Changelog

What's new

Freeframe is on v1.29.1. Every template is versioned too: each one has its own changelog on its page, and the latest updates are listed here.

Site releases

Changes to freeframe.dev itself. Versions follow semantic versioning.

v1.29.1
Oct 18, 2026
Changed
- The guides for contributors and coding agents are complete for building templates without a coordinator: AGENTS.md and docs/templates/new-template.md now cover keeping demos current (with the patterns to use), fictional contact details (.example domains, reserved phone ranges), the storage-flow and SEO-length checks, merging parallel template branches, a pre-PR checklist and a "working as a single agent" section.
- Template tooling for agents: pnpm templates:check --clock <time> (and scripts/check.js --clock) loads a template at another date to prove its demo won't go stale; scripts/thumbs.js --clock <time> takes thumbnails at a fixed time. The check now also fails on a missing og:image file and on an unknown template name (it used to report "0/0 passed"), screenshots at 390px are full-page, and pnpm templates:storage <slug> says when a template has no blocked-storage flow.
- The end-to-end category filter test reads the expected Store templates from the catalogue, so adding a store template no longer breaks it.
v1.29.0
Oct 18, 2026
Added
- Four new templates, in HTML + Tailwind for now (Next.js, Astro and WordPress versions on request), bringing the total to 53: - Paws: Sweetgum Animal Clinic, an independent vet in Asheville, with appointment requests that remember your pets, a vaccine planner, a price estimator and new-client pages. - Garage: Bellcrank Motor Works, a family car repair and MOT garage in Kidderminster, with a service price checker, booking by registration, an MOT reminder and bank-holiday-aware opening hours. - Chapter: the website of novelist Clemency Thorne, with book-jacket artwork, a new-release countdown, a first-chapter reader that keeps your place, events and book-club guides. - Petal: Hollyhock, a florist in Shrewsbury, with a same-day delivery countdown, a delivery date picker, postcode checks, a basket, flower subscriptions and a wedding flowers estimator.
Fixed
- Template demos no longer go out of date. Dates that would have expired now roll forward from today: Summit's conference, Solstice's festival and the Vows wedding move to next year's edition once they're over, Tempo's album release and tour, Lingua's term, Compass's next cohort, Hearth's seasonal events, Tally's example invoice, Forge's maintenance notice, and "Now booking" months and years in Lens, Soiree, Folio, Studio and Profile. Copyright years are set in the browser, including in 15 Next.js versions that froze the year at build time.
- Next.js versions of Agency, Dashboard, Lens, Market, Stay, Vows, Bloom and Academy now self-host the exact font files the HTML templates use, so text wraps the same as the HTML on every page. Vows and Academy also had small text differences from the HTML (spacing around apostrophes, dashes and "B&B", a doubled search label).
- Dashboard: the analytics heatmap no longer puts days on the wrong weekday in time zones with daylight saving time.
v1.28.0
Oct 17, 2026
Added
- Six new templates, in HTML + Tailwind for now (Next.js, Astro and WordPress versions on request), bringing the total to 49: - Tally: invoicing and bookkeeping software for freelancers in Cork, with an invoice demo, monthly/annual pricing with VAT and a late-payment calculator. - Flow: Salt & Sage Yoga in Falmouth, with a weekly timetable, mat booking and a class-pass calculator. - Soiree: Ivy & Ash Events, a Charleston wedding and event planner, with a budget estimator, a portfolio, a venue guide and an inquiry form. - Sketch: Marnie Draws, an illustrator's course-creator site, with course sales pages, an early-bird countdown, live workshops, free downloads and a student gallery. - Drift: Nightjar, a dark landing site for a sleep app, with a feature tour, a bedtime calculator and sound previews. - Hearth: The Fallow Hart, a pub with rooms in the Yorkshire Dales, with a stay price checker, menus, walks from the door and events.
- All-access: while the bundle isn't on sale (for now every template is free), /all-access shows a "Premium templates are coming soon" page instead of a 404. It explains that today's templates are free under MIT, that premium templates with a commercial license and an All-access bundle are on the way, and offers the newsletter and a link to the free templates. No prices or Buy buttons; it stays out of search results and the sitemap. Once the bundle goes on sale, the usual sales page is back unchanged.
- Template pages: when a template doesn't come in all four stacks yet, a short note under the downloads says "Want this in Astro or WordPress? Request it", naming only the missing stacks. The link opens the requests page with the form already filled in, and keeps it filled in through signing in.
- Requests: /requests?title=…&description=… prefills the request form (cleaned and cut to the form's limits; posting still checks everything on the server).
Changed
- New templates ship HTML-first and are ported when people ask; category pages and the README now say how many templates also come in Next.js, Astro and WordPress instead of assuming all of them do.
Fixed
- 404 pages inside the site (an unknown template, blog post or guide, for example) showed the header and footer twice. Every 404 now has exactly one of each; signed-in areas keep their own "Not found" page.
v1.27.2
Oct 17, 2026
Fixed
- Market (Next.js): choosing a shop category or pressing Reset no longer briefly snaps back to the previous category while the address updates. This also made the shop's interaction test fail at random.
v1.27.1
Oct 16, 2026
Fixed
- Market (all stacks): changing a quantity or removing a line in the cart drawer or on the cart page no longer drops keyboard focus. Focus stays on the same button, moves to the neighbouring line when a line goes, and to the "Shop" link when the cart empties; the quantity announcement now works in every stack.
- Vows (all stacks): pages no longer move focus on load, so keyboard and screen-reader users start at the skip link; focus still moves to the new heading when changing RSVP step. The Next.js registry Reserve button keeps focus without a one-frame delay.
- Interaction scenarios check both fixes, and the Vows FAQ checks wait for the page to settle.
v1.27.0
Oct 16, 2026
Added
- Admin: a Tools group in the sidebar with a link to Google Search Console's search performance report for freeframe.dev.
v1.26.0
Oct 16, 2026
Added
- Refunds have a status. Access ends only once a refund succeeds: a pending refund keeps the buyer's access, a failed one keeps or restores it, and Admin shows a Retry refund button. The Stripe webhook now also handles refund.updated, refund.failed and charge.refund.updated (migration 0011_refund_status).
- Newsletter subscribers that fail to sync to Resend are retried after the next newsletter action and by a daily Vercel Cron job (/api/cron/newsletter-sync, protected by CRON_SECRET). Admin Overview shows how many are waiting.
- pnpm templates:storage runs each template's stateful flows (carts, bookings, saved items, tabs) with storage working and behind the demo sandbox, in every stack; CI runs it.
Fixed
- Template demos: carts, bookings, saved items and view switches did nothing in the sandboxed live demos, because the sandbox blocks browser storage. 15 templates now fall back to in-memory storage when storage is blocked (see each template's changelog).
- Next.js demos: client-side navigation and prefetch requests were refused by CORS.
- Template ports now match their HTML originals in the interaction tests: new Next.js scenarios for Market, Bloom, Vows, Academy and Dashboard found and fixed focus, back-to-top, URL-tidying, form-reset and accessibility differences; Astro Fitness's trial confirmation text no longer runs its sentences together.
- Next.js and Astro template package.json versions match template.json again; a script test checks every version field.
- Two avatar uploads at once could delete each other's photo; saves are now serialised per user.
- Concurrent analytics beacons could overshoot the per-IP and per-visitor caps.
- Analytics didn't count the blog, All-Access and newsletter pages; a test now checks every public page is on the allowlist.
- scripts/audit.mjs read audit errors, crashes and malformed output as zero findings; it now fails.
- WordPress templates: the development dependency qs is pinned to a patched version.
v1.25.2
Oct 16, 2026
Added
- AGENTS.md, a one-page guide to the repository for new contributors and AI coding agents, and docs/templates/new-template.md, the playbook for adding templates in all four stacks.
- pnpm readme:table regenerates the README's template table from each template's version; CI checks it.
Changed
- The FAQ and license docs explain that most templates are free (MIT) and premium templates use the commercial license.
- Developer docs brought up to date: release workflow, CI jobs and known flakes, environment variables, database tables and migrations, template specs and license wording rules.
Fixed
- The site changelog accepts any Keep a Changelog section, including Removed.
- README template versions were out of date for most templates.
v1.25.1
Oct 16, 2026
Changed
- Removed the temporary pnpm minimumReleaseAgeExclude exception for Next.js 16.4.1 from the site and every Next.js template. The release is now older than the minimum release age, so installs no longer need it.
v1.25.0
Oct 16, 2026
Added
- Three new templates, each in HTML + Tailwind CSS, Next.js, Astro and WordPress (43 in total): - Kinetic (Health & Fitness): a personal trainer studio with a goal picker, programmes, client progress charts, a pricing calculator, training tools (plan builder, one-rep max, pace) and session booking with a health questionnaire. - Brief (Business): an independent employment solicitor with fixed fees and a fee estimator, a "what are my options?" check, a deadline calculator, guides and call booking. - Studio (Business): a minimal, Swiss-style design studio with a filterable project index, case studies, a project brief estimator, a journal and a step-by-step enquiry form.
Changed
- The Business and Health & Fitness category pages describe the new templates.
v1.24.0
Oct 16, 2026
Added
- Three new templates, each in HTML + Tailwind CSS, Next.js, Astro and WordPress (40 in total): - Forge (Business): a dark, terminal-style site for a developer API, with code samples in four languages, a live request explorer, a usage-based pricing calculator, a status page with 90-day uptime and a changelog. - Crumb (Business): a bakery and café with click-and-collect preorders, a "fresh out of the oven" bake board, a pickup-slot basket, a celebration cake builder and a café menu with diet filters. - Atlas (Business): a personal site for an independent estate agent, with filterable listings, listing pages with open-house calendar files, a home value estimate, a seller net sheet, an affordability calculator and consultation booking.
Changed
- The Business category page describes the new templates.
v1.23.2
Oct 15, 2026
Fixed
- Tempo, Slice, Solstice and Smile template fixes, released as new patch versions in every affected stack: - Tempo and Slice: form fields that appear after a choice (Tempo's contact topics, Slice's catering delivery postcode) are checked as you type and when you leave them, like the other fields. - Solstice: switching topic on the Get involved form no longer leaves the hidden topic's error messages behind. - Smile: a radio-button error clears as soon as any option is picked; the booking summary shows "First available" when the chosen dentist doesn't offer the new visit type; and each dentist in the booking flow now shows their next opening, as the guide describes.
- WordPress template listings no longer claim Open Graph tags on every page; the themes leave those to an SEO plugin.
v1.23.1
Oct 14, 2026
Security
- Next.js 16.4.1 for the site and all 37 Next.js templates. It fixes two critical remote code execution vulnerabilities (in use cache functions returning typed arrays, and in the Image Optimization API with SVG files) and a denial of service in Server Actions. Each Next.js template gets a patch release with a rebuilt demo; the HTML, Astro and WordPress versions aren't affected.
v1.23.0
Oct 14, 2026
Added
- People vs bots in download stats. Each new download records whether it came from a real browser clicking a download button on the site, a real browser opening a link from elsewhere, or a bot or script (crawlers, link previews, monitors, headless browsers and HTTP tools). Admin shows the split as cards and a filter on the downloads page, a column in the log and CSV export, and per day on the dashboard chart. Nothing extra about visitors is stored, and public download counts are unchanged.
v1.22.0
Oct 14, 2026
Added
- Six new templates, each in HTML + Tailwind CSS, Next.js, Astro and WordPress (37 in total): - Tempo (Media): a band and musician site with a release countdown, a discography you can play, tour dates with calendar files, a merch shop with a cart and a press kit. - Fade (Health & Fitness): a barbershop with live walk-in wait estimates, chair booking by barber and service, a product shop and a gift card builder. - Solstice (Community): a food and music festival with a filterable line-up, a personal timetable that flags clashes, ticket tiers with camping rules and an interactive site map. - Slice (Business): a pizzeria that takes orders online, with a delivery-zone checker, a pizza builder (sizes, crusts, half and half, extras), deals, scheduled pickup or delivery and an order tracker. - Smile (Health & Fitness): a family and cosmetic dentist with online booking, a cost estimator and payment-plan calculator, an emergency guide and a new-patient form. - Orbit (Business): a SaaS site for a shift scheduler, with an interactive schedule demo, a pricing calculator, an integrations directory and a three-step sign-up.
- Media category page (/templates/category/media) for podcast, band and musician templates.
Changed
- The template requests page no longer promises that every template will be free.
- Business, Health & Fitness and Community category pages describe the new templates.
v1.21.0
Oct 14, 2026
Added
- Sort templates by date. The templates page can sort by Newest (when a template was first released) and Recently updated (its latest release in any stack), worked out from the templates' changelogs. Sorted by date, each card shows when the template was added or last updated.
v1.20.0
Oct 14, 2026
Added
- Social images for blog posts, docs and landing pages. Each blog post, docs page and category or stack page now has its own generated 1200×630 image (title, description and, where it fits, the templates it features), so links shared on social networks and chat apps show what the page is about instead of the generic site image. Blog posts use it in their structured data too.
- A new blog post every day, written for what's relevant that day (new releases of the tools the templates use, search and browser changes, seasonal jobs for small-business sites), researched from primary sources and published through the usual pull request checks (docs/blog.md#daily-posts).
Changed
- Blog posts use the same three-column grid as the template cards and related posts under them: the post spans two columns and the contents sidebar takes the third, so the sidebar is wider and shows from laptop widths up.
v1.19.0
Oct 13, 2026
Added
- Blog at /blog, for practical how-to guides: posts grouped by category, each with a table of contents, BlogPosting structured data, template cards and related posts, plus an RSS feed (/blog/rss.xml), sitemap entries and a Blog link in the header and footer. Launches with eight guides: making a small business website, free static hosting, contact forms on static sites, connecting a custom domain, Next.js vs Astro vs HTML, installing a WordPress block theme, customising a Tailwind template and a website launch checklist. Posts are Markdown in apps/web/content/blog/, checked by the tests for metadata lengths and broken links (docs/blog.md).
- Vercel Web Analytics on every page, cookieless, sent without query strings (some of our links carry tokens) and not at all when the browser sends Do Not Track or Global Privacy Control.
- Custom events: downloads, demo and docs opens, stack switches, filters and empty searches, favourites, buy clicks, purchases and refunds, sign-ups, newsletter sign-ups and confirmations, template requests and votes, contact messages and more (docs/analytics.md#custom-events). None carries a name, email address or account ID.
Fixed
- npm run typecheck in apps/web on a fresh checkout whose dependencies were installed with npm in that folder only (no root node_modules): the template build couldn't find fflate. It now falls back to the web app's copy.
v1.18.0
Oct 13, 2026
Added
- Profile photos: upload a photo in Account → Settings instead of pasting a GitHub or Google picture URL. It's cropped to a square and shrunk to 256 px in your browser (which also strips its location and camera details), then stored with Vercel Blob. Uploads go only into your own folder, as JPEG, PNG or WebP up to 1 MB (never SVG), at most 20 a day; changing or removing a photo deletes the old one, and deleting your account deletes it too.
v1.17.1
Oct 13, 2026
Fixed
- typecheck and test failed on a fresh checkout because the files scripts/build-templates.mjs generates (src/generated/) weren't there yet. They now run that build first when the files are missing (scripts/ensure-generated.mjs).
- The download route's function traced every file under public/ (about 22,000, with a build warning) when it only needs the zips; it now reads from public/downloads only.
v1.17.0
Oct 13, 2026
Added
- Newsletter sign-up in the footer of every page, double opt-in: the address is subscribed only after its owner clicks the emailed confirmation link and presses Confirm subscription (opening the link alone does nothing, so mail scanners can't confirm). Confirmed subscribers are added to Resend's contacts for sending newsletters as Resend Broadcasts, and every welcome email has one-click unsubscribe. Bots are dropped quietly (hidden field, minimum fill time, script check), sign-ups are limited per client, an address gets at most one confirmation email per 15 minutes and three a day, and confirmation emails are capped at 50 a day. Admin → Overview shows the number of confirmed subscribers, and the privacy page explains what's kept.
v1.16.1
Oct 12, 2026
Fixed
- The site no longer says every template is free once some have a price. The home page counts free and premium templates ("28 free templates · 3 premium"), its FAQ and license note explain premium templates, and category and stack pages with premium templates say which are free. The footer, about page and search descriptions now say "most of them free" or "free templates" where they used to say all. With no priced templates, the old wording returns.
v1.16.0
Oct 12, 2026
Added
- Three new templates, each in HTML, Next.js, Astro and WordPress (31 templates in all): - Compass (Business): a leadership coach's site, with programs and pricing, a method page, filterable client stories, a self-check quiz that recommends a program, and a booking flow with a calendar and time slots in the visitor's time zone. - Gather (Community): a church site, with a countdown to the next service, a sermon archive with an audio player, an events calendar with add-to-calendar, a small-group finder, online giving and a prayer-request form. - Echo (Media): a podcast site, with an episode archive, episode pages with chapters and a searchable transcript, a player that keeps playing across pages and remembers where you stopped, a sponsor page and a guest application form.
- A Media category.
Changed
- The Business and Community landing pages now mention coaches and churches.
v1.15.0
Oct 12, 2026
Added
- Three new templates, each in HTML, Next.js, Astro and WordPress (28 templates in all): - Prism (Business): a dark site for an AI startup, with a live playground demo, benchmark chart, pricing calculator, developer docs with code tabs, a filterable changelog and careers. - Keystone (Business): a design-build construction and architecture firm, with a filterable project portfolio, case studies with a before/after slider and lightbox, and a step-by-step cost estimator that ends in a quote request. - Wander (Travel): a small-group tour company, with a trip finder, filterable tours, tour pages with departures and a booking widget, destinations, and a journal.
- A Travel category with its own landing page.
Changed
- Stay moves from Business to the new Travel category.
v1.14.0
Oct 11, 2026
Added
- Templates with a price are marked Premium: a badge on their card (whose button now reads "View · $29.00") and next to the category on their page. The templates page gets a Free / Premium filter (?price=) while any template has a price, and searching "premium" or "free" works too.
v1.13.2
Oct 11, 2026
Changed
- A template page's side card now starts with the price and Buy (or, for free templates, the downloads), with the details below. Paid templates no longer repeat the price in the details list.
v1.13.1
Oct 11, 2026
Fixed
- On template pages, the buttons beside the stack switcher (Save, Docs, Live demo, Buy or Download) wrapped onto a second line. They're now a little smaller and fit on one line from about 1200px wide; Buy reads "Buy · $29.00" there (the template's name is still read out to screen readers), and Documentation is "Docs".
v1.13.0
Oct 11, 2026
Added
- All-access bundle: every premium template, including ones priced later, for one price, at /all-access. The admin sets its price under Admin → Purchases; it goes on sale once at least two templates have a price. Buying works like a template (sign in and back, Stripe Checkout, receipt), each download's LICENSE.txt says it came through the bundle, and a refund ends access to everything bought through it. Paid template pages mention the bundle, and Account → Purchases lists the templates it includes with their downloads.
Changed
- The commercial license covers templates bought through All-access (terms updated 2026-10-11).
v1.12.0
Oct 11, 2026
Added
- Buyers get an email from Freeframe when a purchase is refunded, from the admin or the Stripe dashboard: the amount, the reference, and that the template's downloads and commercial license have ended. Stripe still sends its own refund receipt.
v1.11.1
Oct 10, 2026
Changed
- The price on a premium template's page notes that sales tax or VAT is added at checkout where it applies.
- Clicking Buy while signed out now finishes the purchase after signing in: the page starts the checkout by itself once you're back. A new account does so after confirming its email, through the confirmation link.
- Receipts and the admin's revenue say that amounts include any sales tax Stripe collected.
Fixed
- Checkout failed with Stripe Managed Payments ("the product tax code is missing"): templates are now sold with the "Downloadable Software - business use" tax code.
- A publishable key (pk_…) in STRIPE_SECRET_KEY, or a STRIPE_WEBHOOK_SECRET that isn't a whsec_… signing secret, now counts as not configured: templates show "Purchasing unavailable" and the server logs which key is wrong, instead of every Buy failing with "Couldn't start the checkout". A failed checkout now logs Stripe's error type, code and message.
v1.11.0
Oct 10, 2026
Changed
- Paid templates now carry their commercial license automatically: every buyer's download includes a LICENSE.txt made out to them (template, name, email, purchase date and order reference), and its README, DOCS and WordPress headers point to it. Nothing needs adding per template, and free downloads are unchanged.
- The commercial license on /license is final and rewritten in plain English, with numbered sections: unlimited projects for you and your clients, no resale or redistribution of the template, third-party components under their own licenses, and WordPress themes split between the GPL (PHP and block markup) and the commercial license (CSS, JavaScript, images and design). The page and the downloaded LICENSE.txt share one text.
- Template zips always ship the MIT License; a LICENSE.txt in a template's folder is no longer used.
Fixed
- The Lens, Pocket and Vows WordPress themes (1.0.1) named the Launch template's page as their Theme URI and Update URI.
v1.10.1
Oct 10, 2026
Fixed
- Accordions on the WordPress demos (Launch pricing, Pocket pricing and support) didn't open: the demos were published without WordPress's own scripts.
- A template's own LICENSE.txt now ships in its zip, so a paid template's commercial license reaches its buyers; templates without one still get the MIT License.
- Unpublishing or pricing a template now updates the stack and category pages straight away, not up to five minutes later.
- A stack removed from a template disappears from its page after the next deploy instead of offering a demo and download that no longer exist.
Security
- A refund that reaches the site before the purchase itself now still ends the buyer's access.
- Draft and archived templates' zips are no longer downloadable at their public URLs.
- The page-view counter caps how many views one address can record per hour, even without ANALYTICS_SALT. It stores only an hourly keyed hash for this, erased after the hour.
- Preview deployments no longer apply database migrations or sync the template catalogue, since they share the production database.
v1.10.0
Oct 10, 2026
Added
- Roast (Store): a specialty coffee roaster's shop with roast, origin and process filters, product pages with bag sizes and grinds, a subscription builder with price per cup and delivery dates, a cart drawer, a three-step demo checkout, brew guides with a recipe scaler and a wholesale enquiry form, in all four stacks.
- Lingua (Education): a language school website with course filters, course pages, an interactive placement test that recommends a course, a weekly timetable, teachers and a four-step enrolment form with a live fee summary, in all four stacks.
- Notebook (Blog): a personal developer blog with highlighted code and copy buttons, an outline that follows your reading, series, an archive by year, a tag browser and instant search, in all four stacks.
- The Education, Blog and Store categories now have two templates each, so they get their own landing pages.
v1.9.0
Oct 9, 2026
Added
- Landing pages for each stack (/templates/stack/html, nextjs, astro, wordpress) and each category with at least two templates (/templates/category/business, health-fitness, app, portfolio, community, personal): what you get in that stack or kind of site, how to install it, the matching templates and common questions. They're linked from the home and templates pages, every template page and the footer, and listed in the sitemap.
- Page-view analytics of our own, with no cookies, no third party and no personal data: a small beacon records the page, the referring site, the device type and the country, with a visitor code that changes every day. Visitors who send Do Not Track or Global Privacy Control, bots and admin pages are never counted. Admin → Analytics shows views and visitors over time, top pages, referrers, devices, countries, and each template's views, demo opens and downloads side by side. Individual views are kept for 90 days, then only daily totals. Set ANALYTICS_SALT to count unique visitors (docs/analytics.md).
- A privacy page saying exactly what the site stores.
- Each template has its own social sharing image, with its preview, name, tagline and stacks.
- Structured data for search engines: the organisation and site search on the home page, breadcrumbs on every template, guide and landing page, and the templates on each landing page.
Changed
- Template pages have shorter titles and descriptions that fit in search results.
- Live demos, zip files and sign-in pages ask search engines not to index them, so they never compete with the template pages.
- The first templates on the templates and landing pages show straight away instead of fading in, and the code font no longer loads before the page's main fonts.
- The sitemap dates pages by their templates' real release dates and includes the new pages.
- The footer links to the stack and category pages and the privacy page.
Fixed
- Guide pages had no social sharing image.
- The site's description, footer and home page now mention all four stacks (some still said React, or left out WordPress).
v1.8.0
Oct 9, 2026
Added
- Paid templates. When an admin gives a template a price, it's sold through Stripe Checkout (one-time, USD): one purchase unlocks every stack of the template, with future updates. Signed-out visitors are asked to sign in first, and buyers get a receipt email. Every template stays free until a price is set.
- Buyers find their templates in Account → Purchases and on the template page, with a download per stack.
- Admin → Purchases lists sales with search, filters and revenue totals, and refunds a purchase through Stripe, which ends access to the template. Refunds made in Stripe end access too.
- A commercial license for paid templates on the license page, shown once a template has a price. The page says that MIT applies to free templates.
- Setting up Stripe, testing payments locally and handling refunds: docs/payments.md.
Security
- A paid template's zips and WordPress Playground blueprint are no longer reachable at their public URLs: buyers download them through their account, everyone else is sent to the template page. Free templates' files are served as before.
- Purchases are only recorded from signed Stripe webhooks or sessions read from Stripe, and the price always comes from the database.
Fixed
- Stay: a booked night inside the selected dates on the room calendar is readable in every stack (it failed colour contrast).
v1.7.0
Oct 9, 2026
Added
- Next.js versions of the last 10 templates: Folio, Estate, Bistro, Clinic, Fitness, Summit, Nonprofit, Manual, Ledger and Profile (version 1.0.0). Every template now comes in all four stacks: HTML, Next.js, Astro and WordPress.
Security
- Signing up with an address that already has an account no longer reveals that it exists: new accounts confirm by email before signing in, and the owner of a taken address gets a notice instead.
- Posting template requests and voting need a verified email address (with a banner to resend the link).
- The contact form no longer sends an automatic reply to whatever address was entered.
- Names and avatars are validated on the server; avatars only load from GitHub and Google.
- Site owners can't be demoted, banned, removed, edited or impersonated through the admin tools, which show an Owner badge.
- Only published templates can be favourited, and favourite counts skip unpublished ones.
Fixed
- Template fixes in every stack that had them (each template's CHANGELOG has details): - Folio: switching filters quickly no longer hides matching projects; the copy button keeps its label. - Estate: clicking Submit right after typing isn't lost; the newsletter error sits below the field; "Request another time" focuses the name field; switching views keeps the results' spacing. - Bistro: resetting the booking form resets the notes counter and the large-party note; the private dining enquiry message reads correctly for every space. - Clinic: the newsletter error sits below the form; changing treatment updates the booking summary and clears a clinician who doesn't offer it; the brochure notice names the right folder for each stack. - Fitness: ?plan= and ?topic= work in any letter case. - Summit: every speaker page shows sessions and links like the first; ?id= works in any letter case; the workshop count is right; arrow keys on the schedule tabs update the address; star buttons say "Remove" once starred. - Nonprofit: the impact map has no duplicate dot; the minimum-gift message clears once the amount is valid. - Manual: the guides page shows catch {} instead of catch {{}}. - Ledger: reading time counts only the words a reader sees (the demo essay is a 4 min read). - Profile: the footer credits the fonts the template actually uses.
- The account-deleted email describes what was deleted accurately.
- Template docs, documentation pages and site search update when a listing changes.
Changed
- The WordPress comparison and interaction tools can check any stack's demo against the HTML version (--stack nextjs|astro). Dependabot covers every Next.js template.
v1.6.2
Oct 9, 2026
Security
- Admin pages now check for an admin session themselves, and so does every admin data query. Previously only the admin layout checked, and a client-side navigation request (which skips the layout) could read admin pages, including user emails and contact messages, with any session cookie.
- Template demos are served with a sandbox Content-Security-Policy, so they run with an opaque origin even when opened in their own tab and can never use a visitor's freeframe.dev session or storage. The preview iframe no longer lets pop-ups escape its sandbox.
- Deleting an account now always requires the account's password (when it has one), not only for sessions older than a day.
v1.6.1
Oct 9, 2026
Fixed
- Fitness: coach pages accept ?id= in any letter case, like the timetable (HTML, Astro, WordPress). The WordPress default coach page has the same tab title as the others.
- Stay: changing guests on the first booking step no longer prices a room that can't sleep them. The booking switches to the first room that fits and says so, or shows no price when no room is big enough (all four stacks).
- Academy: the HTML version's generated page titles use one SITE_NAME setting.
Changed
- Template CSS builds (HTML, Astro, Next.js) no longer read the documentation, metadata or committed demo builds, so words in the guides can't add unused rules to the stylesheets. No visible change.
v1.6.0
Oct 8, 2026
Added
- WordPress versions of all 22 templates: block themes for WordPress 7.1 (version 1.0.0). Every heading, paragraph, image and button is a block you can edit in the Site Editor, colours and fonts are theme presets for Styles, and the header and footer are template parts. Each theme has a one-click setup screen that creates its pages and menu, page patterns for building new pages, translation templates, a full DOCS.md, and the same design and interactive features as the HTML version. Ledger's essays are real WordPress posts with writers, topics and tags; Manual builds its sidebar, outlines and search from your pages.
- Try in WordPress Playground on each WordPress template: the theme opens in a complete WordPress site running in your browser, with its pages set up.
- Live WordPress demos at /demos/wordpress/<slug> and WordPress downloads (installable theme zips).
- "Install the WordPress theme" in Getting started, and WordPress in the stack guide, deploying, forms and FAQ guides.
- CI runs every WordPress theme in WordPress (PHP 8.3 and 7.4, debug mode, block validation, Theme Check) and checks its demo is up to date; Dependabot covers the themes' build tools.
Changed
- The collection now has 78 template stacks: all 22 templates in HTML, Astro and WordPress, 12 also in Next.js.
Fixed
- Template fixes found while porting to WordPress, in every stack that had them (see each template's changelog): Bloom no longer breaks on ?service=constructor and escapes names; Bistro's page headings are inside the main content, bookings are limited to two months ahead and confirmations say "1 guest"; Market's "Reset filters" also resets the sort; Dashboard's collapsed sidebar button says "Expand sidebar"; Stay restores saved guests to fit the room; Academy keeps lesson titles' casing and resets invalid streaks; Estate shows content without JavaScript; Folio's filter animation plays; Clinic's aftercare lists and star ratings, Agency's and Nonprofit's menus, Ledger's landmarks and Vows' FAQ hint are fixed; and more.
v1.5.0
Oct 7, 2026
Added
- Astro versions of all 22 templates (Astro 7, TypeScript, Tailwind CSS v4, static output, version 1.0.0): the same pages, design, copy and interactions as the HTML versions, with shared layout and header/footer components, repeated content rendered from typed src/data/*.ts files, and a full DOCS.md guide each. Live demos at /demos/astro/<slug>, Astro downloads and an Astro tab in each template's documentation.
- Astro and WordPress as template stacks (WordPress themes are coming soon): stack filters, badges, download options, admin charts and the "Choosing a stack" guide include them.
- CI installs, lints, type-checks, checks and builds every Astro template, and runs axe on every Astro demo in light and dark themes. Dependabot keeps Astro templates up to date.
Changed
- The collection now has 56 template stacks: 22 templates in HTML and Astro, 12 also in Next.js.
Fixed
- Template fixes found while porting to Astro (see each template's changelog): phone fields in Estate and Bistro accept only phone numbers again; Estate, Clinic and Summit use the right local or event date; Estate, Fitness, Summit and Lens ignore unknown or prototype-named URL values (?id=constructor) instead of showing empty or broken pages; Launch's trial note meets contrast and its comparison table can be scrolled by keyboard; Manual, Ledger and Profile fix heading order, keyboard-scrollable tables and code, 404 indexing and tampered theme settings; Pocket's "send another message" works; Stay says "1 adult, 1 child"; Vows hides back to top while the menu is open; Bistro and Clinic mark the current page in the mobile menu.
v1.4.0
Oct 7, 2026
Added
- Full documentation for every template: a DOCS.md guide for each of the 34 template stacks (22 templates, 12 also in Next.js), covering setup, structure, customising, every interactive feature, connecting forms to a backend, saved data, SEO, accessibility, deploying and troubleshooting. Guides ship in the downloads.
- Template documentation pages at /templates/<slug>/docs, with a tab per stack, table of contents and version information; "Documentation" links on template pages and cards.
- A documentation section at /docs with 11 guides (getting started, choosing a stack, customising, Tailwind CSS, forms and backends, deploying, SEO, accessibility, versions, FAQ, license), sidebar navigation and search (Ctrl/⌘K) across the guides and every template's documentation.
Changed
- Documentation is rendered at build time with syntax highlighting in WCAG AA-contrast themes.
- Template guides, readmes and changelogs are no longer copied into public demo folders (they stay in the downloads).
Fixed
- Template fixes found while documenting (see each template's changelog): Market forms now submit their fields; Bistro, Clinic and Fitness use the business's time zone for opening status and booking times; Summit ticket prices come from one place; Handy quotes are deterministic and identical across stacks; Bloom team bookings respect each person's diary; Vows calendar files escape semicolons; Lens content is visible without JavaScript; and more.
- Production builds no longer fail intermittently when Neon drops a connection while prerendering pages.
v1.3.0
Oct 6, 2026
Added
- Eight new templates, each in HTML + Tailwind CSS and Next.js (version 1.0.0): - Stay (Business): boutique hotel with live room pricing, availability calendar and a booking wizard. - Counsel (Business): law firm with practice areas, attorneys, case results and insights. - Handy (Business): home services with an instant quote calculator and service-area checker. - Bloom (Health & Fitness): salon and spa with a booking wizard and gift cards. - Academy (Education): online courses with a filterable catalogue, curriculum and student dashboard. - Pocket (App): mobile app landing page with phone mockups, release notes and a press kit. - Lens (Portfolio): photographer portfolio with galleries, lightbox and client proofing. - Vows (Personal): wedding site with countdown, RSVP, calendar invites and a registry.
- New template category: Education.
Changed
- The collection now has 22 templates, 12 of them also in Next.js.
v1.2.0
Oct 6, 2026
Added
- Admin inbox pagination and search (50 per page across name, email, topic and message); template requests are filtered, searched and paginated on the server.
- Accessibility (axe) scans for every page of every template, a localStorage robustness check for templates, and checks for the committed Next.js demo builds (pnpm templates:storage, pnpm templates:demos).
- Dependency audit in CI (pnpm deps:audit) with an explicit, expiring allowlist, plus a weekly CI run.
- ADR 0006: Neon everywhere.
Changed
- Neon everywhere. The in-process PGlite database is gone: DATABASE_URL (Neon) is required in every environment. Local development uses a Neon dev branch; tests run in isolated schemas of a test branch; CI creates a throwaway schema-only Neon branch per job and deletes it afterwards.
- Template previews on detail pages run in a sandboxed iframe, isolated from the site's origin.
- Template packaging refuses to publish sensitive files (.env, keys, credentials, .git) and only includes an explicit set of dotfiles.
- 16 templates updated to 1.1.1 (accessibility contrast and ARIA fixes, hardened saved data).
Fixed
- Market (HTML and Next.js): a malformed or tampered saved cart no longer crashes the page; quantities are clamped and prices always come from the product list. Saved lists in Estate, Fitness and Summit, and saved settings in Dashboard and Docs, are validated too.
Security
- Resetting a password now signs out every existing session.
- Closed an open redirect after sign-in (/\t/evil.example and similar inputs were accepted).
- Better Auth's origin check is enforced explicitly, including in tests.
- Contact form and request limits are keyed to the client (hashed IP) as well as the email address, and are atomic under concurrent submissions; anonymous downloads are de-duplicated and capped per client.
- Admin access from ADMIN_EMAILS always requires a verified email address.
- The template QA server only serves the template being checked, rejects dot-paths, traversal and malformed URLs, and listens on 127.0.0.1 only.
- Patched esbuild in the tooling chain via an override.
v1.1.0
Oct 5, 2026
Added
- Back-to-top button on the public site and the account and admin dashboards.
- Public /changelog page with site releases and a feed of template updates.
- Version badges and per-template changelogs on every template page.
- Site version and changelog link in the footer.
- sitemap.xml, robots.txt, canonical URLs and structured data (JSON-LD) for templates.
- Error pages for the site, account and admin areas, plus a global error fallback.
- Environment variable validation at startup with clear error messages.
- Security headers: HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and frame restrictions.
- Rate limiting for sign-in, sign-up, password reset and the contact form.
- Test suite, continuous integration and full documentation for the repository.
- Documentation for the Next.js template versions, versions and changelogs on /docs.
Changed
- Template data is loaded once per request instead of once per component.
- Admin user actions no longer show internal error details.
- Light-theme brand orange is darker (#c2410c) so text and buttons meet WCAG AA contrast.
- Every template is now version 1.1.0 with its own changelog and a back-to-top button.
Fixed
- Admin actions with malformed input return a friendly error instead of crashing.
- Template social sharing images are PNG instead of SVG, so link previews show on social sites.
- Repeat downloads of the same file by the same signed-in user within 10 minutes count once.
Security
- Admin access from ADMIN_EMAILS is granted only after the email address is verified.
v1.0.0
Oct 5, 2026
Added
- New website on freeframe.dev, built with Next.js 16, Tailwind CSS v4 and shadcn/ui.
- Accounts with Better Auth: email and password, GitHub sign-in, email verification and password reset.
- Account dashboard: favourites, download history, template requests and account settings.
- Admin dashboard: statistics, template listing controls, users, messages, requests and a download log with CSV export.
- Neon Postgres database with Drizzle ORM, and transactional email through Resend.
- Next.js versions of the Launch, Dashboard, Agency and Market templates, with live demos.
- Download tracking, favourites, and community template requests with voting.
Changed
- The old GitHub Pages site now redirects to freeframe.dev.
v0.2.0
Oct 4, 2026
Added
- Eight new multi-page HTML templates: Agency, Dashboard, Estate, Clinic, Fitness, Summit, Nonprofit and Docs.
- Social preview image and "more templates" suggestions on template pages.
v0.1.0
Oct 3, 2026
Added
- Static template gallery published on GitHub Pages.
- Six multi-page HTML + Tailwind CSS templates: Launch, Folio, Ledger, Bistro, Profile and Market.

What's new

Site releases

v1.29.1

v1.29.0

v1.28.0

v1.27.2

v1.27.1

v1.27.0

v1.26.0

v1.25.2

v1.25.1

v1.25.0

v1.24.0

v1.23.2

v1.23.1

v1.23.0

v1.22.0

v1.21.0

v1.20.0

v1.19.0

v1.18.0

v1.17.1

v1.17.0

v1.16.1

v1.16.0

v1.15.0

v1.14.0

v1.13.2

v1.13.1

v1.13.0

v1.12.0

v1.11.1

v1.11.0

v1.10.1

v1.10.0

v1.9.0

v1.8.0

v1.7.0

v1.6.2

v1.6.1

v1.6.0

v1.5.0

v1.4.0

v1.3.0

v1.2.0

v1.1.0

v1.0.0

v0.2.0

v0.1.0