New Signup Theme "Trace" - A new minimal signup minisite theme with light and dark color schemes that follow the visitor's system preference, full white-labeling with your program logo and name, and right-to-left language support (#15780)
User Interface
Starred Records - Affiliates, campaigns, banners, and transactions can now be starred in their merchant panel grids, and the star in the grid header switches to showing starred records only (#11942)
Security
Strengthened Access Control - Tightened permission checks on several merchant panel endpoints (#16317)
Improvements
Integrations
Affiliate Details in Shopify Orders - A new optional Shopify plugin setting adds the crediting affiliate's username and name to the order's additional details, next to the existing visitor ID and referrer URL (#15397)
Bug Fixes
Integrations
Shopify Click Tracking After a Shop URL Change - Changing the shop URL in the Shopify plugin no longer removes the click-tracking script tag from stores that still rely on it; the tag is recreated on the new store (#16406)
REST API v3
Missing Affiliate Responses - PATCH /affiliates/{id} and DELETE /affiliates/{id} now return a 404 response for a non-existent affiliate regardless of the account language (#16270)
User Interface
Menu & Screens Edit Dialogs - Fixed edit dialogs of screens containing a grid in Menu & screens being clipped and impossible to scroll (#16416)
Dark Theme Dropdowns - Fixed unreadable dropdown options in dark themes (#16363)
Right-to-Left Checkbox Alignment - Fixed checkbox groups aligning incorrectly in right-to-left languages on signup forms and in the panels (#16422)
Strengthened Access Control - Tightened permission checks on several merchant panel endpoints (#16203) (#16177)
Improvements
REST API v3
Network Fee in Traffic Overview - GET /traffic-overview now includes a network_fee breakdown in its transactions and sales sections for accounts with an active affiliate network (#15383)
Visitor ID in Transaction Detail - GET /transactions/{id} now returns the transaction's visitor_id (#15337)
Reports
Profit Column in Top Affiliates - The Top Affiliates report and the GET /reports/top-affiliates endpoint now show a total profit value (total cost minus commissions) that can be sorted and filtered (#12489)
Home Page Statistics
Referral Commissions on the Home Page - New template variables expose referral commission totals for all time periods on the affiliate and merchant home pages, and the per-campaign filter now works for sales, commissions, and referral commissions (#16033) (#16036)
Plugins
Affiliate Commission Filter by Campaign - The plugin that hides commissions in the affiliate panel commissions list can now limit its filter to specific campaigns; leaving the new field empty keeps the previous behavior (#16221)
REST Commissions Plugin Description - Corrected the plugin help text describing which affiliate receives a missing tier commission (#13529)
User Interface
Edit View Popup Scrolling - In the column-selection popup, the title and Save buttons now stay in place while only the column list scrolls, so the buttons no longer scroll out of reach (#12677)
Performance
Coupon Generation Limit - Coupon generation and import are now limited to 1000 coupons per operation to avoid database performance problems (#15369)
Bug Fixes
Tracking
IP Anonymization - Fixed a case where enabling "Anonymize IP addresses" could drop Shopify sales for visitors with IPv6 addresses (#16300)
Integrations
Shopify ReCharge Subscription Tracking - Restored tracking of ReCharge subscription orders after Shopify changed the identifier it sends for them (#16311)
Shopify ReCharge with Tiered Commissions - Fixed ReCharge recurring orders producing an incorrect order ID and crediting the wrong affiliate when multi-tier commissions are used (#16324)
Stripe Checkout Affiliate Creation - The "Create Affiliate" setting now works for Stripe Checkout payments, and the plugin now supports Stripe's newer API version when detecting recurring commissions (#15966)
AI Assistant
FlowHunt AI Assistant Visibility - The AI assistant is now shown only to the account owner; in Post Affiliate Network accounts it also appeared for the network's own merchants (#16254)
Affiliate Panel
Welcome Message - Fixed the affiliate panel home page welcome message reverting to its previous text instead of saving (#16230)
Themes
Design Panel with Invalid Themes - The Design configuration screen no longer fails to load when a custom theme has a missing or invalid thumbnail; the broken theme now shows a placeholder, and theme import rejects invalid files (#16251)
User Interface
Faster Grid Loading - Fixed grid screens requesting their data twice right after a panel refresh, which could delay loading by a few seconds; a single request is now sent (#16231) (#16271)
Improved Data Protection - Tightened filtering of sensitive account fields from merchant panel responses (#16105)
Improvements
REST API v3
Assign Coupon to Affiliate - The coupon update endpoint (PATCH /banners/{id}/coupons/{coupon_id}) now accepts an affiliate_id field to assign an existing coupon code to an affiliate (#16131)
Login
Password Policy - The default password policy no longer requires a special character; passwords still need at least 8 characters including a letter and a digit (#16175)
FlowHunt AI Assistant - The merchant panel now offers an AI assistant powered by FlowHunt — the "AI assistant" button in the screen header opens a chat side panel that helps you navigate and work with Post Affiliate Pro. Activated automatically (#15414)
Security
Improved Output Escaping - Improved escaping of content displayed in the merchant panel (#16089)
Strengthened Access Control - Tightened permission checks on several merchant panel endpoints (#15999)
Improved URL Validation - Stricter validation of URLs processed by tracking scripts (#16041)
Login Protection - Fraud Protection IP rules are now evaluated earlier during login (#16095)
Improvements
REST API v3
Grid Request Limit Documented - The 1-request-per-second limit on list endpoints is now described in the Rate Limiting docs, and exceeding it returns a proper "Too Many Requests" response with a retry hint instead of a generic error (#16133)
Tracking vs. API Access Clarified - The Tools → Integration screen now separates tracking methods from programmatic API access, and the POST /transactions docs clarify that the endpoint creates commission records directly and is not the sale tracking mechanism (#16028)
Integrations
Shopify write_orders Notification - The missing-scope warning now appears only when updating order attributes actually fails, instead of proactively polling the Shopify API on every notification load (#16103)
Shopify Notification Length - The "Stores requiring update" list in the Shopify notification is capped at 10 stores, with an "and X more stores" summary for the rest (#16099)
Plugins
AWeber OAuth 2.0 - The AWeber plugin now uses AWeber's OAuth 2.0 authorization, replacing the discontinued OAuth 1.0 flow; merchants using the plugin need to re-authorize the connection (#16003)
HubSpot Field Mapping - Removed the redundant "unused" option from affiliate-field listboxes in both HubSpot plugins; leaving the field empty is now the single way to express "no mapping" (#16082)
Banners
Open Link Banner in New Tab - Link banners in the affiliate panel now show an "open in new window" icon, so the link can be opened without copy-pasting it (#15445)
Webhooks and Outbound Requests
Default User-Agent - Outbound HTTP requests (webhooks, plugin downloads, license checks) now send a User-Agent header identifying the application, preventing rejections by firewalls and bot filters; white-labeled installations use their configured branding name (#15829)
API Client User-Agent - Applications integrating via the PAP API client library (PapApi.class.php) can now set a default User-Agent for their outgoing calls without affecting the visitor browser data sent to tracking (#15764)
Bug Fixes
REST API v3
PATCH /transactions/{id} Field Names - The endpoint now accepts the documented snake_case total_cost and merchant_note fields instead of their legacy camelCase names (#16132)
Campaign Detail Account Status - GET /campaigns/{id} now returns the actual account approval status (approved, pending, declined, suspended) in account_status instead of an unrelated internal value (#15816)
Deterministic Pagination - Cursor-based pagination on /reports/top-affiliates no longer repeats a row across pages when affiliates share the same name (#15902)
Integrations
Shopify Webhook Processing - Fixed visit processing failing on queued Shopify webhook tasks such as refunds and order status changes (#16059)
Plugins
HubSpot Optional Custom Fields - The "HubSpot - create affiliates" plugin no longer requires all custom field values to be filled in to save the settings (#16047)
Commissions
Sale Filter on Manual Commissions - The Sale filter plugin is now applied when a sale commission with multi-tier support is created manually (#16046)
Affiliates
Number Field Range Filters - Range filters (greater/less than, between) on number-type custom fields now compare values numerically instead of alphabetically, in both the merchant affiliate grid and the API v3 q filter (#16007)
User Interface
Integration Method Instructions - Step-by-step screenshots in Tools → Integration now render correctly, and the marketing banner was removed from the instructions (#16051)
Notification Dismissal - "Don't show this message again" now persists for notifications without an expiry date, such as the "Default campaign is stopped/paused" warning; the dismissal resets once the campaign is active again (#15969)
Themes
Dark Mode Fixes - Fixed unreadable selected items in the top-right user menu in the August theme and the unstyled popup for editing available signup field values (#16068) (#16031)
Coupon Endpoints - Added coupon management under /banners/{id}/coupons — list, get, update, delete, generate, and import coupons (#15358)
Click Details in GET /transactions - The fields parameter on GET /transactions now accepts first/last click details (time, referer, IP, data1, data2) and click count, so click context can be fetched alongside the commission in a single call (#15994)
Integrations
Per-Locale and Per-Domain Campaign Routing in Shopify - Multi-country Shopify stores under one Shopify account can now map each storefront domain, market handle, or locale to a different campaign within a single integration, instead of routing everything to one shared campaign (#15674)
Shopify Billing Address Fields - Billing address fields (name, phone, company, address, city, ZIP, province, country) and a compound full-address option are now available in the Shopify Extra data dropdowns (#15996)
Tracking
Time-Limited UserAgent + IP Association - Added a validity period setting for "Track referrals by UserAgent and IP address", mirroring the existing IP-only setting and defaulting to 2 days. Useful where many users share the same IP and UA (VPNs, iOS user-agent freeze) (#15417)
Plugins
Plugin Capability Tags - The merchant Plugins list now shows capability tags on each plugin (refunds, partial refunds, recurring commissions, coupons, lifetime commissions, customer details) so it's clear at a glance which features each plugin supports (#15102) (#16004)
Improvements
Security
Raw SQL Removed from Event Log - Replaced raw SQL strings in customer event log entries with structured, non-SQL messages (#15955)
Cleaner Event Log During Install - Routine outbox debug entries no longer flood the customer event log during account install (#15956) (#16018)
Maximum Password Length - Removed the admin-configurable "Maximum password length" setting and capped passwords at 72 characters across all accounts (#15975)
User Interface
Password Rules Up-Front - The set-password screen, in-panel password change, and signup forms now show the active password policy as a live hint list with red/green checkmarks, replacing the strength bar that could disagree with what the validator actually accepts (#15944)
Integrations
Shopify write_orders Notification - The write_orders scope warning now appears only when at least one configured store actually lacks the scope, and multi-store setups list which specific stores still need updating (#15958)
Tracking and Callbacks
Block Google Read Aloud Bot - The Google Read Aloud user agent is now treated as a crawler, so its affiliate-link prefetches no longer create duplicate clicks (#15901)
Affiliate Name in Sale Tracking Callbacks - Application Callback URLs fired on commission events can now use {$name}, {$firstname}, {$lastname}, and {$username} (email) merge variables (#15404)
Performance
Faster Campaign Save - Saving a campaign no longer re-stamps every banner's account when the campaign's account hasn't changed — a significant improvement for accounts with thousands of banners and frequent campaign edits (#15961)
Coupon Grids - Coupon grid queries no longer add user-table joins when affiliate columns are not requested (#15859)
Bug Fixes
Integrations
Stripe Subscription Tracking on Additional Config Tabs - Fixed Stripe subscription tracking silently failing on any config tab other than the first, affecting merchants with multiple Stripe configurations (#15964)
Stripe Plan-Based Product ID - Fixed an empty product ID and PHP warning when the Stripe Product ID setting was "Plan's product" or "Plan's ID" and the purchase had no plan attached (#15752)
Plugins
Affiliate Profile Change Webhook with Membership Subscriptions - The webhook now also fires when the Membership Subscriptions Manager changes an affiliate's status (subscription activation, decline/refund, or expiry); previously these automated transitions silently skipped the webhook (#15928)
Themes
Theme Import with Disabled Built-in Parent - Fixed theme import failing with original_theme="..." does not exist when the parent built-in theme had been disabled in Configuration → Design → Themes (#15916)
Theme Import on Built-in Templates with Runtime Variables - Fixed theme import failing with a PHP fatal error and leaving an orphan theme row when the imported zip contained built-in templates referencing runtime variables; invalid templates are now rejected cleanly instead (#15946)
Dark Theme - Country Commissions - Fixed the unreadable light-grey "Custom per Sale commissions for country" section on the Commission settings screen in dark mode (#16000)
Transactions
Original Currency in Commission Import - The "Original currency ID" column (relabelled to "Original currency (ID / code)") now accepts both internal currency IDs and codes (e.g. EUR), and no longer writes a spurious critical event log entry on successful imports (#15980)
Login
Merchant Session Termination on Status Change - When a network owner changes a merchant account's status to pending or declined, the merchant's active session is now closed immediately instead of remaining usable until manual logout (#15777)
