Leaky Paywall Updates: August 2026

7 releases went out in August, across the core plugin and 6 add-ons. Payment security and subscriber data accuracy were the theme.

The highlights

Stripe signups only get access after payment clears (5.1.7). Before, an abandoned or unconfirmed Stripe payment could open a short window where someone got temporary access without paying. That window’s closed. Access is granted only once payment is confirmed or genuinely in progress.

100% off coupons are working again (Coupons 2.4.7). A bug had broken fully-discounted coupon codes. If you run promotions or comps through 100% coupons, this one’s for you.

SimpleCirc subscribers stop getting wrongly expired (SimpleCirc 2.1.0). SimpleCirc could overwrite a subscriber’s Leaky Paywall expiration with an older date, sometimes expiring someone who’d just renewed. Now it only touches subscribers it actually maintains, and the date only ever moves forward. There’s also a new optional setting (off by default), “Sync Cancellations & Failed Payments,” that sets a subscription to do-not-renew on voluntary cancellation and Expired on a failed or ended subscription.

Registration forms hold up better against bots and slow-loading scripts (Recaptcha 1.4.6, Turnstile 1.3.1). Both now reliably initialize on forms injected after the page loads, like the paywall nag’s quick register form and List Builder, and wait for their verification script even when it loads late or is deferred by a performance plugin.

Category and tag exemptions now support custom taxonomies. If you organize content with custom taxonomies instead of (or alongside) built-in categories and tags, you can restrict or exempt by those too.

Everything else, by plugin

Leaky Paywall (core), 5.1.7

• New “New Paid Subscription” filter on the Transactions list shows initial paid signups only, no renewals or refunds mixed in.
• Two new developer filters: leaky_paywall_free_registration_effective_price lets extensions adjust a registration’s effective price (for coupon discounts, for example) while keeping free vs. paid level validation secure, and leaky_paywall_skip_stripe_sync suppresses the Stripe to Leaky Paywall sync during migrations or bulk corrections.
• Extension installs are more reliable, with a pre-flight check for writable directories and a clear support message, including manual upload instructions, when a download can’t be saved.
• REST API subscriber endpoints got several improvements: expiration only overwrites when you supply a value, you can set a password when creating a subscriber through the API, expiration accepts “never” and rejects dates it can’t parse, and API-driven changes are labeled “API” in the status log so you can tell them apart from admin edits.
• PayPal Standard settings and IPN processing stay available even after you uncheck the gateway, so existing PayPal subscribers keep renewing instead of quietly lapsing.
• The “Subscription Started” event sent to Insights fires only for paid signups now. Free registrations won’t inflate your paid-conversion numbers (paid trials and 100%-off coupons still count).
• Editing a post’s categories, tags, or exemption setting takes effect immediately instead of waiting on the restriction cache to expire.

LP – Basic Shipping, 1.9.2

• The shipping address now saves correctly when a signup finalizes through the Stripe webhook (after a captcha failure, a closed tab, or a 3DS delay) instead of only on normal form submission.

LP – Recaptcha, 1.4.6

• Registrations that skip the reCAPTCHA token are rejected now instead of slipping through unverified.
• The payment form and quick register form no longer fight over the same shared token field on pages that show both.

LP – Turnstile, 1.3.1

• Token handling is refined: the multistep form’s validate-then-submit flow reuses its verification, while single-request forms keep full protection against duplicate submissions.

LP – Authorize.net, 1.3.3

• The payment form can’t be submitted twice anymore (by pressing Enter or clicking a re-enabled button). That used to be able to create duplicate customer profiles and subscriptions at Authorize.net.

LP – SimpleCirc, 2.1.0

• An unrecognized SimpleCirc webhook status no longer defaults a subscriber to active, which could otherwise reactivate someone who’d just been cancelled or expired at the payment gateway.
• The SimpleCirc login role check is now a filterable allowlist (leaky_paywall_simplecirc_login_allowed_roles), so you can allow roles other than subscriber to log in.

New resource: blocking AI scrapers from your content

Most paywalls hide your article with JavaScript. A scraper doesn’t care about that. It reads the page source directly, no login required.

Leaky Paywall’s restriction happens on the server. Uncheck “Alternative Restriction Handling” and we swap the full article for an excerpt and your subscribe message before the page ever leaves the server. Nothing is sitting in the page source for a bot to grab.

We put together a full walkthrough: the settings to check, how to keep your RSS feed from leaking full content, and the robots.txt entries that block known AI crawlers by name. Read the guide on blocking AI scrapers.

Catch up on everything we’ve shipped

View the release archive for every update, plugin by plugin.

That’s August. As always, if you’re not sure whether an update affects your setup, reach out and we’ll walk through it with you. Thanks for being a Leaky Paywall publisher.

Thanks for being a Leaky Paywall publisher.