Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 12 of 24 - 710 releases, newest first.
Maintenance cleanup is now actually scheduled
Fixed
- A re-audit found that the daily maintenance cleanup (expired cache, rate counters, stale feed/sitemap files, old sessions, log trimming) lived only in a legacy cron script that nothing ever invoked - so in practice none of it ran. It is now wired into the real scheduler body that both server cron and the visitor-triggered fallback execute, with its own 24-hour interval guard. Verified end-to-end: planted stale files were swept, fresh files and still-valid caches were left untouched.
Disk hygiene: every cache now cleans up after itself
Fixed
- Rate-limit counter files (one tiny file per visitor IP) could pile up indefinitely on hosts where daily maintenance never runs - a real concern on shared hosting with inode quotas. The limiter now sweeps stale counters opportunistically on a small fraction of requests (the same pattern PHP uses for session cleanup), and the daily maintenance covers both counter formats instead of one.
- The daily cleanup used to delete rate counters after just one hour, silently resetting live 24-hour limits; it now waits until a counter can no longer be active.
- Requesting a comments feed for a non-existent post ID now returns 404 without writing a cache file.
- Feeds requested with a custom ?limit are now generated fresh instead of each size writing its own cache file (up to 100 files per feed).
- Stale feed and sitemap cache files left behind by key changes were never deleted; the daily maintenance now sweeps them.
- Expired session files could linger for months on quiet sites (PHP's own cleanup is probabilistic); maintenance now removes sessions past their 30-day lifetime deterministically.
Comments in four more themes + newsletter popup fixed to once a day
Added
- The Lifestyle, Minimalist and Tech themes now have a full comment section (list with replies, moderation-aware form, spam protection) designed in each theme's own visual language; the Starter theme's dormant comment code was wired up and completed. All four respect the global comments setting and the per-post comment status.
Fixed
- The newsletter signup popup could reappear on every page: the Finance theme only remembered the popup after the visitor clicked the close button, and the plugin popup reset at midnight. Both now remember the moment the popup is shown and stay quiet for a full 24 hours; subscribers never see it again.
- The Finance popup's subscribe form pointed to a root-absolute address that broke on subdirectory installs.
System-wide audit: privacy, SEO and reliability fixes
Security
- Private posts stayed truly private everywhere: posts imported from WordPress as “private” could previously be opened at their direct URL and could appear in theme lists, related-posts blocks, search results, the llms.txt export, weekly digest emails, auto-shared social posts and the Stories bar. Every one of those paths now respects the post's visibility.
- The Atom feed no longer publishes author e-mail addresses - they were an open invitation to spam harvesters and had no SEO value.
- Locking out repeated failed logins now also works when signing in with a username instead of an e-mail address.
- AVIF uploads are now validated as real images (previously they skipped both the image check and the content scan).
Improved
- Duplicate structured data removed: author pages in the Health theme and recipe pages no longer emit the same schema twice with conflicting IDs.
- Content boxes across six themes were restyled from the left-accent-bar look to cleaner top-accent panels.
- Recipes theme post pages now get the shared content typography (image alignment, figures, captions).
- Support API endpoints now require a domain that is actually activated on the license before showing or changing tickets, with per-IP rate limits.
- Four confirmed-dead legacy files were removed after a three-week production probe; the update tooling now automatically covers every plugin's admin pages.
Fixed
- The RSS feed cache now keys on the requested size, so a “?limit” value on one request no longer affects the feed other readers receive.
- Feeds now use the actual publish date for ordering and timestamps, so scheduled posts appear correctly (matching the sitemap's logic).
- Sitemap family: the news sitemap's index entry now uses the same publish-date window as its content; the video sitemap now really lists posts with YouTube embeds (it was announced but empty); noindex pages are no longer announced; the homepage's last-modified date reflects real content changes instead of “today”; image entries carry the post title instead of the slug.
- Comment forms in the Recipes and Travel themes posted to a non-existent address - comments could never be submitted. They now reach the comment handler, and six themes additionally hide the form when comments are closed for that post.
- The Trends theme now runs post content through the full content pipeline - shortcodes (forms, downloads, quizzes…), FAQ/how-to boxes and the final safety filter all work there now.
- Tables of contents across seven themes no longer skip or mislink headings that already have an ID.
- The “posts per page” reading setting is now honoured by archive and search pages in eight more themes.
- Database migrations now actually record their progress, run in numeric order and log failures (previously every migration silently re-ran on each update).
- Sending a newsletter from two overlapping runs could deliver the same campaign twice to a subscriber - queue rows are now claimed atomically and the cron entry point takes a lock.
- Deactivating a plugin now really turns off its public endpoints (forms, quiz submissions, download links, A/B redirects…).
- Date archives (/archive/2026) rendered as 404 even in themes that support them.
- Percent-encoded URLs (e.g. slugs with Turkish characters typed encoded) no longer 404.
More resilient automatic updates
Improved
- Automatic updates are now sturdier: before installing anything, the update package's digital signature is verified against several canonical forms and the exact bytes served - so a future change in how the update server formats its release list can never silently stop updates from reaching your site. The current, working verification is always tried first, so nothing changes for you day to day; this only adds safety nets.
Fix: image & logo uploads failing on some servers
Fixed
- On servers where PHP's Fileinfo extension is turned off, every image and logo upload failed with “Class finfo not found”. Upload validation now detects the file type through several fallbacks (including reading the image header directly), so uploads work regardless of that extension.
The format menu now scrolls neatly instead of overflowing the screen
Fixed
- With all the new blocks, the format menu could run off the bottom of the screen; it now fits the viewport with a tidy internal scroll and closes when you scroll the page, so it never appears detached from its button.
Cleaner block design, styled callouts on the page, plus keyboard keys and drop caps
Added
- Two more inline text tools other editors have: a Keyboard key style (renders a real key cap, e.g. Ctrl + S) and a Drop cap (an oversized decorative first letter to open an article).
- The Info / Warning / Error / Tip highlight boxes are now properly styled on the published page - before they only looked right inside the editor.
Improved
- Cleaner, less templated block design: the colored left bar was removed from the Key takeaways box (and the editorial summary box), replaced by a clean titled panel; the pull quote is now a centered, magazine-style quotation. The look is more editorial and less generic.
Beautiful content blocks, collapsible FAQ, and two new text styles
Added
- Two strong new text styles for richer articles: a Lead paragraph (a larger, standout intro) and a Pull quote (a decorative, oversized quotation) - both in the format menu.
- The FAQ block is now collapsible on the page: each question expands and collapses like an accordion, so one FAQ block gives you a full set of expandable questions in one place.
Improved
- All content blocks were visually redesigned on both the editor and the live page: buttons get depth and hover, How-to steps show numbered badges, Pros & Cons use clear check/cross marks with colored headers, Key takeaways carry an icon and accent bar, and star ratings are larger - a noticeably more finished, professional look.
Editor blocks: audited and hardened for every theme
Fixed
- FAQ questions no longer appear inside a theme’s table-of-contents: the question is now a styled heading that stays out of the on-page contents list while still powering the FAQ rich result.
- Verified every new block (FAQ, Pros & Cons, Key takeaways, How-to) renders correctly through the article pipeline on all themes, with the FAQ and How-to search markup produced automatically and safely (user text is always escaped).
A pro-grade editor: SEO content blocks, fixed Button & Accordion
Added
- Four new content blocks for richer, search-friendly articles: an FAQ (question & answer) block that automatically adds Google FAQ rich-result markup, a Pros & Cons box, a Key takeaways box, and How-to steps that automatically add How-to rich-result markup - each inserted and edited through a professional panel.
- Video now has its own toolbar button, right next to the image button - clearer than hiding it in a menu.
Fixed
- The Button block now inserts a clean, compact button instead of a broken empty area, and can be re-edited by double-clicking it.
- The Accordion block is now fully editable: type the title directly and write the hidden content underneath (previously it appeared as an unusable strip).
- The format menu items now line up consistently - every entry is an icon plus a label in a logical order, instead of scattered styles.
Pro Forms, an Audience suite, a richer editor, and faster videos
Added
- Form Builder is now a real visual builder: a two-pane editor with a LIVE PREVIEW that updates as you type, 16 field types (text, e-mail, dropdown, checkbox, date, time, star rating, consent/GDPR, section heading, info text, hidden…), per-field width so fields can sit side by side, and drag-and-drop reordering by a handle. Plus an auto-reply e-mail to the sender that fills in their own answers, redirect-after-submit, keyword spam filter, an entry limit, and a full submissions manager (read/spam, per-entry detail, CSV export).
- Audience & Marketing - the CRM grew into a marketing hub: contacts from every source unified by e-mail, plus saved Segments (audience filters with live counts) that will become broadcast targets for e-mail and web push.
- The post editor gained rich content blocks - Button/CTA, Accordion (collapsible FAQ), Star Rating, and YouTube video - inserted through professional modals (not browser prompts). Tables now open a visual size picker (pick rows × columns) and show a floating toolbar right on the table to add/remove rows and columns without dialogs.
Improved
- Every plugin admin screen was rebuilt to the jekcms admin design - proper cards, pill buttons, stat panels, inline how-it-works notes and rich empty states, with a left inner-sidebar where a plugin has multiple sections.
- Web Push adds a “Send test to this browser” button so you can subscribe and test notifications right from the admin.
Fixed
- Adding a YouTube video no longer slows the page: embeds load a lightweight poster and pull in the real player only on click (privacy-friendly youtube-nocookie).
- Hardened CSV exports (Audience, SEO, Analytics, form entries) against spreadsheet formula injection.
Critical: plugin admin pages could crash with a 500
Fixed
- Fixed a 500 error that could break plugin admin pages. The admin header's update check caught its exception into a variable named $e - the same name pages use for their HTML-escaping helper - so whenever that check failed (e.g. a slow update server or a stale database), the page's next output call crashed with “Object of type … is not callable”. The header and sidebar now use private catch variables, so a failed background check never takes the page down.
- Plugin admin descriptions and sidebar names for the newest modules (Forms, Downloads, Web Push, Editorial Calendar, Audience/CRM, A/B Tests) now show in Turkish on Turkish installs instead of falling back to English.
CSV exports hardened against formula injection
Security
- CSV exports are now hardened against spreadsheet formula injection: every untrusted cell in the Audience (CRM), SEO and Analytics exports is neutralized so it opens as plain text in Excel or Google Sheets.
Improved
- The admin sidebar now shows the newest modules (Forms, Downloads, Web Push, Editorial Calendar, Audience/CRM, A/B Tests) with proper localized names and their own icons, instead of an English name and a generic icon.
A/B Tests: Even Variant Split on 32-bit PHP
Fixed
- A/B Tests now split traffic evenly on 32-bit PHP builds too. The visitor-bucketing hash could turn negative on 32-bit, which would have pushed almost everyone onto the first variant and skewed the results; the hash is now masked to stay non-negative on every platform. No effect on 64-bit hosting (the common case), where the split was already even.
New Plugin: A/B Tests
Added
- A/B Tests - find out which headline or call-to-action actually works instead of guessing. Create an experiment with two or more variants, drop the [ab id=N] shortcode into any post or page, and each visitor is shown one variant - the same one every time they return, chosen without a cookie so it just works. A link to /ab/go?e=N records a conversion for that visitor's variant and forwards them to your goal page. The admin shows impressions, conversions and conversion rate side by side, highlights the leader with a 🏆, and warns while the sample is still too small to trust. Weights let you send more traffic to a variant, and pausing an experiment freezes the numbers while still showing the winning version to readers. Lightweight by design: cookieless bucketing and aggregate counters, so no per-click table piles up. Activate it under Plugins.
New Plugin: Audience (CRM)
Added
- Audience (CRM) - a lightweight CRM that unifies the contacts you already collect into one place. It gathers your newsletter subscribers, Form Builder leads, Digital Downloads buyers and approved commenters into a single audience keyed by e-mail: someone who subscribed, filled a form and bought a download shows up as one contact with all three sources, not three scattered rows. Search by name or e-mail, filter by source or by your own tags, and open any contact to see a full activity timeline across every channel. Add tags to build segments (vip, prospect, customer…) and a private note per contact, then export the filtered list to CSV for your mail tool. One click rebuilds the audience from your live data, and it always keeps the tags and notes you added. Activate it under Plugins.
New Plugin: Editorial Calendar
Added
- Editorial Calendar - plan your content pipeline with a kanban board (Idea → Draft → Review → Ready) and a month calendar. Assign posts to authors, set due dates, and add editorial notes. Moving a card to Review flips the post to “pending”; the other stages keep it a draft, and publishing still happens in the editor - so nothing goes live by accident. The calendar places published and scheduled posts on their publish date and planned drafts on their due date, giving you a clear month-at-a-glance of what’s coming. Multi-author teams get a shared view of who’s working on what and when it’s due. Activate it under Plugins.
New Plugin: Web Push Notifications
Added
- Web Push Notifications - let visitors opt in to browser notifications and reach them even after they leave your site. When you publish a new post, every subscriber gets a native notification that reopens the article - bringing readers back for repeat visits. Includes a subscriber count and a one-click test broadcast. Fully self-hosted: standard VAPID authentication and RFC 8291 payload encryption in pure PHP, no third-party push service and no per-message fees. Only trusted push endpoints are accepted, dead subscriptions are pruned automatically, and the private key is encrypted at rest. Works on HTTPS sites (and localhost); the visitor grants permission in their browser. Activate it under Plugins and turn on “notify on new post”.
New Plugin: Digital Downloads
Added
- Digital Downloads - sell or give away digital files (ebooks, printables, templates, courses). Embed a product anywhere with the [download id=N] shortcode. Free products act as e-mail-gated lead magnets: the visitor enters an e-mail and instantly gets a secure download link (also e-mailed). Paid products create an order you fulfil however you like - bank transfer / havale or any method - then one click marks it paid and e-mails the buyer their link. Files are stored in a web-blocked folder and served only through single-use tokenized links with a per-order download limit and expiry, so they can’t be shared or hotlinked. Uploads of executable file types are refused. Activate it under Plugins; set your payment instructions on its page.
Smarter Search: Relevance-Ranked Results
Improved
- Site search now ranks results by relevance instead of just date. It uses the database full-text index (which existed but was unused) so the best matches surface first - a term in the title outranks the same term buried in the body - and partial words match too (searching “brew” finds “brewing”). Very short queries automatically fall back to the previous substring search, so nothing is lost. Turkish content and multi-word queries are handled correctly.
New Plugin: Form Builder
Added
- Form Builder - build unlimited custom forms (contact, lead-gen, surveys, quote requests) with a visual field editor. Ten field types (text, email, phone, URL, number, textarea, dropdown, radio, checkbox, date), each optional or required. Embed any form anywhere with the [form id=N] shortcode, collect submissions in a built-in viewer, and get e-mail notifications on new entries. Protected out of the box with a honeypot, CSRF, rate limiting, minimum-submit-time and spam filtering; all stored values are safely escaped. Activate it under Plugins.
Fixed
- Shortcodes such as [form id=5] or [quiz id=3] could leak as raw text into a page’s meta description and social-share (Open Graph) snippet. They are now stripped from the description, so search results and shared links read cleanly.
Core Cleanup: Removed Unused Legacy Modules
Improved
- Removed several unused code modules left over from earlier versions - a dead front-end controller, a duplicate image-optimizer class (the feature runs from a different code path and is unaffected), an unused string helper, a duplicate support-ticket class, two unused cache helpers, an unused query builder, and three already-disabled one-time scripts. This trims the codebase with no change to how the site behaves; every page and feature was re-verified afterward.
Backup System Hardening: View-Safe Restore, Memory-Safe Dumps, Reliable Scheduling
Improved
- Database dumps are now streamed to disk instead of being assembled entirely in memory, so backups no longer risk running out of memory on busy sites with large analytics or log tables.
- Scheduled daily backups are more reliable on low-traffic sites: instead of only firing in a single exact hour (which a quiet site could miss entirely), the backup now runs at the first opportunity from the chosen hour onward, still once per day.
- Old pre-restore safety backups are now cleaned up on the same retention schedule as automatic backups, so they no longer accumulate and fill disk space over time.
Fixed
- Restoring a backup could fail completely on databases that contain a SQL view: the dump treated the view as an ordinary table and the restore aborted partway. Backups now handle views correctly, so a restore runs cleanly from start to finish.
- Restoring a large backup could run out of time and stop halfway, leaving the database partly restored. The restore now lifts the same time and memory limits the backup step already used, and if a specific statement ever fails it reports exactly which one instead of a cryptic error.
Comments & Newsletter Deep Audit: Closed-Post Guard, Accurate Counts, New Notification E-mails
Added
- Optional comment notification e-mails: get an e-mail when a new comment arrives (including ones awaiting moderation), and let commenters know when someone replies to them. Both are off by default and configurable under Settings → Discussion.
Fixed
- Comments could still be posted to an article whose comments were closed: the theme hid the form, but the endpoint did not enforce it, so a direct submission slipped through. Closing comments on a post now truly rejects new submissions.
- The comment counter shown on posts could drift out of sync when comments were approved, unapproved, spammed, or deleted from the admin - the number is now recomputed from the approved comments on every change, so structured-data and listings stay correct.
- The newsletter signup box on the Lifestyle theme never worked - the form pointed at a blocked internal path and returned a silent error. It now uses the correct subscription endpoint and confirms properly.
Fixed a Setting Collision: Comments, Newsletter & Spam “Enabled” Are Now Independent
Fixed
- Three separate features - comments, the newsletter, and the spam filter - were all storing their on/off state under the same internal “enabled” name, so they secretly shared a single database row. Turning one off could silently turn the others off too: disabling the newsletter, for example, could make comments disappear from your site. Each feature now uses its own dedicated setting, so their switches are fully independent. Existing sites are migrated automatically, keeping whatever state they were last showing - no action needed.
General Settings Audit: “Posts Per Page” Now Actually Works
Fixed
- Settings → Reading → Posts Per Page was a dead knob on most themes: changing it did nothing to the category, tag, author, search and archive listings, because those theme templates read a hard-coded constant instead of your setting. The value you pick now drives pagination on all of them, with the constant kept only as a fallback. Every observable general setting was re-verified live: analytics snippets (GA4, GTM, Meta Pixel, AdSense), the cookie-consent banner, custom header/body/footer scripts, SEO verification tags, JSON-LD publisher data, the RSS full-content switch, robots crawler blocking, page-cache headers and maintenance mode all apply correctly.
Plugin Deep Audit: License Gate, Quiz Fix, and Two 500s Closed
Fixed
- The Quiz plugin created no database tables when activated - it looked for a migration file that was never shipped, so every quiz admin page failed with a server error and the plugin was effectively dead on arrival. Its full schema is now built into the plugin itself; activating it (or simply loading a site where it was activated) creates the tables and heals existing broken installs on the next visit.
- Two endpoints returned a server error when reached over the web: the legacy contact-form submit shim and the newsletter weekly-digest web-cron. Both re-declared a core constant (and the digest re-loaded the whole framework a second time) when invoked through the site router. Both now run cleanly - the contact shim rejects a missing security token with a proper 403, and the digest cron enforces its secret key with a 403 before doing any work.
- Hardened the plugin authorization boundary. Plugins are a paid-tier feature: the loader now verifies the licence on every request, so plugin availability always matches the active licence tier - while never restricting a paid site whose token has not yet refreshed.
Preview Bar on the Site + Live Preview in the Customizer
Added
- While you preview a theme, the site itself now pins a small dark bar to the bottom of every page: it names the theme being previewed, reminds you that only you can see it, and carries two links - activate this theme, or close the preview - so you decide right where you are looking, without returning to the panel. Visitors never see the bar; it exists only in your admin session, and preview pages are never written to the shared page cache.
- The theme customizer gained a live preview pane: your site sits in a small window next to the settings, and color, size and font fields repaint it the instant you change them - before saving. Fields that feed several style variables at once update all of them together; the remaining settings show after you save, and the pane can be refreshed or popped into a new tab. The whole appearance layer was re-verified on all 13 themes after these additions: 272 checks, all green.
Theme Preview Now Actually Previews - Plus Two Appearance Fixes
Fixed
- Theme preview was a dead switch: the admin banner said preview mode was active, but nothing on the frontend ever read the flag, so the site kept rendering the active theme. The preview now genuinely applies to your own browser session - you browse the whole site in the candidate theme while visitors keep seeing the live one, then either activate it or close the preview.
- Switching themes could fail with a bare "database error" on customized sites: every activation stored a rollback backup that embedded the previous backup inside itself, so the record snowballed with each switch until it exceeded the database packet limit. The backup now stores only what rollback actually needs, a failed backup can no longer block the activation itself, and per-theme customizations are untouched as before.
- Saving the footer builder could return a silent server error when the payload lacked the logo-type field, losing the save. The whole appearance layer was then re-verified end to end on all 13 themes with a real admin session - activation, preview, rollback, customizer save, footer save, header logo and page rendering: 136 checks, all green.
Get your site live
The setup wizard gets a site live in about 30 minutes. See the prices and the free edition.
View Pricing- Setup and live in 30 minutes
- 15 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO - Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)