Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 10 of 24 - 710 releases, newest first.
Critical: image uploads were completely broken on some servers
Fixed
- On hosting where PHP's optional "fileinfo" extension is disabled, every image upload failed with a "mime_content_type" error - the editor's image dialog, the Pinterest image and the media library were all affected. The file type is now detected through a chain of safe fallbacks (including reading the image header directly), so uploads work on every hosting configuration. If your uploads were failing, update and try again - no other action needed.
Google Console: weekly email digest + rising/declining queries + opportunity list + cache fix
Added
- Weekly performance digest by e-mail: every week the plugin compares the last 7 days of Search Console, Analytics and AdSense with the previous week and sends a compact summary (with ▲▼ trends and the week's top queries) in the site language. Enable it in Settings; runs on the server cron, retries gracefully and never double-sends.
- Rising / declining queries: the Search Console tab now compares the selected period with the previous one and lists the queries that gained and lost the most clicks - including queries that disappeared entirely.
- Opportunity queries: keywords that show often in Google (ranking 4-20) but get few clicks - the fastest wins for title/description improvements, sorted by impressions.
- Pages losing traffic: content-refresh candidates ranked by click loss versus the previous period.
Fixed
- The API response cache effectively never worked on servers where PHP and MySQL run in different time zones: expiry times were written with the PHP clock but checked against the MySQL clock, so every cached entry was born already expired (by the zone offset) and every panel visit hit Google's APIs live - this is why the panel could feel slow or unstable. Expiry is now computed on the database clock.
Contact Form: reply from the panel + bulk actions + CSV export + phone field
Added
- Reply from the inbox: write your reply under the message and send it by e-mail without leaving the panel - the visitor receives it with their original message quoted, and the message is marked "replied" with the reply stored on the record. (The "replied" status existed but nothing ever set it; the old Reply button just opened your mail app.)
- Bulk actions: select multiple messages and mark read / spam / archive / delete in one go, plus one-click CSV export of the inbox (Excel-ready, with spreadsheet-formula injection neutralized).
- Optional phone field: enable it in settings and the form shows a phone input (validated loosely for international formats); the number appears under the sender in the panel and in the notification e-mail. Themes that pass their own field list are unaffected.
- Auto-reply personalization: the {name} tag in the auto-reply subject and body is replaced with the sender's name.
- Field-level error display on the form: validation errors now appear under the exact field and the first one is focused - the styling for this existed but was never used; visitors only saw a generic "check the form".
Fixed
- Spam-flagged messages were stored without any cap - a bot flood could grow the table indefinitely (the "no message is ever lost" design kept everything). The newest 300 spam records are now kept and older ones pruned, matching the Form Builder's protection.
Form Builder: conditional logic + multi-step forms + smarter validation
Added
- Conditional logic: any field can be shown only when another field meets a condition (equals / does not equal / is empty / is not empty / contains). Hidden fields are skipped by validation and never stored - the server re-evaluates every condition itself, so hand-crafted requests can't smuggle values in.
- Multi-step forms: drop a "page break" between fields and the form turns into steps with a progress indicator and back/next buttons; each step validates before advancing, and with JavaScript off everything gracefully falls back to a single long form.
- Per-field error display: validation errors now appear under the exact field (with the wizard jumping back to the right step and focusing it) instead of a single generic message.
- Multi-checkbox groups: a checkbox field with options now renders one checkbox per option, with "at least one required" enforced in the browser and on the server. Previously the options were validated but never rendered - the form always showed a single box.
- Duplicate form action in the list, and "redirect after submit" now actually redirects in the no-page-reload (AJAX) flow too.
Fixed
- A field saved without a width value (via the API or programmatically) crashed the save with an "Undefined array key" error; the admin form always sent a width, which masked it.
- The confirmation redirect URL is now validated when saving - non-http(s) addresses are rejected instead of being passed to the browser.
Web Push: campaign composer + click statistics + welcome notification + background secret-decryption fix
Added
- Campaign composer: write and send any notification (title, message, target URL, large image) to all subscribers from the admin panel - until now the panel could only send a fixed test message.
- Broadcast history with click tracking: every send (new post, campaign, test) is logged with delivered/failed counts, clicks and CTR. Clicks are counted by a lightweight beacon from the notification itself - no third-party service, no personal data.
- Welcome notification: optionally greet each new subscriber with a one-time, customizable notification the moment they subscribe - they immediately see that notifications work.
- Configurable opt-in button: position (bottom left/right), custom label, show delay, and a dismiss (✕) that snoozes the prompt for a configurable number of days. Previously the button was fixed, undismissable and shown forever.
- Rich notifications: new-post pushes now carry the post's featured image as a large picture on supported platforms; campaigns can attach one too.
- Subscriber analytics on the panel: growth in the last 7/30 days and a browser breakdown.
Fixed
- Background jobs (cron, deferred sending after the page is delivered) could silently fail to decrypt stored secrets: if any output had already been produced when the security layer initialised, session setup threw and decryption returned empty - for Web Push this meant the whole broadcast was silently skipped with an unusable VAPID key. Session configuration now degrades gracefully after output has started, so encrypted secrets remain readable in every background context.
Quiz: premium engine (timer, instant feedback, question bank, weighted personality) + fixes
Added
- Time limit per quiz: a countdown runs while playing and the quiz auto-submits with the answers picked so far when time runs out.
- Instant feedback mode: as soon as the reader picks an answer, right/wrong (and the explanation, if enabled) is shown before moving on. Correct answers still never appear in the page source - each check is answered by the server, and the endpoint only responds for quizzes that opted in.
- Question bank: shuffle question order and/or serve a fixed number of questions from the pool on every run - each play gets a different quiz. Scoring uses the served count, not the pool size.
- Weighted personality engine: every answer can carry points and the result card is chosen by the point total - the standard model of premium personality quizzes. Trivia scoring is unchanged.
- Result sharing: copy link, X, WhatsApp and Facebook buttons on the result screen, with the score or personality result in the share text.
- Duplicate quiz action in the admin list, drag-to-reorder questions in the editor, and a working media picker for quiz, question and answer images (the old "Browse" button always fell back to "enter the URL manually").
- The standalone quiz page now emits Quiz schema (JSON-LD) - deliberately without questions or answers, so correct answers stay out of the page source.
Fixed
- On themes that pre-parse content (e.g. to build a table of contents), the embedded quiz lost its stylesheet and script - questions never rendered. The assets now travel with every embed, and the view counter no longer double-counts on those themes.
- When editing an existing quiz, the field labels showed raw template code ("${QI18N.qText}") instead of text.
- The admin quiz screens mixed Turkish and English ("No quiz plays yet yok.", untranslated settings and buttons); the share image URL of the standalone quiz page was relative, so social preview cards came out empty.
Recipe Cards: visual recipe editor in the post editor + premium card features
Added
- The post editor gained a full Recipe panel: structured ingredient rows (quantity, unit, name, note) with group headings ("For the sauce"), drag-to-reorder steps with optional step photos, minute-based time fields with automatic total, servings, difficulty, course/cuisine suggestions, nutrition facts and an FAQ builder. Until now this rich recipe data could only be produced by the AI content pipeline - writing a recipe by hand meant raw ISO-8601 duration codes in the SEO schema panel.
- Bulk paste: paste a plain ingredient list ("200 g flour") or numbered steps and the panel splits quantity, unit and name into rows automatically.
- Recipe video support: paste a YouTube, Vimeo or mp4 link - the card embeds the player and YouTube videos are added to the Recipe schema as a VideoObject (eligible for video rich results).
- Cook mode on the recipe card: one tap keeps the phone screen awake while cooking (on supported browsers; the button hides itself elsewhere).
- "Copy list" button on the card copies the ingredient list - including scaled quantities when the reader changed the serving count.
- Printing now prints only the recipe card, not the whole page; a Notes/tips box and step photos are shown on the card as well.
- The [recipe] shortcode places the card wherever you want inside the content - and works on every theme, not just the recipes theme.
Fixed
- On a recipe post without a usable image, the plugin correctly skipped the Recipe schema node but silently dropped the FAQ schema with it - FAQ rich results were lost on exactly the posts that needed them. The FAQ schema is now emitted independently.
- Recipe difficulty was displayed in raw English data tokens ("easy") on Turkish sites; known values are now shown in the site language.
- Step photos were included in the schema but never shown to readers on the card; they now appear under their step.
Stories audit: "Latest Posts" statistics + navigation fix
Improved
- The whole plugin was re-verified live: poll vote integrity, per-visitor replay windows, reaction-switch accounting, slide ownership checks and the sanity of the new virtual-story validation (unknown posts rejected, polls not accepted on the automatic story).
Fixed
- Views, link clicks and emoji reactions on the automatic "Latest Posts" story were silently discarded by the server - visitors saw the reaction animation but nothing was ever counted, and the statistics page had no trace of the story most sites use the most. These events are now recorded (with the same replay protection as manual stories), reactions show up in the ambient emoji stream, and the statistics page gained a dedicated "Latest Posts" card breaking performance down per post.
- With "auto-advance to next story" turned off, swiping or tapping to the next story closed the viewer entirely instead of advancing. That setting now only controls what happens when a story finishes on its own - manual navigation always moves to the next story.
Web Push audit: no subscriber misses a notification + dead-subscription cleanup
Improved
- When the browser rotates a push subscription, the service worker now re-subscribes automatically instead of silently going quiet. Sending got faster on large lists (the signed authorization is computed once per push service instead of per subscriber) and the delivery connection is explicitly TLS-verified with redirects refused. The whole plugin was re-verified live against a mock push service: crypto self-test, dead-endpoint pruning, budget cursor, tick lock and intake validation all confirmed.
Fixed
- On sites with many push subscribers, publishing a post only notified as many browsers as fit into the sending time window - the rest simply never received that notification. Sending now remembers exactly where it stopped and continues in the background (server cron and page-triggered fallback, with a lock so no browser is ever notified twice) until every subscriber has been reached.
- Subscriptions that kept failing without properly expiring (persistent errors, unreachable endpoints) were retried forever on every publish, eating the sending window. After 8 consecutive failures a subscription is now cleaned up automatically.
- A subscription registered with a valid push service but corrupt encryption keys was accepted and then failed on every send; keys are now validated byte-for-byte at registration.
AI Images audit: pin domain fixed + scaling and provider improvements
Improved
- The visual-concept helper now uses the same hardened network settings as image generation (strict TLS, no redirects, response size cap), and the generation log cleans up entries older than 180 days by itself. The whole plugin was re-verified live: concurrency lock, daily cap, image validation, oversized-response cut-off and redirect refusal all confirmed working.
Fixed
- The "Pinterest / Recipes pin" style rendered a fixed website address into the bottom strip of every generated pin - regardless of which site generated it. The pin now carries the site's own domain automatically.
- The "posts with missing images" list loaded the full content of every published post into memory to count images; on a site with thousands of posts that could exhaust memory. Counting now happens inside the database and the screen stays fast at any size.
- With OpenRouter selected as provider, the settings screen still warned "no Gemini API key" and style-preview generation insisted on a Gemini key. Both now follow the selected provider.
jekcms.com audit: contact form repaired + language redirect fixed
Improved
- The marketing site was audited top to bottom: 38 pages in both languages (render integrity, silent log noise, titles, canonical and hreflang tags, single H1), all 88 internal links, sitemap/robots/feeds/docs search, payment checkout links and both forms - everything else came back healthy. The "Try the admin panel live" band on the themes page now sits below the theme list, and a new automated suite guards the form pipeline against regressions.
Fixed
- The jekcms.com contact form rejected every single submission with a "security token mismatch" error: the page stored its security token in one session while the receiving endpoint checked a different one, so the two could never match. The form now fetches a fresh token at the moment of submission - messages actually arrive and open a support ticket. The footer newsletter form carried a lighter version of the same risk and now uses the same always-fresh-token pattern.
- Opening a jekcms.com page with the ?lang=tr shortcut on a direct .php address redirected to a dead URL (for example /blog.php?lang=tr landed on a 404). The Turkish redirect target is now normalized to the clean address, and subdirectory installs no longer produce doubled paths.
General audit: post reactions/ratings completed + silent error floods ended
Improved
- The whole automated test battery was run end to end - 65+ suites, 2,000+ checks, all green - covering plugins, themes, mail, licensing, installers, customer portal and admin access controls.
Fixed
- The Entertainment theme's reaction buttons (🔥 ❤️ 😮) and star ratings were half-built: the interface was drawn and clicks were sent to the server, but the receiving endpoint never existed and the database tables were never created - counts always showed zero, reverted on reload, and every page view silently wrote errors to the log. The feature is now real end to end: one reaction and one rating per visitor (updatable), public-published posts only, rate-limited, and the tables create themselves on first use.
- The settings-change timeline (who changed which setting, with undo) had never worked: its query joined a table name that doesn't exist in the product, so the history always came back empty and every dashboard load added another silent error to the log. The audit found 1,600+ recorded changes that are now actually visible.
- Small persistent warnings cleaned up across jekcms.com: the admin invoice list read a wrong column name for due dates (overdue highlighting never fired), 404 pages warned about a missing canonical URL, the blog listing warned on every load, and two 2.65-era changelog entries had no title and rendered a warning on the public changelog page.
Customer accounts: clear verification flow + session security
Improved
- One password policy across the whole customer portal (register, reset, profile, sign-up modal): at least 8 characters with a letter and a digit, and obvious passwords are rejected - "12345678" is no longer a valid password for an account that holds licenses and purchase history. Both blog-site user management and the customer portal were audited end to end on a live environment: brute-force lockouts, role whitelists, IDOR scoping on orders/tickets/invoices/licenses, OAuth account-linking protections and 2FA flows all verified working.
Fixed
- An unverified customer account was silently bounced back to the sign-in page in an endless loop with no explanation - right after registering, after signing in with the correct password, and after changing the email address on file. Every entry point now explains what happened and links to "resend verification email"; registration no longer opens a session that gets dropped one request later, and changing your email signs you out cleanly with a clear note instead of appearing to crash.
- Profile password changes and admin-side password resets now bump the session version, so every other signed-in device is signed out immediately - only the device that changed the password stays in.
Editor SEO assistant: score verified live + 4 new checks
Added
- The post editor's SEO assistant gained four new checks, shown only when the issue actually exists: a stale year in the title (e.g. "2024 guide" in 2026), heading sections with no content under them, generic link text like "click here", and long articles (1000+ words) with fewer than two images.
Improved
- The SEO score engine was verified end to end in a real browser: a blank draft scores exactly 0, Turkish dotted-İ keyword matching and inflected-word density counting work, over-density and readability warnings fire correctly, and on every scenario the dial score matches the sum of the per-category points exactly. The computed score is also confirmed to be saved with the post and shown in the post list.
Newsletter: campaigns now send themselves
Improved
- The whole subscription pipeline was audited end to end on a live site: sign-up protections (honeypot, rate limit, spam filter, mail-bomb cap, address-disclosure parity), double opt-in with token rotation, one-click unsubscribe headers, open/click counters with signed links, and bounce pre-flight all verified working.
Fixed
- Newsletter campaigns only went out while an admin kept clicking "send next batch", or on servers with a manually configured cron job; on a typical installation a campaign larger than one batch - and every automatic new-post notification - sat in the queue forever. The queue is now processed automatically: the built-in scheduler drains it in small batches as the site gets visits, and the server cron (where present) drains it in full - with row-level locking so the two never send the same email twice, and nothing is sent while the newsletter is disabled or the plugin is deactivated.
Visual theme audit: readability and dark-mode fixes
Fixed
- Every theme was rendered in a real browser in both light and dark mode and measured for text readability; unreadable spots were corrected across nine themes - badge and button text on bright brand colors, faded date/muted text, table-of-contents boxes and post cards that stayed white in dark mode, a newsletter band whose white text vanished on its yellow gradient, and an oversized content image that forced horizontal scrolling.
- When you pick a light brand color in the customizer, badge/button text on that color now switches to dark automatically (and link-style brand text is deepened just enough to stay readable) instead of staying white and disappearing.
- The travel theme's default menu no longer links to pages that don't exist on the site; "Destinations/Tips" entries appear only when a matching category exists and point straight to it.
- The shared sidebar widgets (tags, categories, recent posts) now stay readable in dark mode on every theme, even when a theme doesn't define its own dark palette for them.
Theme audit: broken-image safety net + graceful demo-media fallback
Added
- A new deep theme audit exercises all 13 themes across eight page types each - checking rendering, single H1, canonical tags, encoding, leaked shortcodes, layout-section contracts and every referenced asset. All 517 checks pass on both an English and a Turkish site.
Improved
- The travel theme's showcase images (front-page slider, about page, archive banners) now appear only when the files actually exist on the installation; sites without the demo media pack get a clean dark banner instead of broken image icons.
Fixed
- Content written on a development machine could carry "localhost" image addresses into the live site, showing readers broken images (one live post was affected and has been repaired). Rendering now silently rewrites such development addresses to the site's real address - only inside image and link attributes, so articles that mention localhost in their text or code samples are untouched.
- The finance theme linked an apple-touch icon file that doesn't ship with the theme, producing a broken request on every page; the icon already comes from the site's central favicon pipeline, so the stray link was removed.
Site Versions screen + lasting analytics history + cleanup
Added
- License server: a new "Site Versions" screen lists every licensed installation that checks in with the update server - its domain, last reported version, PHP version and last-seen time - and flags at a glance which sites are up to date, which are running behind, and which have gone silent for two weeks. Check-ins are recorded only for valid licenses actively bound to the reporting domain.
Improved
- Analytics: the daily trend chart now also reads the permanent daily summaries, so date ranges older than the raw-data retention window (90 days by default) show real history instead of an empty chart. The summaries had been collected all along but were never displayed.
- The demo site now applies updates automatically every day and its nightly reset preserves that setting, so the public demo always showcases the current release.
Fixed
- Eight plugins registered an admin-menu hook that the panel never fires; the dead registrations were removed (menu entries continue to come from the panel's own list, nothing visible changes).
- The internal schema check misread SQL comments and nested data blocks, hiding real columns and reporting phantom ones; with the parser fixed and three schema reference files brought up to date, the known-issues backlog dropped from twelve to zero.
General audit: silent log flood stopped + plugin registration repair
Improved
- Four plugin distribution tools were missing two installations from their target lists, so future fixes for those plugins would silently skip them; the lists were completed (the same gap was fixed for the SEO panel earlier).
Fixed
- The admin dashboard queried social and push-notification tables even on installations where those plugins were never activated; the page rendered fine, but every single dashboard visit silently appended errors to the database log (one installation had accumulated 47,000 lines). The dashboard now checks the schema first and simply shows zeros, and it also adapts to older social-queue schemas instead of failing.
- The Google Console plugin's activation script used a wrong column name when registering itself, so it logged an error on every update and could fail to register on a fresh site; the column name was corrected.
- Two internal quality checks had fallen out of date after recent changes (quiz answer response and content-filter wiring) and reported false alarms; they now verify the actual behaviour instead of exact source text, and five already-resolved records were cleaned out of the schema check's known-issues list.
Both languages everywhere: 10 themes + admin panel fully TR/EN
Added
- A live bilingual audit tool now logs into the panel and crawls the critical admin screens and public pages of every site in BOTH languages, catching raw dictionary keys, Turkish text in English mode and English text in Turkish mode - 140 fleet checks and 45 deep checks all pass.
Fixed
- Around 1,100 hard-coded interface strings across ten themes (travel, pets, finance, minimalist, recipes, crypto, tech, entertainment, health, starter) now follow the site language: comment forms, newsletter boxes, search, 404 pages, pagination, reading time, share labels and screen-reader labels all render in Turkish on Turkish sites and English on English sites.
- The admin panel now honours the admin language setting consistently: the login screen tagline, every date (month names were printed in Turkish even in the English admin), the media upload box and the license screen no longer mix languages.
- Thirteen dictionary entries that displayed their internal key instead of text (e.g. the date filters on the Posts screen) and nine English dictionary entries that contained broken Turkish text (e.g. the login subtitle) were repaired in both languages.
- A site language saved as a regional code like "en-US" was silently falling back to Turkish; regional codes are now normalised, so an English site no longer renders a Turkish interface.
- Two sites were running theme copies months behind the product (missing every rollout since the layout engine); all fleet theme copies are now byte-identical with the product and a new sync tool keeps them that way.
SEO: AI visibility audit (llms.txt + AI crawler policy)
Added
- SEO Health Check gained an "AI Visibility" group: it now verifies that llms.txt and llms-full.txt (the site summaries ChatGPT, Claude and Perplexity read) are actually being served, summarises your AI crawler policy (how many of the 13 known AI bots are allowed), and confirms the live robots.txt really reflects that policy - so a stray static robots.txt file can no longer silently override your choice.
Fixed
- Advanced SEO propagation lists were completed: the plugin's activation file joined the fleet sync list and two installations missing from the dedicated sync tool's target list were added, so future panel fixes reach every site instead of silently skipping some.
Audience (CRM): export a segment, faster counters, tighter access
Added
- Each saved segment now has its own "Export CSV" button, so you can download exactly the contacts a segment covers in one click - not just the whole list.
Improved
- The audience summary counters (total plus one per source) are now computed in a single database pass instead of five separate scans, so the Audience screen stays fast on large contact lists.
Fixed
- The admin-only access check on the Audience screen is now unconditional, closing a theoretical gap where the contact list (personal e-mail addresses) could have been reachable by a lower-privileged user if the code were loaded differently.
Social: non-blocking Instagram/Threads publishing + Pinterest image fix
Fixed
- The per-post Pinterest image field in the editor now saves. It was posting to an address that had no route, so the value was silently dropped - the pin image you set was never stored.
- Publishing a photo, story or carousel to Instagram - and a post to Threads - no longer holds a worker busy waiting for the platform to finish processing. Ready posts go out immediately; ones still processing are picked up on the next pass, the same way Reels already worked. Before, a single post could tie up a worker for up to half a minute.
- When a social post succeeds, its remote post id and publish time are now recorded on the queue entry itself (not only in the log), so the published-at time and a link back to the post are available.
Recipe card: servings scaler, card image fix, sturdier rich results
Added
- Recipe cards now have a servings adjuster: readers tap − / + to change the number of servings and the ingredient amounts scale automatically. Whole numbers, decimals and fractions (½, 1½, 1/2) are all handled and shown back as neat fractions; anything that isn't a plain amount ("a pinch", "2–3") is left untouched.
Fixed
- A recipe with only a cover image (no separate step photo) now shows that image on the card. Before, the card's image was computed but never displayed unless a separate process photo was set, so many cards appeared with no picture.
- The recipe's star-rating rich result is now emitted only when the rating is a real number within range and has at least one vote - a stray or out-of-range value could previously invalidate the whole recipe rich result in Google.
- A recipe with an unreadable publish/update date no longer stamps the structured data with a 1970 date; the field is simply left out instead.
- Prep/cook/total times written with a day component (for long-rested recipes) are now counted correctly instead of reading as zero.
Quizzes: fairer scoring, answer explanations, cleaner personality results
Fixed
- A question with more than one correct answer is now scored fairly: picking any of the correct answers counts as right. Before, only one of them was accepted and a reader choosing an equally-correct answer was marked wrong.
- The "Show explanation" option now actually works - when it's on, each question's explanation appears in the results review after finishing. It had no effect before.
- The "Auto-scroll" option now works too: moving to the next question gently scrolls the quiz back into view, which helps on phones. It was also previously inactive.
- Personality quizzes no longer show a "3/10 correct" score or right/wrong marks - those don't apply to result-based quizzes, so now only the result card is shown.
Plugin review, round four: social, forms, CRM, analytics
Improved
- Social & Video: YouTube uploads use a tighter per-chunk timeout so a single slow chunk can no longer tie up a worker; the upload simply resumes where it left off.
- Analytics: the tracking beacon no longer re-checks the database structure on every single page view - it only sets things up if something is actually missing.
- Audience (CRM): segment sizes are now counted directly in the database instead of loading every matching contact into memory, so the Segments screen stays fast on large lists.
- A/B tests: a winner is now declared only once every variant has reached the full sample size, matching what the screen tells you to wait for.
- Forms: spam submissions can no longer grow without bound - only the most recent are kept per form.
Fixed
- Social: the connected app's client secret is now stored encrypted, matching how access tokens are already protected.
- Video Studio: the 90-second limit is now enforced on the server too, so an over-long video can't slip through and be rejected by Instagram - you're asked to shorten the script and re-render instead.
- Contact form: on older installs, clicking "Spam" on a message could silently lose it; the message list now repairs the underlying field first so the message is safely kept.
- Forms: dropdown / radio / checkbox answers are now validated on the server against the defined options, so a made-up value can't be slipped past the form.
Plugin review, round three: push notifications, downloads, AdSense checker
Improved
- AdSense readiness checker: the scan no longer loads every post into memory at once, so it runs reliably on sites with thousands of posts.
Fixed
- Push notifications: the list of trusted push services is now matched strictly, so a look-alike address (a domain merely ending in a trusted name) can no longer register and receive your notifications, and only secure addresses are accepted.
- Push notifications: publishing a post no longer waits for every subscriber to be notified before the save completes - the save finishes at once and notifications are sent right after, within a time budget so a large subscriber list can never stall or crash the publish.
- Downloads: a download link with a set limit can no longer be pushed past its limit by firing several downloads at the exact same moment.
- Editorial calendar & recipes: the admin permission check on these screens is now unconditional, closing a theoretical gap where it could have weakened if the code were loaded differently.
Plugin review, round two: quizzes, Google, recipes, Cloudflare
Improved
- Google: the plugin no longer re-checks its database structure on every admin page load - it does so only once per version.
- Cloudflare: clearing the cache after you publish or edit a post no longer holds up the save while Cloudflare responds - the save finishes immediately and the purge runs right after.
Fixed
- Quizzes: a page containing an embedded quiz could fail to load because the view counter had nowhere to record to. The counter now has its place, is added automatically to older sites, and can never take a page down again.
- Quizzes: a published quiz now has its own shareable page, so the "View" link in the admin opens the quiz instead of a "not found" error.
- Quizzes: the WordPress importer now refuses image and page addresses that point back into the server's own network, and verifies the remote site's certificate.
- Google: the "automatically notify Google when new content is published" checkbox now genuinely turns the feature on - before, it looked enabled but every submission was quietly refused.
- Google: the manual "submit for indexing" action now only accepts addresses on your own site.
- Recipes: a recipe with no usable image no longer publishes structured data that Google would reject - the recipe rich-result is emitted only when it will actually validate.
- Cloudflare: applying the recommended security rules can no longer wipe your own custom firewall rules if reading the current rules momentarily fails - the change is aborted instead.
Plugin review, round one: safer AI images, newsletter and notifications
Improved
- Web notifications: subscriber records are handled more efficiently, without needless database work on every visit.
Fixed
- AI images: a picture returned by the image provider is now downloaded only from a safe public address; an address that points back into the server's own private network is refused.
- AI images: when generation fails, the error message no longer risks showing your API key - the key is now hidden.
- AI images: if the daily image limit can't be read for a moment, the system now stops generating rather than continuing without a limit, so you are never billed past your cap by accident.
- Newsletter: an email template you edited by hand is no longer overwritten by an update - only templates you never touched are refreshed.
- Newsletter: the weekly digest is now sent only once even if two runs happen to start at the same moment.
- Newsletter: the sign-up form no longer reveals whether an address is already on the list - the reply is the same either way.
- Web notifications: the subscribe endpoint is now protected against being flooded with fake entries.
- Stories: reaction counts now change only from a genuine visitor tap, and a reaction sent from another site is ignored.
Video Studio: 90-second cap so videos stay Reels-eligible
Improved
- Studio videos are now capped at 90 seconds. Instagram only places videos of 90 seconds or less in the Reels tab; a longer one would post as an ordinary video instead. The narration is already about a minute, so this only affects manually lengthened scripts - and when it does, both the picture and the sound are trimmed at the same point, so the file really stays within the limit. The script step notes the limit as you type.
Get your site live
The setup wizard gets a site live in about 30 minutes. See the prices and the free edition.
View Pricing- Setup and live in 30 minutes
- 15 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO - Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)