Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 15 of 24 - 710 releases, newest first.
Dark Mode Switch Fixes
Fixed
- In one theme the dark mode switch stopped responding after moving to another page, and only worked again after a refresh.
- In two themes the dark mode switch did nothing at all.
- Because those switches never worked, their dark palettes had gone unchecked: several cards kept a fixed white background and turned white-on-white in dark mode. Both themes are now readable in dark mode.
Readability, Pages and Checkout Reliability
Improved
- Text contrast across themes was reviewed and raised where it fell short, improving readability and accessibility scores.
- Upgrading from the free plan to a paid licence now carries your existing site over instead of leaving it unlicensed.
- Licence checks are more forgiving of temporary network problems and no longer misread addresses that start with www.
- Password reset and update downloads fail less often on slow connections.
Fixed
- Order confirmation after payment could fail to record. Payments now complete reliably.
- Visitors whose device is set to dark mode could see unreadable text on some themes. Light and dark are now both checked.
- About and Contact pages written in the admin were ignored by several themes and never appeared on the site. They now show up.
- The homepage slider is aligned with the header width, keeps its rounded corners and shadow, and no longer clips its text on phones.
- Page numbers in one theme were listed vertically with bullet points instead of a row of buttons.
- The editorial box under articles had no styling and blended into the article text.
- Social icons in one theme's footer were invisible.
Stability & Integrity Improvements
Improved
- Internal reliability and integrity improvements across the core. No changes to how you write or manage content.
License Seats Stay in Sync
Fixed
- When a site's seat is released from the customer panel, that change now takes effect on the site itself. Previously a site could keep running on a seat that had already been freed, so the seat count and what was actually installed could drift apart. The admin now re-checks with the license server shortly after you open it and, if this domain is no longer registered to the license, shows a clear notice with a one-click reactivation link.
What You Write Is What You Get
Added
- Galleries: multiple images render as a responsive grid, and clicking one opens it full-screen in a lightbox.
Improved
- The editor now matches the published page. Paragraph spacing and Shift+Enter line breaks looked one way while writing and another way live - a shared content-typography standard now drives both the editor and every theme, so what you see in the editor is what readers get.
- A single, modern icon set (Lucide, self-hosted) replaces scattered inline SVGs. The news theme's Font Awesome CDN dependency is gone - icons now load from your own server, better for privacy, offline installs and speed.
- Images can now be placed left or right with text wrapping around them (like a magazine layout), or centered - straight from the editor's align buttons.
- The automatic logo is now also produced as a PNG, so Google's Organization logo and social shares get a real raster image instead of an SVG some platforms won't render.
Fixed
- The homepage slider now actually works. Its settings (slide count, autoplay, duration, arrows, dots) were in Customize but no theme shipped a slider template, so choosing "Slider" quietly fell back to a plain hero. A universal slider template now honours every setting, in any theme.
A Sharper Brand Image
Improved
- The automatic brand-image generator got a real upgrade. Your social share image (OG) now carries a proper corporate signature - a domain line along the bottom, depth on the title, and a lifted monogram badge - instead of a flat, generated look. Shared links finally look like they belong to a brand.
- The Branding screen's template picker now shows what each layout actually produces - badge, headline, tagline and signature line - with clean square corners, so you pick by seeing the real composition instead of guessing from two flat bars.
- The social share image is now managed in one place - Branding. The duplicate field that also lived in the SEO tab is gone, replaced by a pointer, so there's no more confusion about which one the site actually uses.
Fixed
- Deactivating your license from the admin now actually brings the license warning back. Before, "Deactivate" cleared only part of the stored license, so the panel still believed a valid license was present and the reminder banner never returned - the deactivation was effectively invisible. It now clears the full local license state, and works even when only the settings-side token was left behind.
A Fresh Install Tells the Truth
Improved
- Theme previews in the setup wizard are now twice the size, so you can actually see what you are choosing. Hovering a card reveals a "View demo" link that opens the live theme showcase in a new tab - pick with your eyes, not from a thumbnail.
- On the wizard's finish screen, "View Site" now opens your site in a new tab, so the completion page with your next steps stays where you left it.
Fixed
- Right after installation the admin greeted you with "License validation has not succeeded for 999 days" - alarming, and not what was happening. When no license key has been entered yet, the panel now simply asks you to enter it; the day counter only ever appears after a real validation has aged.
- The free edition's Updates screen claimed every theme and 13 plugins were installed. "Installed Components" now reports what is actually on your server - and when you upgrade to a paid license, the missing premium components are offered for install exactly as before.
- On installs without the distribution plugins, the dashboard showed a "Traffic Control" panel with a made-up setup score and links to screens that don't exist. Plugin panels now appear only when the plugin is actually installed, and the score is computed only from the channels you have.
Quizzes Speak Your Panel's Language
Added
- The Recipe plugin now has a place in the admin menu. It used to work invisibly - recipe data is filled in per post in the editor - so there was nothing to click and no way to see which posts carry a recipe card. A Recipe Cards screen now lists those posts with their status, links straight to the editor, and explains where the data lives.
Fixed
- The quiz screens now follow the panel language. On a Turkish panel the list page greeted you with "New Quiz", "All / Published / Draft", "Search quizzes…", "No quizzes found" - and the editor's placeholders and buttons were English too. Every label on the list and editor screens now reads in the panel language, and the search row uses the same layout as the rest of the panel instead of a stacked, misaligned one.
- Opening a quiz screen before the plugin was ever activated no longer ends in a server error. The quiz tables were created only when the plugin started; the screens now create them on first visit, the same self-healing the contact form received.
The Messages Link Opens the Messages
Fixed
- The Contact Form entry in the admin menu answered "not found". The messages screen moved to its current address a while ago and old bookmarks were being redirected - but the menu itself still pointed at the old address, which redirects only from the old location, not from the one the menu produced. The menu now links straight to the messages screen.
License State Is Not Public Reading
Security
- Your installation's internal state files - version.json and VERSION.txt - are no longer served over the web. They hold licence and component details that belong to your admin panel, not to the public internet; the panel keeps reading them from disk exactly as before, so nothing changes in daily use.
The Wizard Cleans Up After Itself
Security
- The setup wizard now proves its own files are gone when installation finishes. The wizard and the package zip were already being deleted at the end, but the deletion was never checked - if the server refused it, both files stayed behind without a word, and a forgotten installer is an open door. Removal is now verified on disk, and when any file survives, the finish screen names it and gives exact instructions: open FTP or your hosting file manager, go to the site root, delete these files. Same behaviour on the paid and the free package.
Only Your Software on Your Server
Security
- The setup wizard belongs to whoever opens it first. The first visit claims the wizard for that browser session, and a session from another address is refused while installation is still in progress; the way out is one line on screen: delete config/.install-claim. The claim expires by itself after twelve hours, so an abandoned setup never locks the site permanently.
Fixed
- The footer editor no longer ends in a missing page. It used to forward every unsupported theme to the theme customizer, which the free edition does not ship - so the link answered "not found". It now explains where the footer logo lives on the free edition and links straight to it, and the menu entry is hidden when neither editor is available.
- The SEO analysis panel is no longer shown on the free edition. It appeared in the post editor and reported nothing, because the scoring engine is part of the paid package. The save and preview bar above it stays exactly where it was.
- The License screen now knows the free plan. A site running a valid free license was labelled "Unlicensed" on both the License and Updates screens, because the free tier was missing from the plan table - the product did not recognise the license it had issued itself. Plan names also read in the panel language now instead of always in English.
- Paid plans no longer show bought features as switched off. The feature badges came from an older tiering in which Personal had no premium themes and Standard had no plugins; every paid plan includes everything and only the number of sites differs, so the badges said otherwise to paying customers.
- A fresh installation no longer answers with an error on its own home page. The table that records reads was created only when the first post was viewed, but on a new site the first page anyone opens is the home page - and the Minimalist theme reads that table to build its popular-posts list. The table is now part of the installation, and the Reports screen, which is built entirely on it, opens on a brand-new site as well.
One Language Per Page
Fixed
- Theme wording now follows the site language everywhere, not only in the footer. Sixty-six labels in the bundled themes carried a single hard-coded default - some English, some Turkish - so a page could show both at once. Each label now carries both languages, and the page language attribute follows the site setting instead of the language declared by the theme.
A Site That Behaves: Logo, Language and Newsletter
Added
- Setup wizard: the site language and the admin panel language are chosen separately during installation, instead of being inherited from the language of the wizard itself.
- Setup wizard: the theme step shows a real preview of each theme instead of a coloured strip.
Fixed
- The newsletter form no longer appears on installations that do not have the newsletter plugin. The free edition ships without it, yet themes still printed the form on every page - and a visitor who typed an email received a server error. The interface is now drawn only when the feature exists, and the endpoint answers "not found" instead of failing.
- A logo uploaded during setup now also appears in the footer. The footer was reading a separate setting and, when it was empty, printed a fixed letter left over from the original site the theme came from - so the site name could be anything and the footer still showed the same initial. You can still set a different footer logo, or remove it, under Appearance.
- Theme wording follows the site language. A site installed in Turkish had Turkish legal pages but an English footer, newsletter box and "Page Not Found" screen - two languages on one page. Theme labels may now carry both languages, and an English label from a theme no longer leaks onto a Turkish site.
Update Channel Restored, and a Real Path from Free to Paid
Added
- Güncellemeler screen: components your plan covers but your installation does not have can now be downloaded one by one. Coming from the free edition, premium themes and plugins were never on disk, and the channel only ever offered updates for what was already installed - so a paid plan delivered nothing until the whole package was reinstalled by hand.
- Customer portal: a free licence now shows the paid plans, and once a paid licence exists the site can be moved onto it in one click. A domain belongs to one licence at a time, so the new licence previously could not be added while the free one still held the site; the move does both steps at once and does not spend a slot from the 30-day move allowance.
Security
- A licence upgraded in place from the free edition now receives a newly issued key. The key format itself marks a licence as free, so raising only the plan column would have left the customer paying for a plan the update channel still treated as free.
Fixed
- Updates could be listed but never downloaded. The key used to verify the signed update manifest was rotated on the server and the matching key never reached the product, so every install refused each package with a verification error while the panel still advertised the update. The current key now ships with the product; core, theme and plugin downloads work again. This is the single most important reason to install 2.65.0.
Security Fix: Contact Notification Email Headers
Security
- The subject a visitor types into the contact form went into the notification email header as-is. A crafted subject could therefore add headers of its own - enough to have the site send mail to addresses the owner never chose, from the site's own domain. Every value that reaches a mail header is now stripped of line breaks and encoded, on both the SMTP and PHP mail paths, and recipient addresses are validated before use. Sites running 2.64.0 with the new contact notification should update.
- The AI draft screen now requires an administrator, matching the other content screens. It previously accepted any signed-in account, so an editor or author could generate content with the site's own API key.
Fixed
- Replies to a contact notification now go to the person who wrote the message. The reply-to address was being set through a method the mailer did not have, so the call quietly did nothing.
- A site name containing characters that look like a pattern reference no longer corrupts the header when the brand name is printed next to a square logo.
A Setup Wizard Worth The First Impression - And A Contact Form That Delivers
Improved
- The setup wizard was rebuilt around the first impression: a welcome that says what will happen, the four steps shown up front, the three ways to start side by side on one row, system checks in two columns, and motion that points at what matters. It respects reduced-motion settings and works the same on a phone.
- The contact form now brings its own appearance. It used to inherit whatever the theme happened to provide, which on most themes was nothing - raw browser fields with labels beside them. Themes that style the form themselves are left untouched.
- The wizard asks for the administrator name properly instead of silently filling in "Admin", and offers only the themes that are actually inside the package you are installing.
Fixed
- The setup wizard would not start. A single unescaped apostrophe in a Turkish label broke the whole page script, so the wizard opened with empty labels and a spinner that never stopped. Every download since 2.60.0 carried it. The wizard now parses in both languages and a release check keeps it that way.
- Contact messages were being lost. On some installations the messages table had never been created - it was only built when a plugin was activated or an administrator happened to open the messages page - so submissions vanished while the visitor was told "message received". The table is now created the moment a message needs to be stored.
- No email ever went out for a contact message. The message sat in the panel and the site owner heard nothing. Owners now receive a notification with the sender set as reply-to, so a reply is one click away.
- A contact message could disappear silently. Four separate anti-spam paths dropped the message and still answered "sent". Nothing is discarded any more: a suspicious message is stored under Spam with the reason attached, so a false alarm can be recovered instead of lost.
- The spam filter was tuned for comments and flagged ordinary contact messages - a plain message could land in Spam and never reach the owner. Contact submissions now only count as spam on decisive signals, and lesser suspicion is recorded as a note instead of blocking the message.
- A stray search box appeared next to the logo on desktop headers. The in-menu search guarantee was modifying the page on load; it now only appears when the mobile menu opens and is removed when it closes.
- An uploaded brand logo could overflow the header at its natural size. Every theme now caps the header logo, and a square logo (an icon rather than a wordmark) is shown with the site name beside it instead of leaving the brand nameless.
- Related articles showed an initial instead of the author photo, while the same card showed the photo everywhere else.
- On the finance theme, the newsletter box in category and author pages stretched down the whole page, and the author header was hard to read on its coloured band.
The Search Sits At The Top Of Every Mobile Menu
Improved
- Where a theme already puts a search inside its mobile menu, it is now moved to the top and given the same full width as everywhere else. The travel theme kept it at the very bottom, below every link, where it was easy to miss. All fourteen themes now open the menu the same way: search first, then the links.
Search Always Inside The Mobile Menu
Fixed
- The mobile menu now always contains a search field. The search icon in the header disappears on narrow screens in different ways from theme to theme - one hides it at a breakpoint, another runs out of room, a third has it switched off in the theme settings. Rather than chase each theme, the menu itself now guarantees it: if the menu has no search of its own, one is added at the top. Themes that already put a search there keep theirs.
Search On Mobile, In Every Theme
Fixed
- The search button was missing from the mobile header in the finance theme. Its buttons sat inside the navigation element, and the theme hides that element on small screens, so the search and day/night buttons went with it. They now sit outside it and stay visible.
- The personal and trends themes had no search on phones at all: the header search box is hidden on small screens and nothing replaced it. Both now carry a search field at the top of the mobile menu, the way the pets theme already did.
- The touch-target rule no longer resizes custom switches. The day/night control in the trends theme is a pill-shaped switch, and a 40px minimum turned it into a black circle.
A Readable Mobile Menu In Dark Mode
Fixed
- In dark mode the mobile menu showed dark text on a dark panel, so the links were almost invisible. The shared mobile menu pinned its colours to light values for every theme, and nothing set the matching dark ones. The menu now reads the theme you are actually in, and follows it even if you switch the theme while the menu is open.
- The order of the header buttons on phones and tablets is now day/night, then search, then the menu button on the far right.
Mobile Header, Dark Documentation, Readable Turkish
Fixed
- On phones and tablets the search and day/night buttons now sit on the right, next to the menu button, in that order. They used to be pushed up against the logo while the menu button stood alone at the far edge. The layout is the same in all fourteen themes.
- Documentation pages follow dark mode again. They were asking for colours that were never defined; a colour the browser cannot resolve makes it drop the whole line, so the backgrounds stayed white with no error anywhere.
- Turkish text that had been stored through the wrong character set, showing accented letters as pairs of unrelated symbols, has been repaired across the site.
Empty Screens, Dark Logo And Instant Refresh
Improved
- On the Turkish site every page address is now Turkish: the cookie policy moved from /tr/cookie-policy to /tr/cerez-politikasi, with the old address redirected so existing links keep working.
- Language alternate links now describe the page you are actually on. Documentation sub-pages were all announcing the documentation index instead of themselves, which made search engines discard the annotation for a third of the site.
Fixed
- An admin page could stop rendering halfway through, leaving everything below the greeting blank. A single empty date, image or e-mail column coming from the database was enough to do it. Every display helper now tolerates empty values, so one missing field can no longer take down a whole screen.
- The dark mode logo you upload under Settings → General → Branding is now the logo that appears in dark mode. Some themes were guessing it from the light logo's filename instead of reading your setting, which showed an unrelated file or a broken image.
- Uploading a logo now takes effect immediately. The address of the file carries a stamp derived from the file itself, and saving settings clears the CDN cache as well, so you no longer wait for the old copy to expire.
- Publishing or editing a post also refreshes the CDN copy of your home page, feed and sitemap.
- File sizes of zero are shown as "0 B" instead of producing a warning.
Update Confirmation Shows The Version You Just Installed
Fixed
- The confirmation message after a core update now shows the version that was installed.
- Theme and plugin updates also name the component's new version in the confirmation message.
Reliable Rollback For One-Click Updates
Fixed
- The backup taken before a core update now covers every file that update changes, so restoring it returns the site to exactly its previous state.
- Version information is included in the backup. After a rollback the admin panel and the update service report the same version.
- Your media is never placed in an update backup, so backups stay small and your files are untouched.
Security Follow-Up: Environment Detection And Content Visibility
Security
- A site decides whether it is running locally by looking at the server itself, never at the address a visitor sends. Local development is unaffected; set the JEK_ENV environment variable if you want to pin the mode.
- Private network address matching was tightened, so lookalike external addresses are not treated as local.
- Posts marked private are now hidden not only on their own page but also in archives, search, related and featured lists, the sitemap and the RSS/Atom/JSON feeds. This matters for sites migrated from WordPress, where private posts arrive as published. Administrators and editors still see everything in the panel, and an author still sees their own.
- SVG files in a WordPress package are scanned as content during import; files carrying scripts or external references are not accepted. Static SVG logos import normally.
Security Release: Stricter Input Validation And Reliable Throttling
Security
- Environment detection is decided by the server itself rather than by anything a visitor sends, so an installed site always runs in production mode.
- Rate limiting on login, API and upload paths is now accurate under concurrent traffic.
- Restoring a backup only accepts a .zip inside your own backups directory. Any other path is refused.
- A WordPress package import writes only recognised media files. Anything else in the package is skipped and counted, and never lands in your uploads folder.
- On an already-installed site, the setup wizard's remaining steps - including the WordPress cleanup - are tied to the browser session that performed the installation.
- The support endpoint gives the same answer for every licence key it does not accept, and is rate limited.
- The contact form links a message to a customer account only when the sender is signed in as that customer; everything else is filed as a guest request.
- Language alternate links are escaped on output and built from a sanitised page name.
- Newsletter click tracking verifies a signature before redirecting, so tracking links always lead where they say they do.
- The newsletter queue worker only runs with the configured cron secret. Running it from a real cron job is unchanged.
- Outgoing mail requires an encrypted connection: if TLS cannot be negotiated the send is aborted, and the newsletter mailer verifies the server certificate.
Security Release: Tighter Role Boundaries And A Leaner Installation Package
Security
- The installation package is leaner: distribution-side components that a site owner never runs are no longer part of it.
- Admin screens that affect the whole site - the ad manager, banner editor and comment import - require an administrator account.
- Authors can edit, trash or delete only their own posts and their own media. Bulk actions skip anything that belongs to someone else and tell you how many items were skipped.
- The newsletter subscriber list and campaign sending are administrator-only.
- The order confirmation page shows an order only to the customer it belongs to.
- Invoice PDFs live in a directory that is closed to the web and carry a random filename. They remain downloadable from your customer portal, where ownership is checked.
- A licence that has been revoked or suspended cannot download the installation package.
- A post marked private is not served to visitors on its own page. Administrators and editors still see it.
- The example environment file ships with obvious placeholders, so a fresh installation always generates its own signing keys.
Fixed
- Theme stylesheet and script addresses now carry a stamp derived from the file itself. Before this, a corrected theme file could sit on the server for months while browsers and the CDN kept serving the old copy for up to a year.
- Signing in on jekcms.com now updates the header immediately instead of leaving the "Sign In" button in place.
Move From WordPress With One File: The jekcms Migrator Plugin
Added
- A WordPress plugin that packs your whole site into one file. Install "jekcms Migrator" on your WordPress site, press Start export, download the .zip -- that is the entire WordPress side. No database host, user or password, and no server-to-server MySQL connection, which most shared hosting blocks anyway. The export runs in batches and saves its progress, so sites with thousands of posts finish without hitting PHP time limits.
- The package carries posts, pages and drafts, the category tree with its parent-child structure, tags, authors with their bios, approved comments, menus, media files, SEO titles and descriptions from Yoast, Rank Math or All in One SEO, and a redirect map from every old URL to its new address.
- Two ways to bring the package in: the setup wizard has a third scenario ("Import a WordPress package") for brand-new installs, and an existing site takes it from Admin panel -> Import -> WordPress package. Both use the same import engine, so both apply exactly the same rules.
- Imported images are copied into your own uploads folder and the addresses inside the content are rewritten to those local copies -- including the scaled variants WordPress writes into post bodies. Your images keep working after the old site goes offline.
- Old WordPress URLs are installed as 301 redirects during the import, so links in search results and on other sites keep working.
- The plugin is in the Downloads section of your customer portal, in English and Turkish.
Google Console Grows Up: Connect With One Click -- No Cloud Console -- and Real Performance Charts
Added
- Connect with your Google account in one click -- like the big-name SEO plugins. Press "Connect with Google", sign in, approve; done. No Google Cloud project, no API enabling, no client ID/secret. The flow runs through jekcms's central OAuth relay: tokens are handed to your site server-to-server with a one-time code and never appear in a browser URL. The old "your own Cloud app" method remains as an advanced option.
- Search Console now shows real charts and breakdowns: a clicks-and-impressions performance chart over the whole period, separate CTR and average-position trend charts, plus device and country breakdown tables -- alongside the existing top queries and top pages.
- Analytics gained a daily users-and-sessions chart for the selected period.
Fixed
- The indexing-coverage scan tested page URLs with the redirecting /page/ prefix, so static pages were wrongly flagged as errors; it now checks the canonical /slug address.
Get your site live
The setup wizard gets a site live in about 30 minutes. See the prices and the free edition.
View Pricing- Setup and live in 30 minutes
- 15 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO - Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)