What’s new in HiveCRM

Maintenance release: data integrity, notifications and a security hardening of the MCP server. Recommended for everyone.

Security

• MCP server accepts Application Passwords only. The API no longer accepts an account’s regular WordPress password over Basic auth, and no longer matches a bare password against every user. Connect with username:application-password (or OAuth). Existing OAuth connections are unaffected.

New

• Project workspace. A project page now brings everything for that project together: its tasks (add, edit, complete, delete — with assignee, status and due date), notes, files (upload or pick from the media library), the estimates and invoices linked to it (create an estimate or invoice from the project, convert an estimate to an invoice), and a compose email action. Invoices and estimates record which project they belong to.
• Export and import. Settings → Export / Import: export leads, deals, contacts, clients, businesses, projects, tasks, tickets, estimates and invoices to CSV or PDF, with an optional date range. Import from CSV with column mapping, a downloadable template, a preview step, and duplicate handling (skip, update or create).
• Full-page package editor. Packages now have a dedicated create/edit page alongside the quick modal.
• Assigned agent on leads and deals. The assignee is shown on lead and deal lists, overviews and forms.
• Report PDFs render from the top of page 1 with safe page breaks (no more blank first pages or split table rows).

Fixed

• Invoice line items no longer disappear. Updating only part of an invoice — for example clicking “Mark as paid” — overwrote the stored invoice with just the changed fields, wiping items, taxes and discounts. Partial updates now merge into the saved invoice.
• Contact Form 7 leads are captured even when CF7’s own email fails. The integration listened for CF7’s “mail sent” event, so a mail delivery problem meant no lead. It now captures every completed submission, and CF7’s internal fields no longer appear in the lead’s notes.
• Recurring invoices generate again. The scheduled recurring-invoice job stopped with a fatal error on every run.
• No more – in deal titles. Deals converted from leads are titled with a real dash, and a one-time repair decodes HTML entities in any existing lead, deal, contact, project, task, ticket or invoice titles.
• Workflows no longer corrupt accents, quotes and line breaks. Saving a workflow stripped the backslashes out of its stored data, so an accented letter (é, ñ, ü) in an email turned into “u00e9”, line breaks in an email body were lost, and any quotation mark or backslash broke the workflow entirely — it saved, then came back with no actions. Text now round-trips exactly, including accents, quotes, curly quotes, em dashes, emoji and non-Latin scripts. The same fix covers multi-select custom-field values and custom-field text sent as JSON.
  • Workflows saved with an older version: accented letters and typographic punctuation are repaired automatically on the first admin page load. A workflow that was broken by a quotation mark can’t be reconstructed, so if it was active it is switched off — open Workflows and rebuild it. Line breaks lost earlier can’t be recovered; re-check the email bodies of existing workflows.
• Client page shows invoices and totals. The client overview looked up invoices by the wrong link, so the Invoices & Estimates tab was always empty and Total Billed / Paid / Due read $0. It now lists the client’s invoices and estimates with their document numbers and computes totals from invoices only, honouring partial payments; the Clients list’s invoice count is fixed the same way.
• Ticket details show the right people. The requester name and email, the ticket description, and each reply’s author and avatar are displayed correctly; replies no longer all read “Staff Member”.
• “Deal won” fires once. Editing a deal that already sits in a won stage no longer re-logs “Deal won” and re-sends the won notification. The won check uses the stage’s type (or an exact “Won” name) and only on an actual stage change, which is now logged with the stage’s name.
• No duplicate bell notifications. An assignment or creation that was reported through more than one internal path produced two or three identical notifications; now exactly one per person, event and record.
• Notification emails no longer go missing. Two over-eager safeguards were removed: a 60-second window that dropped a second legitimate email to the same person (for example two client replies on a ticket within a minute), and a rule that skipped the system email whenever a workflow could email the same person even if that workflow’s conditions did not match.
• Estimate and invoice notifications work, with the right link. The created, accepted and paid emails for estimates and invoices were wired to a post type that does not exist and linked to a preview URL that does not exist; they now fire and link to the real document page.
• Brevo (Sendinblue) email log shows one row per email instead of a permanent “pending” row plus a result row.
• Plugin header now declares Requires PHP: 7.4 and Requires at least: 6.0, and the OAuth server no longer uses a PHP 8-only function.

1.0.4 — October 16, 2026

Connecting AI assistants is now much easier, email delivery is more reliable, and the dashboard shows real numbers.

New

• One-click MCP connection for Claude Desktop and Claude.ai. OAuth discovery endpoints now answer before anything else on the site can redirect them, support JSON and form token requests, return the iss parameter, and handle cross-origin preflight — so “Add custom connector” in Claude works out of the box. Claude Desktop (native or via mcp-remote), Cursor and Claude Code each have their own setup tab under Settings → MCP Server, with the generated Application Password filled into the snippet for you.
• MCP health check. GET /wp-json/hive-crm/v1/mcp reports server status, version, protocol, tool count and whether the request is authenticated — handy when a client won’t connect.
• Brevo via HTTP API. When Brevo is your email service, HiveCRM now sends through Brevo’s REST API instead of SMTP port 587, which many hosts block. If Brevo rejects your server’s IP, the settings screen shows the IP to authorise with a copy button and a link to Brevo’s allow-list.
• More system emails. New editable templates and notification preferences for: lead assigned, lead converted to deal, deal created / assigned / won, estimate created / accepted, invoice created / paid, task created / assigned, project created, ticket created. Each person can switch any of them on or off under Settings → Notifications.
• Activity timeline now records assignments (“Assigned to …”) and deal stage changes on leads, deals and tasks.

Improved

• Email delivery. Custom SMTP and Brevo SMTP set a proper envelope sender (fewer strict-server bounces), use timeouts, and the email log now distinguishes pending, sent and failed with the provider’s error message.
• Application Passwords are shown without spaces and copied in one click; the “new password” banner can be dismissed, and nothing is kept in browser storage.

Fixed

• Dashboard shows real numbers. Total leads, active deals (open, excluding won), open tickets and pipeline revenue come from the live stats endpoints, with real context lines (“12 new this month · 3 hot”, “Weighted: $18,400”) instead of the placeholder “+12.5% vs last month” and “$0.00”. Counts are no longer limited to the first page of records.
• Your name, not “Admin User”. The dashboard greeting and the header profile show the signed-in user’s name, role (Admin, Manager, Staff…) and avatar.
• & no longer appears in names. Site titles, business names and record titles containing “&” are returned as plain text to the admin app, the client portal, emails and payment providers, instead of HTML-encoded entities.

New

• Clients are emailed when your team replies to their ticket. Every non-internal staff reply (from the dashboard or through an AI assistant) sends the client an email with the reply text and a link that opens the ticket in their portal. Internal notes are never sent.
• Your team is alerted when a client replies from the portal. The assigned staff member (or every admin/manager if unassigned) gets an in-app notification and an email. A new “Client Replied on a Ticket” notification preference lets each person switch the email on or off.
• Both emails are editable templates under Settings → Email & SMTP → System Event Triggers (“Ticket: Reply Sent to Client”, “Ticket: Client Replied”), with placeholders {client_name}, {author_name}, {ticket_num}, {item_title}, {reply_message}, {ticket_url}, {admin_url}, {org_name}.
• Workflows can trigger on ticket replies. New “Replied” trigger event for tickets, plus a “Last reply from (client / staff)” condition field and {last_reply_message} / {last_reply_author} placeholders — for example, “when a client replies, create a follow-up task for the assignee”.

New

• Pay invoices online with Stripe or PayPal. Every unpaid invoice now shows “Pay by card” (Stripe Checkout) and/or “Pay with PayPal” buttons — in the header and in a payment panel next to the totals — for whichever gateways you have enabled under Settings → Payment Gateways. The client is taken to the provider’s hosted, secure checkout and brought straight back to the invoice.
• Automatic settlement. When the client returns, HiveCRM verifies the payment directly with Stripe/PayPal (nothing in the URL is trusted) and marks the invoice paid: amount paid, due = 0, status, gateway, provider reference and a timestamped activity entry. Stripe and PayPal webhooks remain supported as a backup, so an invoice is still marked paid if the client closes the tab. Settlement is idempotent — a webhook and a return for the same payment never double-log.
• Client portal shows a “Pay now” marker on invoices that can be paid online.
• Zero-decimal currencies (JPY, KRW, …) and PayPal’s no-decimal currencies are handled correctly.
• A merchant’s lapsed license never blocks a client from paying an invoice.

Changed

• The WooCommerce “Pay Online” button, which opened an empty WooCommerce checkout, has been removed. The WooCommerce toggle now clearly describes what it does (customer/product/order sync). Routing invoice payments through WooCommerce checkout stays on the roadmap.

Security

• Fixed an issue where CRM records could be read through WordPress core’s REST API (/wp-json/wp/v2/…) without logging in. HiveCRM’s own API was always protected; the core endpoints for HiveCRM record types are now disabled entirely. All HiveCRM data is now only accessible through the authenticated hive-crm/v1 API.

Improvements

• Leads Kanban board now scales to large pipelines. The board loads 50 cards per column with exact per-column totals and a “Load more” button, instead of loading every lead at once. On a 3,000-lead test site this took the board from ~0.8s and a 3.7MB payload to under 0.1s and 127KB.
• Drag and drop on the Leads board. Drag a lead card to another column to change its level. Changes save immediately and revert with a message if the save fails.
• Faster lead lists. Linked contacts and organizations are now loaded in bulk, so list and board views no longer run extra database queries per card.
• The leads API now returns standard X-WP-Total / X-WP-TotalPages pagination headers.

Initial public release. HiveCRM is a complete CRM that runs inside your own WordPress site: leads, deals, contacts, proposals and invoices, projects, tasks, support tickets, a client portal, a visual automation builder and a built-in MCP server for AI assistants. One dashboard, your own database, no monthly subscription.

Sales

• Leads with levels, sources, tags, budgets, assignment to staff, list and Kanban views, server-side search and filtering, one-click conversion to a deal.
• Deals with multiple sales pipelines, custom stages per pipeline with win probabilities and colors, Kanban and list views, weighted pipeline value for forecasting, and per-pipeline stats.
• Contacts (people and organizations) with statuses, tags, custom fields, linked deals, projects and invoices.
• Clients — contacts with billing and portal access, created manually or automatically from a won deal.

Billing

• Estimates & invoices with line items, taxes, discounts, numbering prefixes, due dates and reminders.
• Convert an estimate into an invoice in one click.
• Online payments with Stripe and PayPal, with signed webhook verification.
• Secure, token-based public invoice and estimate pages with PDF download.
• Recurring invoices.
• Products & Packages catalog with pricing, SKU, tax rate, one-time or recurring billing.

Delivery & support

• Projects with statuses, budgets, start and end dates, linked client and deal.
• Tasks with statuses, priorities, types, due dates and assignees, linked to leads, deals, projects or contacts.
• Support tickets with priorities, statuses, threaded replies and internal staff-only notes.

Client Portal

• A self-service portal on your own site for clients: dashboard with amount due and overdue, deals, projects, invoices (view and pay), tickets (open, reply) and account settings.
• Each section can be shown or hidden; new tickets and replies can be allowed or disabled.
• Logo and site name white-labelling; the portal page is created automatically on activation.

Automation

• Visual workflow builder: trigger → conditions → actions on a drag-and-drop canvas.
• Triggers on any record being created or updated (leads, deals, contacts, projects, tasks, tickets, invoices, packages).
• Conditions on fields such as lead source and level, deal stage and budget, invoice status and total, with equals / not equals / contains / greater than / less than / is empty operators.
• Actions: send email (with merge placeholders), create task, add tag, update field, call webhook.
• Run history per workflow showing every match, skip and action result.

AI (MCP server)

• Built-in Model Context Protocol server so Claude, ChatGPT, Cursor and other assistants can work with your CRM.
• 43 tools: search across the CRM; list, get and stats for leads, deals, contacts, clients, projects, tasks, tickets, invoices and packages; create and update leads, deals, contacts, clients, projects, tasks, packages and tags; convert a lead to a deal; create invoices and estimates with line items; update invoice status; reply to tickets. No delete tools by design.
• Connect with an Application Password (Claude Code, Claude Desktop, Cursor) or OAuth with a consent screen (ChatGPT, Claude.ai). The assistant acts with the permissions of the WordPress user who authorised it; connections can be revoked at any time.

Integrations

• WooCommerce sync: customers → contacts, products → packages, orders → deals, with order status changes logged on the deal.
• Form integrations: Fluent Forms, WPForms, Gravity Forms and Ninja Forms submissions become leads (and contacts), with the full submission captured.
• Google Meet and Google Drive integrations.
• Outgoing webhooks on record events, for Zapier, Make and custom endpoints.
• Public REST API with per-module access toggles and Application Password authentication.

Platform

• Roles: Admin, Manager, Staff (scoped to their own records) and Client (portal only), with a full capability map.
• Custom fields on every module.
• Tags across all modules.
• Email: PHP mail, custom SMTP or Brevo relay, with editable templates for every system email and a delivery log.
• In-app and email notifications with per-user preferences.
• Trash with restore for every record type.
• Dashboard with total leads, active deals, pipeline revenue and open tickets.
• Global search across all modules.
• Licensing with automatic updates from the HiveCRM dashboard; a lapsed license keeps your data readable.
• Lightweight footprint: loads nothing on your public pages except the client portal and invoice pages; admin assets load only on HiveCRM screens.