes.
• Changed: snippets that change how the whole site or shop behaves (catalogue mode, email-only logins, logged-in-only comments…) stay off after installing a pack, like the ones that need your details.

0.15.0

• New: the snippet library. 70 ready-made, tested snippets in 10 packs, including a Greek e-shop pack. Install from Snipfire > Snippet library, the classic screen, wp snipfire library or the REST API. Updates keep the settings you changed.
• New: WordPress abilities to list and install library snippets.

Snipfire Pro

• Works with the snippet library in Snipfire 0.15.

0.14.0

• Renamed to Snipfire. The shortcode is [snipfire], the WP-CLI command wp snipfire, the REST API snipfire/v1, and snippets are stored in wp-content/snipfire/.

0.13.0

• New HTML locations: before or after paragraph N, before or after the excerpt, and in post lists before or after post N or between posts (block and classic themes).
• Header & Footer screen: three boxes for code in the head, after <body> and in the footer, each a snippet with history and conditions.
• Files: ads.txt, app-ads.txt, llms.txt and /.well-known/security.txt served by WordPress, and extra robots.txt lines. WP-CLI: wp snipfire files.
• Shortcode finder: see where snippet shortcodes are used, spot ones that print nothing, and rewrite other plugins' shortcodes to Snipfire's. WP-CLI: wp snipfire shortcodes.
• See who else has a snippet open, and get asked before a save overwrites someone else's newer version.
• WordPress abilities (WordPress 6.9+) for AI assistants and the MCP adapter: list, read, check, save and switch snippets. Off for outside tools until you switch them on in Tools.
• SNIPFIRE_DISABLE_PHP in wp-config.php turns off PHP snippets for everyone; DISALLOW_UNFILTERED_HTML makes Snipfire view-only.
• Import from Post Snippets and Woody Code Snippets. WPCode's paragraph, excerpt and post-list locations now come across exactly.
• WP-CLI: wp snipfire list takes --folder, --hook and --fields; create and update take --position.

0.12.0

• Every snippet has a permanent ID that travels with it in exports, so the same snippet is recognised on other sites (used by Snipfire Pro's Git sync).
• WP-CLI: wp snipfire create and update take --folder, --description and --tags.
• Copies are named "Copy of …" in your language.

0.11.0

• Snipfire is now the free core; SCSS/LESS, cookie consent, testing mode, the hook finder, team access, the activity log and the visitor, language and WooCommerce cart conditions move to the Snipfire Pro add-on.
• The editor runs on WordPress's own React, so it loads faster.
• Snippet settings that need Pro are kept, and fail safely without it: a snippet waiting for cookie consent doesn't run, one in testing mode runs for nobody, and SCSS keeps its last compiled CSS.
• The history keeps the last 10 versions of each snippet.

0.10.0

• Translation ready: every screen, message and label can be translated, and Greek is included.
• Each person sees Snipfire in their own profile language.
• The editor toolbar wraps instead of overflowing when labels are longer.

0.9.0

• Team access: give each WordPress role no access, view only, CSS/JS/HTML without PHP, or full access. Administrators always have full access.
• Activity log: see who created, edited, switched on or off, deleted or restored each snippet, which snippets were switched off after an error, and who changed settings. Filter it by snippet, person or kind of change.
• WP-CLI: wp snipfire access, wp snipfire log.

0.8.0

• Visual hook finder: click "Hooks" in the admin bar on any page to see every WordPress, WooCommerce, plugin and theme hook labelled right where it fires.
• Click a hook to see what it passes, what's already attached at which priority, and which snippets run there, then add HTML or PHP on it in one click.
• The side panel also lists hooks in the page head, actions that run before the page (init, template_redirect…) and the filters used on the page.

0.7.0

• Cookie consent: JS and HTML snippets can wait until the visitor accepts cookies (statistics, marketing, preferences or functional). They run the moment the visitor accepts, without a reload, and it works with page caches.
• Works with Complianz, CookieYes, Cookiebot, Borlabs Cookie, the WP Consent API and Google Consent Mode v2 (Real Cookie Banner and most other consent tools).
• New "Cookie consent given" condition for PHP snippets.
• Tools > Cookie consent shows the consent tool Snipfire found and what happens without one. WP-CLI: wp snipfire consent, --consent on create/update.

0.6.0

• WooCommerce conditions: cart subtotal, items in cart, cart contains product or category, customer has bought a product, customer's paid orders (first-time buyers), and the order-received (thank you) page.
• Visitor conditions: referrer, country (from Cloudflare and other CDN/host headers, or WooCommerce geolocation) and language (WPML, Polylang or the site language).
• The rule picker is grouped (Visitor, Page, WooCommerce, Date & time, Site) and each new rule explains what it checks.
• WPCode referrer rules are now imported.

0.5.0

• History: every change to a snippet keeps the previous version. Compare any version side by side with what's in the editor, load it into the editor, or restore it in one click (the version it replaces is kept too).
• Testing mode: set a snippet to "Only testers" and it runs only for admins and people you send the preview link to. Visitors don't see it until you click Go live.
• Admin bar item listing the snippets in testing; preview visitors see a small badge with an exit link. Preview pages are never cached.
• WP-CLI: wp snipfire revisions, wp snipfire restore, wp snipfire preview, and --mode=test on create/update.

0.4.0

• SCSS and LESS: CSS snippets can be written in SCSS or LESS and are compiled when you save. Errors show on the right line, live while you type.
• Partials: pull other SCSS/LESS snippets in by name (@use 'variables';, @import 'mixins';). Changing a partial recompiles every snippet that uses it.
• @use 'sass:math', sass:map, sass:color and the other built-in modules work, as do @use ... with (...) and @forward.
• A typo in a live SCSS/LESS stylesheet doesn't take your styles off the site: the last version that compiled stays live until it's fixed.
• WPCode SCSS snippets are imported as SCSS source instead of compiled CSS.

0.3.0

• Import from WPCode (including its global header/footer boxes), Code Snippets, FluentSnippets, Header Footer Code Manager, Simple Custom CSS and JS, the Customizer's Additional CSS, and WPCodeBox (beta). Locations, priorities, tags and conditions are carried over; anything that can't be matched exactly is flagged for review.
• One-click switch over: snippets are switched off in the other plugin and on in Snipfire, and the site is test-loaded. The other plugin's shortcodes keep working.
• WP-CLI: wp snipfire import-from <plugin> [--dry-run] [--switch].

0.2.0

• New editor app: Monaco (VS Code) editor with WordPress, WooCommerce and PHP autocomplete, hover docs, parameter hints, hook callbacks, Emmet, Prettier formatting and live error checking.
• Folders, search, filters, drag and drop, bulk actions, duplicate, export from the editor.
• Fix: fatal errors before any output now switch the snippet off too.

0.1.0

• First development version: core engine, basic admin screens, REST API and WP-CLI.