Native Thickbox integration, Add New Entry, finally done right
A new major: the Add New Entry button opens a native WordPress Thickbox popup with full Gravity Forms support, iframe isolation, and zero theme conflicts.
- Add New Entry now opens in a native WordPress Thickbox modal
- Full Gravity Forms support including conditional logic and complex fields
- Iframe isolation prevents theme CSS conflicts
- Robust nonce verification and role-based access checks
- Responsive popup that adapts to screen size
The 4.0 line is about respecting WordPress’s existing primitives instead of fighting them.
What changed#
In 3.x the “Add New Entry” button rendered the GF form inline below the table. It worked. It also broke on every theme that aggressively reset form CSS, every conditional logic rule that depended on visibility computations, and every page builder that hijacked submission handlers.
4.0 swaps the inline form for a Thickbox modal containing an iframe that loads the GF form in isolation. The result:
- Conditional logic works, because the form runs in its own DOM
- Field validation works, because GF’s frontend scripts boot in the iframe just like a normal GF page
- Theme CSS can’t bleed in, because there’s a document boundary
- Focus trapping is correct, because Thickbox handles it
Security#
Every modal request is gated by:
- A nonce unique to the table-form pair, rotated on every page load
- A
current_user_cancheck against the table’s configured permissions - Server-side enforcement that ignores client-side role spoofing
If the user can’t add an entry, the button doesn’t render. If the request still arrives, the AJAX handler returns a 403 with a structured error.
Performance#
The iframe boot adds ~30ms on broadband. We considered a custom modal but the trade-offs weren’t worth it: ~3KB saved, dozens of edge cases re-introduced.
Upgrade#
This is a breaking version number, but not a breaking upgrade. Existing shortcodes, tables, and column configurations continue to work. The visual change is the modal itself.