WBAMS 1.12.0

v1.12.0 [25/10/2026]

• Added

  the Business profile (Setup › Business profile): the business's name, phone, WhatsApp, contact email, address, opening hours (up to two spans a day, and a note), logos for light and dark backgrounds, favicon, brand colour and social links, entered once. The website's header, footer and contact page, every email, invoices, quotes, payslips, gift receipts and the details given to search engines all read them there, and the Content Manager's brand, contact and SEO screens show the same values. On the first visit after the upgrade, WBAMS brings together the copies that were typed in several places, keeps the one visitors saw, and lists the rest on the page.

• Added

  four email merge fields from the profile: {$company_phone}, {$company_address}, {$company_contact_email} and {$company_hours}. The band at the top of emails uses the brand colour and the logo for dark backgrounds, and the copy of an email viewed online shows the same logo.

• Added

  Text overrides (Setup › Text overrides): any text of the client area, changed per language, found by searching for the words visitors see. Emptying a text goes back to WBAMS's wording. The Content Manager's Language Text strings are kept here too, and a visitor whose language has none of its own now reads WBAMS's wording in that language.

• Added

  the business's time zone (General Settings › Localization › Time Zone): invoice and due dates, “today”, reports by day, the daily automation's hour, the admin clock and the times in emails follow it. Until one is chosen, WBAMS uses the server's. System Health says when the database server has no time zone tables loaded.

• Added

  Clients › Possible duplicates: open client accounts that share an email address or a phone number, in pairs. An administrator merges a pair into the account they keep, or marks it as two different people so it is not listed again. Nothing is merged on its own.

• Added

  website traffic counted by WBAMS itself: the dashboard's Website visits panel (today, the last seven days against the seven before, the most viewed pages and the sites that sent visitors) and Reports › Website Traffic, a month day by day. An administrator's own visits, robots and prefetches are not counted, nothing is sent to an outside service, and visits are kept for 400 days. The Content Manager's traffic screens read the same record; the history recorded before is kept, without its query strings and without robots' visits.

• Added

  five Content Manager permissions: Edit Website Pages, Edit Site Design, Edit Custom Code, Edit Checkout and Client Area, and Edit Site Settings, so a role can be given one part of the website. Manage Content still allows all of it. A page's own CSS and JavaScript and the footer's HTML can be changed only with Edit Custom Code, and previewing a draft page needs Edit Website Pages.

• Added

  sections that show WBAMS's records: Contact Location from the business profile, Testimonials from clients' reviews, FAQs from a knowledgebase category, the Logo Wall from the Logo Gallery, the three gallery sections from the gallery albums, and the Resource List from Downloads. A new section starts on the record; one saved before keeps its typed list until it is switched. Price Panel and Product Groups now list each group's features.

• Updated

  the page builder: on a wide screen the page's sections form an outline and the section you open is edited in a side panel, and every section's settings use the same form.

• Added

  the footer's link columns: Links per Column in Footer Layout ends a longer column in a More link that opens the rest, and Link Icons shows or hides the icons beside the column headings and links. Without scripts the whole column shows.

• Fixed

  payment rules (Content Manager › Checkout › Payment rules) are applied wherever a client chooses how to pay, at checkout and on an invoice, using the client's country and the total in the default currency. Before, they were saved and never applied.

• Updated

  the sitemap: there is one, the live sitemap.xml, and the extra links added in the sitemap wizard are listed in it. The wizard writes no file. A sitemap.xml an earlier wizard wrote, which hid the live one, is put aside once as sitemap.xml.replaced-<date>; one the site placed itself is named on SEO Tools.

• Updated

  the Google Analytics app takes one Measurement ID and sends Google Analytics 4 only, since Google retired the earlier versions. The purchase event carries the currency and the tax, a visitor whose browser asks not to be followed (Global Privacy Control) is not tagged, and the dashboard's Google card reads the same property.

• Updated

  the contact page shows the address with the business name first, then the hours in the visitor's language and the note; its map searches the address alone. Search engines are given the country and the opening hours. WBAMS knows TikTok, Pinterest, Yelp and Google reviews among the social links, and shows X for Twitter.

• Fixed

  invoice and quote PDFs show the business's logo and colour; every client's PDF had shown WBAMS's own logo. Gift receipts show the business's logo too.

• Updated

  payroll: pay every two weeks follows a fixed fortnight, set by A pay period starts on in Employer Policy, and a new pay run opens on the last one to have ended. A run's own deductions box is for one-off deductions; deductions from pay items show beneath it and are no longer counted twice when a run is rebuilt. Saving typed figures keeps leave pay, someone without a pay rate shows No pay rate, and the payslip lists taxable allowances.

• Added

  settings checks for add-ons: an add-on can refuse settings before they are stored (“did not accept these settings, so nothing was saved”), check them once saved, and show how it stands on its card.

• Added

  an address for texts, text-messages.php: the Telnyx SMS and Twilio SMS apps' company posts the texts people send the account's numbers, and the delivery reports of texts sent, there. A request without the account's signature is refused.

• Updated

  a site without a license key opens the admin area on Activate license, where a full administrator enters the key and the site is activated without editing settings.php by hand.

• Added

  an address of its own for the admin area: setup's last page, just before the step that says to delete install/, offers to move control/ to a folder name you type, and names it in settings.php ($customadminpath). The admin area's stylesheets and scripts, the Content Manager, the menu builder, the product builder and the other pages that named control/ now follow the folder wherever it is, and Update WBAMS puts later releases' admin pages in it. Moved by hand, it works the same way.

• Security

  WBAMS's PHP sends X-Content-Type-Options, X-Frame-Options, Referrer-Policy and, on HTTPS, Strict-Transport-Security on every page, so they arrive on hosts where the .htaccess rules never reach PHP's pages. The root .htaccess now sends only nosniff and HSTS, removing PHP's copies first, so no header arrives twice. An upgraded site replaces its protective block with 1.12.0's.

• Security

  a client's name on a review shown in the Testimonials section is printed as text: decoding the section's data ran after the records were filled in, and undid their escaping.

• Security

  the release's file list, SHA256SUMS.txt, is refused over the web: it names every file of the installation with its hash, an exact fingerprint of the site. The rule is part of 1.12.0's protective block, and Update WBAMS adds it to a site's .htaccess that lacks it.

• Security

  page templates (.tpl) are refused over the web. Before, every one of them answered anyone who asked for its path, the theme's pages, the Content Manager's sections and the admin area's pages included. WBAMS reads them from disk, and Update WBAMS adds the rule to a site's .htaccess that lacks it.

• Updated

  the upgrade runs from the installer. It gives an earlier installation's database its current names, keeping every row, then removes the earlier release's files that are no longer used, each only when it is exactly as WBAMS shipped it, and lists files changed on the site, files it could not remove, and add-ons and payment methods 1.12.0 no longer includes. The folder address /install/ opens the installer, and a second upgrade started while one runs stops before it changes anything and says so. Every session is renewed once, so everyone signs in again.

• Removed

  payment gateways: 1.12.0 ships twenty, listed in Set up a payment gateway. A gateway an earlier release shipped and this one does not is left on the site, but WBAMS no longer loads it; a site that takes payments through one sets up a replacement.

• Updated

  payment notices are answered at extensions/processors/callback/. Saving Stripe, Stripe ACH, Stripe SEPA or Stripe Dynamic Payments registers its notices there; a webhook address typed into a provider's own dashboard is changed there.

• Fixed

  the page builder: subtitles kept their bold, italics and links on save; Product Price List Two's note under the table has a field again (saving a page had dropped it); the editor's own marks are no longer saved into formatted text, and are taken out of what was saved before at the next save; a link to a hidden product group or product is kept rather than emptied; choosing a picture from the media library inside a section no longer raises an error; and pictures preview on a site served from a folder.

• Fixed

  an empty Logo Gallery no longer fills the footer's logo strip with other software's logos, and a footer logo at an http:// address keeps it.

• Fixed

  the dashboard's Client Activity panel: Users Online counts the clients who actually signed in within the last hour (accounts made by an administrator or through the API had counted as online), and its list shows real sign-ins.

• Fixed

  pages that stopped on an error page because a built-in list of values was empty: the partner lists, PayPal's disputes, and importing support email from a mailbox. An add-on's own client-area pages open again on sites served over HTTPS.

• Fixed

  a member or staff member asked to sign in by a page is taken back to that page afterwards, rather than always to their People area. System Health's directory check says when it could not run because PHP has no HTTP transport (cURL).

• Fixed

  a fresh install comes with its storage/cache/ folder, which the installer's system check needs, and with the protective files 1.11.0 had in storage/ and in the Content Manager's folder of generated stylesheets.

• Fixed

  the Content Manager dashboard's range buttons (7 days, 30 days and the others) opened a missing page when the dashboard had been reached through an address naming it.

• Updated

  database: Possible duplicates, website traffic and text overrides keep their records in tables of their own. An installation from an earlier release has its tables, columns and settings given their current names first, every row kept.