What's New for Store Owners in This Release

This update for PrizeX, BidKing and RaffKing is mostly about trust: emailed links and visitor countries that can't be faked, and payments, top-ups, transfers and adjustments that happen once, even when someone taps twice. One thing needs you before or right after you update: a Site URL under Settings › General. It also makes storefront pages lighter, gives you a robots.txt with a setting for AI crawlers, and fixes a handful of things you or your customers may have noticed. Here's what changes for you, grouped so you can skip what you don't run.

Who gets what

• Core changes reach every edition: PrizeX, BidKing Starter, BidKing Plus, BidKing Pro and RaffKing Standard.
• Changes to a plugin or add-on reach the stores that run it; each item below says which.

1. Security

• Emailed links always use your Site URL. Password resets and every other emailed link with a secret in it are now built from the Site URL under Settings › General. Before, a store with no Site URL built them from the address the visitor's browser sent, so someone could get a real reset link for another account, admins included, pointing at their own server. Campaign emails' {{site_url}} is your Site URL too. Every edition.
• If your store has no Site URL, set it. Until it's set, password resets, account invites, newsletter confirmations and unsubscribe links aren't sent, and no marketing email goes out. A strip at the top of the admin says so, and an Administrator can save the Site URL from it in one click. If you're locked out of the admin, whoever runs the server can set it with php bin/set-site-url.php https://your-store.example.
• Visitors can't choose their own country. A visitor can no longer set their country or address by sending a header such as CF-IPCountry or X-Forwarded-For. Cloudflare's country is believed only when the connection really comes from Cloudflare, with no setting needed. A visitor whose country can't be told is no longer counted as being in the United States: they pay the tax rules you add for Unknown country (default) in Tax rules. If you have country-wide US tax rules and no default rule, the update copies your US rules as the default once, so those visitors are taxed as before. Every edition.
• A warning about PHP2Shell. When your server runs a PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the admin and the installer say it may be affected by PHP's own flaw (CVE-2026-109618, CVE-2026-109619), with a link to PHP's release notes. It's a bug in PHP, not in your store: see our PHP security update. Nothing is blocked, and an admin can hide the warning for that PHP version.
• Log in as customer can't spend their money. While staff are logged in as a customer, checkout, top-ups, bids, wallet payments, withdrawals and transfers are refused with a message, and each refused attempt goes in the admin log with both names. Every edition.
• A limit on sign-ups from one network. Once 20 accounts have been made from one internet address within 24 hours, the next sign-up from it is refused and recorded in the fraud log. You can change the number under Settings › Sign-up & compliance; 0 never refuses. Every edition.

2. Money and payments

• Wallet top-ups happen once. The Pay button switches off as soon as it's tapped, so a double tap no longer opens two payment requests. A second top-up for the same coins at the same price within ten seconds goes to the first one's payment page instead of starting another; a top-up for a different number of coins is always its own request. Every edition.
• Admin wallet adjustments happen once. A double click or a resubmitted page no longer credits or debits a customer twice, and the Transactions screen labels the row as an admin adjustment. Every edition.
• Wallet transfers happen once. With the Wallet Transfer add-on, a double tap, or the app retrying after a timeout, gets the first transfer back instead of sending the coins again.
• Late payments aren't lost. With the Nagad, SSLCommerz or M-Pesa add-on gateways, a confirmed payment for an order nothing can deliver right now, because the add-on it was for is switched off, is listed on Payment Requests for you to review instead of going unnoticed. With Nagad and SSLCommerz, a payment confirmed after its request was already paid or closed is kept for you too: it's never credited twice, and the buyer is told it's held for the store.
• Abandoned payments expire. A payment request the buyer gave up on at the gateway, such as a card checkout they closed, now expires instead of waiting as pending. Every edition.
• Offerwall reversals are checked. In PrizeX, Offerwalls now takes coins back for a reversal only when it comes from an address in the offer's Network IPs (needed for reversals) field. Completions are paid as before, but until you fill it in, reversals are refused and logged. The Offerwalls page warns about offers without it.
• eSIM refunds wait for delivery. With the eSIM Store add-on, a refund made while an eSIM is being delivered waits for the delivery to finish, so a customer can't end up with both the eSIM and their coins back.
• Second payments are kept, not lost. With Mollie, Razorpay or Authorize.Net, and with the Paystack or Venmo add-on, a payment that goes through after its order was already paid another way is kept under Payment requests for you to refund, and the buyer is told so. Going back to the Mollie payment page reuses the open payment instead of starting a second one, and a Mollie or Paystack payment the buyer already completed is still credited if you switch that gateway off before it's confirmed. Venmo now starts in sandbox mode when it's installed. Mollie, Razorpay and Authorize.Net come with every edition.
• Seller items are paid with withdrawable coins. A marketplace seller's group-buy, subscription or pre-order, including a pre-order deposit or balance and a subscription's first payment, is paid from withdrawable coins only, so bonus and game-winning coins can't become a seller's earnings. If there aren't enough, nothing is taken and the message says why. A new choice under Settings › Wallet decides whether spend-only coins are accepted on the store's own group-buys, subscriptions and pre-orders. Ordinary items pay as before.
• Stuck payment reviews close. When a gateway said a request was paid but it couldn't be settled, marking its review entry Sorted another way or Not owed now closes the request and releases the stock and coupon it held. Nothing is credited. Every edition.
• A payment isn't listed as paid twice. Reloading an order an older gateway add-on settled no longer lists its payment under Paid a second time, and a payment already kept for review isn't listed again, so the same money can't be refunded twice. Every edition.

3. Lighter pages

• Smaller pictures. Product and listing thumbnails are sent as WebP to browsers that take it, and storefront banners are resized instead of sent at their uploaded size. Every edition.
• Fewer files per page. The store's own stylesheets are joined into a few files, and icons come from a set that holds only the icons your store uses. Every edition.
• Fewer live-bid requests. On auction pages, the bid display and the list share one request for live bids instead of two. While a lot is about to end, the list checks for changes less often than before, and each card still asks about its own lot the moment its clock runs out. PrizeX and every BidKing edition.
• Less work for busy public pages. When many visitors who aren't signed in have the same live list open, the store can answer their refreshes from a copy a few seconds old instead of building the page for each one. Signed-in visitors always get a fresh page.
• Lighter animations. The page-change loader in several themes, the shine on game tickets and the glint on some spin buttons move without redrawing the whole page. They look the same.

4. Settings for store owners

• Your own robots.txt. Your store now answers /robots.txt. It asks search engines and other crawlers to stay out of the admin, account, cart and checkout pages, so they spend their visits on your listings. The sign-in, sign-up and password pages ask search engines not to list them. A robots.txt file you keep in your site's folder still takes its place.
• Block AI crawlers. In Pages & Policies, open SEO Optimization. The new Block AI crawlers setting is off until you turn it on. Its help text says: "Asks the crawlers that collect pages for AI models and AI answers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot and others) to stay off your site. Ordinary search engines such as Google and Bing still list your pages, but AI search (ChatGPT search, Perplexity) stops listing them while this is on. A crawler that ignores robots.txt is not stopped."
• Amount format. Under Auto translations › Settings › Numbers, Amount format lets you choose how amounts are written, such as 1,234.56 or 1.234,56, and where the currency symbol goes. Your cart, checkout, payment, wallet and order pages and emails follow it; add-ons and themes follow as they're updated. Nothing changes until you pick another format.
• A wallet balance that never reads high. On a phone, the short form of the balance (K, M, B) no longer rounds up, and the exact balance now shows in a smaller line under it. Every theme that shows the short form.
• Translation reviews apply everywhere. Approving, editing or rejecting a machine translation on the Translations screen now applies everywhere the same text appears. To change one item only, edit it for that item.

5. Fixes

• Checkout: an address added during checkout shows all its parts, links in My orders open every order, and the pay buttons work again after coming back from a payment page.
• Order pages show order numbers correctly in right-to-left languages, and order statuses in the customer's language.
• Shared hosting: several stores on one database server no longer hold up each other's scheduled jobs.
• Stores on nginx: the example server config no longer serves PHP files as downloads. If you set up nginx from an earlier copy of nginx.conf.example, update the catch-all rule in your server block.
• Previewing the store in another language from the admin, or opening an address with ?lang=, now shows that language throughout the page, error pages and add-on wording included, instead of the language the visitor saved. Every theme.
• Auto translations take far less room. Each machine translation is stored once per text and language, instead of once for every listing and field that repeats it. Existing translations move over in the background and stay shown while they do. A translation that came from a backup service, which doesn't follow your glossary or brand-name choices, is now asked for again later instead of being kept for good. Every edition.
• Refunds: an add-on can keep part of an order back from refunds, and the refund panel shows it on its own line. Buy X Get Y uses it for a free item's value. A cancelled order refunded all but that part no longer sits in Refund owed.
• Busy checkouts: on a store with few payment requests, confirming one payment no longer holds up another customer's checkout.

After you update

1. Check that Settings › General has your Site URL, before you update if you can. Without it, password resets and invites aren't sent.
2. Install the update from Software update in the admin, as usual, and update any plugin the admin flags.
3. Open Tax rules and check the Unknown country (default) rules: they now apply to visitors whose country can't be told. If your store sits behind a proxy or load balancer, list it in TRUSTED_PROXY_IPS in .env; Settings › Server check tells you if it's needed.
4. If you run Offerwalls, open each network offer and fill in its Network IPs from the network's documentation or dashboard.
5. Decide whether you want Block AI crawlers on, and open /robots.txt on your store to see what it asks.
6. If amounts in your country are written differently, pick your Amount format.

Common questions

Do I need to do anything after updating?

Make sure Settings › General has your Site URL: without it, password resets and invites aren't sent. Then check your Unknown country (default) tax rules. If you run Offerwalls, add each network offer's Network IPs, so reversals are taken back again. Block AI crawlers is off until you turn it on, so decide whether you want it.

Will my prices or balances change?

No. The amount format only changes how amounts are written, and nothing changes until you pick another format. A shorter wallet balance on a phone is only a display: the exact balance is shown under it.

Does Block AI crawlers stop AI companies reading my store?

It asks them not to. robots.txt is a request that well-behaved crawlers follow, and a crawler that ignores robots.txt is not stopped. Ordinary search engines still list your pages.