Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 17 of 24 - 710 releases, newest first.
EULA 2.0: A Hardened License Agreement with Stronger Electronic-Acceptance Evidence
Improved
- The End User License Agreement was upgraded to version 2.0 with maximum commercial protection: explicit bans on publishing the source code to public repositories, sharing or publishing license keys, and using the code to train AI models or build datasets - each now covered by the liquidated-damages clause. New sections cover electronic acceptance as a binding signature (with an evidence agreement), agency/third-party installations, trial/developer license limits, personal-data processing grounds (KVKK), the no-withdrawal rule for instantly delivered digital goods, and standard severability/no-waiver/entire-agreement terms. Domain limits now correctly reflect the purchased plan.
- Acceptance records got stronger evidentiary value: both the checkout consent and the first-login admin consent now record the agreement's own version (EULA 2.0) and a SHA-256 hash of the exact text accepted, alongside the existing timestamp, IP, browser and identity records.
- The agreement is now readable at a public /eula page rendered from the very same file that ships with the product, showing the version and text hash; the checkout consent link points there instead of the general Terms of Service.
Newsletter Grows Up: 6 Email Templates, Selectable Signup Placements and a Scheduled Popup; Contact Form Admin Rebuilt
Added
- Six selectable email designs for campaigns and newsletters - Signature, Clean, Bold, Editorial, Dark and Minimal - chosen from a visual picker with live previews (Newsletter → Appearance), applied to the campaign template with one click. All designs are email-client-safe (table layout, inline CSS).
- Signup form placements you control: choose where the newsletter form appears - end of every post, top of the sidebar, a band above the footer, and/or a popup. No theme files are touched; the plugin injects the form on every theme through one universal point.
- A polite newsletter popup: shown after a delay you set (in seconds), at most once per day per visitor, never again after subscribing, with four selectable styles - centered card, corner card, bottom bar or mini card.
Fixed
- The Contact Form admin link no longer 404s: its pages moved to the standard plugin-admin location and the inbox was rebuilt as a tabbed page (Inbox + Settings in one place) with unread badge, filters, search, mark-all-read and the message settings alongside.
Theme/Plugin Updates No Longer Resurface After a Core Update; Admin Visits Now Drive the Scheduler Too
Improved
- The visitor-triggered scheduler (scheduled publishing + automatic updates, no cron required) now also fires on admin panel visits - on a low-traffic site, simply logging into the admin is enough to keep automation running. A real cron job remains optional.
Fixed
- Fixed an update loop where an already-applied theme update kept coming back: the core package carries a version ledger, and a stale entry in it could mark an up-to-date theme as outdated again after every core update. The updater now rebuilds the theme/plugin ledger from what is actually on disk after each core update, and the release pipeline generates the packaged ledger from the real component versions - so the loop cannot recur from either side.
- Automatic updates now apply the core first and then theme/plugin updates (with a fresh check in between), so a core update can no longer overwrite the version records of components updated in the same run.
Automatic Updates Now Work from Real Cron Jobs
Fixed
- Update downloads triggered from a real (CLI) cron job were rejected by the license check: without a web request there is no host header, so the download request reported "localhost" instead of the licensed domain and the server refused it - automatic updates could never actually install from cron. The updater now always uses the domain stored with the license activation (matching how the update check already behaved), so scheduled automatic updates install correctly. Verified end-to-end: a live install auto-updated its core from cron with the license intact.
Your License Now Survives Core Updates; Plugin Cards, System Menu and AdSense Intro Polished
Improved
- Plugin cards are aligned and consistent: the action button row now sits at the same height on every card, descriptions are standardized to a fixed length range (with a display clamp as a safety net), and previously unlocalized plugins (Stories, Cloudflare, AdSense Readiness, ZeroTrack) got proper Turkish/English names and descriptions.
- The System section of the sidebar is reordered by frequency of use: Settings, Updates, License, Import, Backups, Users.
- The AdSense Readiness first-run screen was redesigned to match the admin design language: a calm card with the scan scope listed as chips and a single standard primary action, replacing the dashed box with duplicate oversized dark buttons.
- The automatic-updates note on the Updates page now stays on a single line on desktop.
Fixed
- Critical: applying a core update no longer wipes the license activation. The core package ships its own version file and overwriting it dropped the stored license - the panel fell back to "activate your license" and theme/plugin update buttons disappeared. The updater now preserves the license (and a custom update-server address) across core updates. A related latent bug was fixed too: database migrations no longer overwrite the new package version metadata while recording their progress.
- The header update banner now says what is actually pending: the core version when a core update is ready, otherwise the number of theme/plugin updates - instead of a bare "Update available!" that lingered confusingly after a core update.
Plugin Cards Now Show a Distinct Icon per Plugin
Improved
- Every plugin card on the Plugins page now has its own recognizable icon (newsletter envelope, SEO magnifier, social share graph, analytics bars, cloud, quiz, recipe and more) instead of the same generic circle repeated on every card. Plugins without a dedicated icon fall back to a package icon.
Automatic Updates Arrive; the Updates Page Gets Even Simpler
Added
- Automatic updates: on the Updates overview you can now choose "Off", "Plugins + Themes" or "Everything (core included)". With it enabled, the scheduler checks once a day and applies pending updates through the same signed channel - backup first, automatic rollback on failure, and every run is recorded in the History tab.
Fixed
- Fixed a server-side configuration blind spot dating back to the security hardening that moved secrets out of the web root: the update/license API could no longer load its database credentials, so the component update catalog silently served empty results. The API now searches the relocated secrets directory as well - theme and plugin updates published to the channel are actually visible to installations again, verified end-to-end against the signed manifest.
Updates Page Reorganized into Tabs; Package Install Stays Visible (Locked) on Managed Sites
Improved
- The System Updates page now uses the same tabbed layout as Settings: Overview (status strip + available updates + installed components), Install Package, History (updates + backups) and Release Notes each have their own tab, instead of one long scrolling page. The Overview tab shows a pending-update count badge.
- Package type selection on the install tab is now a visual card picker (Plugin / Theme / Core) with the SHA-256 field appearing only for core packages.
- On centrally-managed installations the Install Package tab is no longer hidden: it explains why ZIP installs are disabled there and how they can be enabled when genuinely needed (JEK_ALLOW_SELF_UPDATE); with the flag set, the full install form is available with an overwrite warning.
System Updates Page Rebuilt: Plugin/Theme/Core Package Installs, Update History and In-Panel Release Notes
Added
- The System Updates page can now install packages by ZIP upload - plugins and themes as well as the core. Plugin and theme packages are structure-validated before install (single safe root folder, a real plugin.php version header or theme.json), a backup is taken automatically and a failed install rolls back. Core packages keep the stricter rule: the official release SHA-256 digest is required.
- A local update history now records every applied update - component, old and new version, whether it came from the update channel or a manual upload, and whether it completed, failed or was rolled back. The history survives cache clears and deployments.
- Release notes are now readable inside the panel: the page shows the full recent core changelog (bilingual, categorized) plus published theme and plugin releases, fetched from jekcms.com and cached for 12 hours. Centrally-managed sites see them too, so operators and site owners follow the same history.
- The installed themes and plugins lists moved into their own collapsible "Installed Components" card with counts, so a site with many themes no longer stretches the version summary into a full-page column.
Fixed
- Backup folders no longer appear as installed components: a leftover directory like "Trends.bak-20260430-210630" was listed as a theme on the updates page and even reported to the update server. Backup-named folders (.bak/.old/.backup) are now excluded everywhere.
- Live sites no longer display a stale core version: the per-site version file was left behind by deployments (a site could show 2.16.20 while actually running the current release), and it is now synchronized on every release.
- The update report sent after a core update now carries the real previous version instead of always reporting "unknown".
Update Notifications Across the Admin: Sidebar Badges, Plugin/Theme Cards and a Dashboard Core Alert
Added
- WordPress-style update notifications throughout the admin panel. When an update is published for an active plugin, the "Plugins" sidebar item shows a numbered badge; installed-theme updates show the same badge on "Themes", and the "Updates" item now shows the total pending count instead of a generic mark.
- Plugin and theme cards now show an "Update available vX.Y.Z" notice (with the current → new version in the tooltip) linking straight to the Updates page. The notice appears on every installed plugin, active or not - the sidebar badge only counts active ones.
- A core update now shows a clear notification band on the dashboard with the installed and available version, including a "critical update" emphasis for security releases. Centrally-managed installations receive updates from the operator, so they intentionally show none of these prompts.
- All notifications are fed by a single per-request status helper sitting on top of the existing 12-hour update-check cache, so no extra requests are made to the update server.
Fixed
- Repaired a disconnect in the update release channel: versions uploaded through the release management panel were stored in a legacy catalog that the client update API never read, so published releases were invisible to installations. The panel now writes to the same catalog the update API, the signed manifest and the download endpoint all read, and lists the SHA-256 of every uploaded package.
- Contact Form 1.0.1: server-side responses (validation errors, rate-limit and security messages) now follow the site language - English sites no longer show Turkish error messages to visitors. Field length limits are now counted in characters rather than bytes, so messages with accented or non-Latin characters near the limit are no longer rejected even though the form allowed them.
Content Quality Gate Now Blocks Leaked Rewrite Notes and Stray Image Markers
Added
- The Content Quality Gate now blocks publishing when a post contains a leaked editorial process-note - the kind an automated rewrite step can leave behind, e.g. a fake "Kaynak" (Source) section whose text is "metindeki … temizlendi/çıkarıldı" (commentary about what was edited) rather than a real citation. The check is precise: it triggers only on the "Kaynak"+"metindeki" leak signature, so legitimate uses of the word "metindeki" (e.g. in a regex or text-processing article) are never blocked.
- The gate also blocks any post still containing an unresolved [IMAGE:] placeholder marker, which would otherwise leak into the published page as raw text instead of an image.
Cloudflare Safety: "Apply Recommended" Is Now Origin-Aware and Can Never Take Your Site Down
Fixed
- Fixed a serious bug where "Apply recommended settings" could take a live site offline. It set the Cloudflare SSL mode to Full (Strict) unconditionally; if the origin server's certificate was expired the site returned 526, and if the origin had no HTTPS certificate at all the site returned 525 (SSL handshake failed). Both make the whole site unreachable.
- The recommended SSL mode is now Full (not Full/Strict). Full encrypts browser-to-Cloudflare with a valid certificate and Cloudflare-to-origin as well, but does not reject an expired or self-signed origin certificate, so it can never cause the 526 that Strict does. If your origin certificate is valid you can still upgrade to Full (Strict) manually in the Cloudflare dashboard.
- Added an origin-HTTPS safety gate: before touching the SSL mode the plugin checks whether your origin server can complete a TLS handshake at all. If it cannot (no certificate installed), the SSL setting is skipped entirely and the plugin explains that you need to install a certificate (e.g. free Let's Encrypt) in your hosting panel first. All the other recommended settings still apply. The connected panel also shows this warning up front.
Accessibility: Primary Navigation No Longer Trips the "aria-hidden Contains Focusable Elements" Audit
Fixed
- Fixed an accessibility violation flagged by page audits (and the newer AI-agent accessibility scan): the shared mobile-navigation script set aria-hidden="true" on the primary
- aria-hidden (and inert) are now applied only while the mobile panel is genuinely hidden on small screens, and removed on desktop where the navigation is visible and focusable. Also removed a redundant static aria-hidden="true" from the lifestyle theme mobile-nav so it can never leak into the desktop tree. Applies across every installation via the shared, cache-busted navigation script.
Cloudflare Panel: Consistent Status Icons and a Truthful Exception-Rule State
Fixed
- The two checklists in the connected panel now use the exact same status icons. Previously the recommended-settings list used a plain checkmark while the exception-rules list used a different check-in-a-circle icon, which looked inconsistent.
- The exception-rules list now reflects its real, live state instead of always showing green. The panel reads the current custom rules from Cloudflare and marks each jekcms exception as applied (green check) or not-yet (empty), with an "ALL APPLIED" badge and a re-apply / apply-count button that mirror the recommended-settings card.
Cloudflare Exception Rules Now Actually Apply: Right Permission, Modern API, Your Own Rules Preserved
Improved
- Removed the colored left-rail line from the sidebar warning cards (a design-system rule) and reworked them into clean, softly tinted alert cards -- amber for attention, blue for info -- that fit the rest of the admin.
Fixed
- Fixed "Apply exception rules" failing with an Authentication error even when the token had "Firewall Services -> Edit". Diagnosed against the live Cloudflare API: the legacy Firewall Rules API is now frozen (maintenance mode, no new rules), and modern WAF custom rules (Rulesets API) require the separate "Zone WAF" permission -- which "Firewall Services" does not grant. The setup wizard now asks for "Zone -> Zone WAF -> Edit" (with a note explaining why), and every permission error message names the exact permission needed.
- The jekcms exception rules now use a proper skip action that bypasses the relevant Cloudflare security products (WAF managed, browser integrity check, security level, rate limiting, UA/zone lockdown) for the automation and crawler paths, instead of an ineffective placeholder.
- Applying the exceptions no longer wipes your own custom WAF rules. The plugin now reads the existing rules first, refreshes only the jekcms ones, and preserves everything else -- so re-applying is safe and idempotent.
Cloudflare Wizard: "Connect" Now Really Connects, Clearer Token Steps, Calmer Sidebar
Improved
- The token step now walks through Cloudflare's real screens in order: My Profile -> API Tokens -> Create Token, then explicitly "under Custom token click Get started" (so users do not pick a template that grants the wrong permissions), then naming the token (Token name, e.g. jekcms) before the permission table. This closes the most common wrong-permission trap.
- Reworked the setup wizard into the same calm two-column layout as the connected panel: the step-by-step guide on the left, the critical warnings in a refined right-hand sidebar. Removed the remaining red boxes in the wizard (red read as an error); warnings are now amber "attention" / blue "info" with a clean left-rail accent instead of the previous generic colored icon tiles.
Fixed
- Fixed a bug where the setup wizard's "Connect" button never actually connected. The test-mode toggle was accidentally nested as a <form> inside the connect <form>; browsers flatten nested forms, so pressing Connect submitted the toggle action instead -- the token was never saved or verified and the panel stayed stuck in test (mock) mode no matter what. The two forms are now separate, and connecting with a real token always runs a real verification (and clears any leftover test mode).
Cloudflare Panel: Real Action Feedback, Permission Diagnostics and a Calmer Layout
Improved
- Reworked the connected Cloudflare panel into a two-column layout: the actionable cards (status, recommended settings, automation exceptions, your own rules) sit in the main column, and the "Critical warnings" moved into a calm right-hand sidebar. The warnings are no longer shown as loud red error boxes -- red read like something was broken; they are now amber "attention" and blue "info" notes.
- Unified the panel header (title + description on one clean band with a direct "Open Cloudflare dashboard" button once connected), and the marketing value strip now only shows before you connect, so the connected panel leads with live status instead of a sales pitch.
Fixed
- Fixed missing feedback on the Cloudflare panel: Purge cache, I'm Under Attack, Apply recommended and Apply exceptions all reloaded the page silently with no confirmation. The panel was writing its flash message under one key while the admin renderer read another, so nothing ever showed. Every action now shows a clear success / warning / error banner.
- Fixed the SSL and Security tiles showing a bare "?" with no explanation when the connected API token lacked the Zone Settings permission. The panel now detects the read failure, shows a plain-language notice telling you to recreate the token with "Zone Settings -> Edit" (and surfaces Cloudflare's own error), instead of a silent question mark.
Cloudflare Setup Wizard: Cleaner Layout and a Token Table That Mirrors Cloudflare
Improved
- The token step now shows the required permissions as a table that matches Cloudflare's real "Create Token" screen one-to-one (Group / Item / Access), plus a matching Zone Resources row (Include / Specific zone / your domain). You can copy each dropdown value straight across instead of decoding a run-on sentence.
Fixed
- Fixed a layout bug in the Cloudflare setup wizard where the click-path chips (Domains, Add domain, Overview, etc.) were placed inline inside wrapping paragraph text; their padding was taller than the line, so wrapped lines overlapped and the guide looked jumbled. Each navigation path now sits on its own dedicated breadcrumb row with chevrons, so the text stays clean at every width.
Cloudflare Wizard Matched to the Real Onboarding Flow: DNSSEC, AI Policies, and the MX/TXT Nuance
Improved
- The Cloudflare setup wizard now mirrors Cloudflare's current add-site flow step by step: Domains → Add domain → "Connect a domain", the new "AI training & search policies" screen (with a jekcms recommendation - Search: Allow and Agent: Allow so you stay visible to search and AI answer engines, matching your llms.txt), picking the Free plan, and reviewing the auto-scanned DNS records before activation.
- Two easy-to-miss but breaking details are now called out explicitly. Turn DNSSEC OFF at your registrar before switching nameservers - leaving it on while you move NS to Cloudflare makes the site completely unreachable. And keep email records (MX, SPF/DKIM TXT) grey "DNS only" while web records (A/AAAA/CNAME) go orange (proxied) - proxying mail records breaks delivery.
- The token step now points at the shorter path too (Overview → API → "Get your API token", or My Profile → API Tokens), and the step indicator reflects the real four phases: Connect, Plan + DNS, NS, Token.
Cloudflare Wizard Leveled Up: Polished Steps, Current Dashboard Paths, and a Bot Fight Mode Warning
Improved
- The Cloudflare setup wizard was rebuilt to feel like a real onboarding flow: a visual step indicator, a value strip (protection / speed / jekcms-aware), and richer step content with breadcrumb-style dashboard paths that match Cloudflare's current interface - creating a custom token now lists the exact permissions to grant (Zone Read, Zone Settings Edit, Cache Purge, Firewall Services Edit) scoped to the one site, and each step points at the right menu (Overview, DNS, My Profile → API Tokens).
- A critical-warnings block now surfaces two things the API can't safely automate: keep Free-plan Bot Fight Mode OFF - it is aggressive and does NOT honor the jekcms skip rules, so turning it on breaks scheduled publishing, n8n and search/AdSense crawling - and make sure your DNS records are proxied (orange cloud) or the whole CDN/WAF layer is bypassed. The advanced panel also links straight to Cloudflare's Bot settings and WAF custom-rules pages.
New Plugin: Cloudflare - a CDN + WAF Edge Layer With a jekcms-Aware Setup Wizard
Added
- A Cloudflare plugin puts an optional CDN + WAF layer in front of your site - extra protection and speed on top of jekcms's built-in security (2FA, encrypted keys, signed updates), not instead of it. A four-step wizard walks you through it: create a free Cloudflare account and add your domain, change your nameservers (with the exact NS to set at your registrar), create a scoped API token (the wizard lists the precise permissions - Zone Settings, Cache Purge, Firewall - limited to this one site), then paste the token to connect. The token is stored encrypted with the same AES-256-GCM vault used for AI keys, and is never shown again.
- One click applies the settings that actually fit jekcms - and each one explains why: SSL Full (Strict) because "Flexible" would loop against the server's own http→https redirect; Always Use HTTPS; a TLS 1.2 floor; HTTP/3 and Brotli for speed; a sensible security level and browser integrity check.
- A second one-click step writes the exception rules that keep jekcms working behind Cloudflare - the part a generic plugin gets wrong. Cloudflare's bot/challenge layer is told to skip /api/v1 (n8n and integrations), the scheduled-publishing loopback and the analytics beacon, and robots/sitemap/ads.txt - without these, scheduled posts, automation and search/AdSense crawling silently break. The real visitor IP is already restored safely from CF-Connecting-IP for rate limiting and logs.
- The status panel shows zone/SSL/security state live, offers one-click cache purge and an "I'm Under Attack" switch, and deep-links to Cloudflare's own WAF editor for your custom rules - deliberately kept there, since a mis-written rule can lock you out. Publishing, updating or deleting a post now purges the affected URLs from the edge automatically. A test (mock) mode lets you preview the whole flow before connecting a real token.
Dark Theme Pass: the Root Cause of White Boxes Fixed, With a Permanent Guard
Improved
- The SERP Identity report's code window now uses a fixed GitHub-dark palette - identical and fully readable in both the light and the dark admin theme, instead of inheriting ambient colors that could lose contrast.
Fixed
- Several admin screens kept glaring white patches in dark mode - the contact messages card, the sticky "Save settings" bar, the social-profiles box on the user form, the backup info strip. The root cause was one pattern, not many bugs: pages referenced CSS variables under local names (--card-bg, --admin-surface, --bg-subtle…) that the admin stylesheet never defines, so their light fallback color won in every theme. Those names are now bridged to the real theme tokens in one place, the remaining hardcoded light strips were converted to tokens, and a static guard runs with the release gate: any future undefined variable with a light fallback fails the build before it can ship a white box.
- Browser autofill was punching light-lavender fields into dark forms (social connections, backup inputs). Autofilled inputs now keep the admin theme's own background and text color.
SEO Tools Accuracy Pass: ads.txt False Negative, Honest Heading Warnings, Stale-Year Scanner, and a Code-Style SERP Report
Improved
- The SERP Identity Check turned from a raw text dump - unreadable on the dark admin theme - into a GitHub-style code window: line numbers, syntax coloring on the admin's own theme tokens (correct in light and dark), a clean/review status chip, one-click copy, and the old plain-text output still available for support scripts.
Fixed
- SEO Health Check could report ads.txt (and favicon) as missing while the file was live: the checker requests a byte range, and web servers answer static files with HTTP 206 Partial Content - which the check treated as failure. 206 is now recognized as success and redirects are followed, so sites with a physical ads.txt are reported truthfully.
- The Heading Fixer's "starts lowercase" warning looked wrong because it never said WHICH heading it meant - it checks subheadings inside the article body, not the post title, so a flag on "Linux RAID Setup: mdadm…" read like a false alarm. The warning is now honest twice over: the label says "a content subheading", the message quotes the actual heading text, and the technical-term whitelist grew by ~40 commands (mdadm, vmstat, iostat, netsh, adb and friends) so command-titled sections are no longer flagged at all.
- The Year Updater only suggested last year by default, quietly missing older leftovers. It now scans every title and slug for any past year and shows them as clickable chips - "2021: 4 posts, 2019: 2 posts" - one click selects that year for the bulk update.
Advanced SEO Ships Active by Default - the Single SEO Panel Works Out of the Box
Improved
- The Advanced SEO hub - the single panel that 2.46.2 made the one way into every SEO tool - used to require manual activation on a fresh install, which would have left new sites with the old scattered entry points until someone flipped the switch. The plugin now activates itself on first install, so the sidebar entry, the module menu and the single-navigation routing are all there from minute one. Existing installs are untouched: whatever activation state you chose stays exactly as it is.
One SEO Panel: Duplicate Entry Points Now Route to the Advanced SEO Hub, Legacy Duplicate Screens Retired
Fixed
- The standalone SEO Optimizer page and the Advanced SEO hub were the same tool with two front doors: the dashboard's "SEO score" tiles opened /seo-optimizer.php directly, where the sidebar showed no active section and the hub's module menu was missing. Every tool embedded in the Advanced SEO hub (optimizer tabs, health check, heading fixer, content optimizer, auto-linker, redirects and friends) now routes its direct URL into the hub with the right module selected - old links and bookmarks keep working, the sidebar highlights correctly, and there is exactly one way in. The routing is careful: POST requests, embedded (iframe) loads and unknown internal tabs are never redirected, and if the Advanced SEO plugin is deactivated the standalone pages behave exactly as before.
- Two hidden screens left over from old versions were retired into safe redirects, found by a full inbound-link scan of the admin: "Advanced Ad Manager" duplicated banners.php on the same database table, and "Content Scheduler" duplicated the Content Queue - worse, it carried its own outdated CREATE TABLE that could seed a fresh install with the wrong schema. Both now 301 to their successors; nothing was deleted, old bookmarks land in the right place.
- The WordPress REST API migration tool existed but was linked from nowhere - you could only reach it by typing the URL. It now has a visible entry on the Import screen, next to the SQL/CSV path it complements.
Customizer Polish: Light/Dark Color Rows Are Now One Aligned Component
Fixed
- The light/dark color pair introduced in 2.46.0 looked cluttered: the disabled dark swatch was squeezed into a thin gray sliver by the flex layout, the two rows didn't line up, and the override checkbox floated awkwardly at the end. Each color is now a single aligned component - a fixed four-column grid (sun/moon tag, swatch, hex, control) shared by both rows, so swatches and hex fields sit exactly under each other; the checkbox became a proper toggle switch; and a disabled dark row dims cleanly with a "theme default" placeholder instead of collapsing.
Theme Customizer, Reworked: Separate Light & Dark Palettes, New Theme-Specific Sections
Added
- Every color in the theme customizer can now be set separately for light and dark mode. Each color shows a Light and a Dark picker; the dark value is written under the theme's real dark mechanism - the data-theme attribute on ten themes, the .dark-mode class on Finance, and the system preference (prefers-color-scheme) on Lifestyle. An "override" switch per color keeps the theme's own dark tone until you opt in, and themes without a dark mode (Crypto is light-only, Tech is dark-native) simply don't show dark pickers - no fake settings. All twelve theme-specific schemas gained the pairing automatically, without a single line changed in their definitions.
- Minimalist and Lifestyle - the two themes that had been falling back to a thin generic panel - got full, hand-written customizer schemas wired to their actual stylesheets: every color maps to the variable the theme really uses (defaults read from the CSS itself, including Minimalist's dark block), font pickers, layout controls (content width; on Lifestyle also section spacing and grid gap), and real section toggles that were wired into the templates - hero, categories bar and newsletter on the homepage; breadcrumbs, share buttons, author card and related posts on articles (Lifestyle additionally: table of contents and the popular-posts widget). Toggles physically remove the markup, they don't just hide it.
- The default schema for future themes also grew: heading, border and surface colors, body line-height, and font pickers that emit their CSS variables directly.
Improved
- jekcms.com now tells both stories on the features page: the reworked Theme Customizer (with its light/dark palettes) and the AdSense Readiness plugin shipped in 2.45 - described honestly, including that approval is always Google's call.
Fixed
- The Lifestyle theme's customizer had never actually worked: the theme's header never printed the customization stylesheet, so every saved setting was silently ignored. The calls are now in place - and covered by a behavior test that catches any theme dropping them again.
- The customizer spoke Turkish to English admins in two themes: Personal and Trends had their panel labels written in Turkish inside the theme definition, and the translation dictionary only worked in one direction. All their labels are now bilingual at the source, help texts pass through localization too, a reverse mapping catches any legacy Turkish label, and a new two-language scan across all fourteen themes runs with the test suite - zero leakage, permanently guarded.
AdSense Readiness: Stored Scans Auto-Refresh After a Plugin Update
Fixed
- After updating the plugin, the dashboard could keep showing the previous version's stored scan - old wording, and no "Show posts" modal button, because that list simply doesn't exist in the old result. The panel now compares the stored scan's plugin version on load and silently re-runs the audit when it's stale, so a new feature never appears to be "missing" just because the visible result predates it. The scan is measurement-only and changes nothing on the site.
AdSense Readiness: Sticky Insight Panel, Full-Width Header, and a Post-List Modal
Added
- Checks that carry a post list - thin content first - now open a modal: every affected post is listed by title with its word count, and clicking a row opens that post's edit screen in a new tab. No more hunting post IDs from a summary sentence; the list is capped at 200 rows with an honest "first N of M shown" note beyond that.
Improved
- The empty right side of the AdSense Readiness dashboard is now a sticky insight panel that follows you as you scroll. It carries the full "maturity - honest note" (why green checks alone don't guarantee approval, with your site's first-publish date and last-30-days output), an application-process card with the key numbers (2–14 day review, ~1 week wait after a rejection), and an application-day checklist: single-source AdSense snippet, automatic ads.txt verification, Search Console, and keep-publishing-during-review.
- The header now spans the full layout: the intro paragraph is no longer truncated into a narrow column, and the Re-scan button sits at the far right of the title row.
AdSense Readiness: 5 New Checks, a Legal-Page False Negative Fixed, and a Polished Dashboard
Added
- Five new checks in the AdSense Readiness audit. SSL certificate: a real TLS handshake verifies the chain and reports the issuer and days until expiry (expiring within 14 days warns, expired fails). Domain: the site must live on a real domain - an IP address or a bare host fails, and IDN (unicode) domains get a punycode heads-up. Google bot access: the homepage is actually requested with Googlebot and Mediapartners-Google user agents to prove the server doesn't block the crawlers AdSense review depends on (honestly labeled as an in-server test - a CDN/WAF in front should also be verified externally). noindex is now its own heavyweight check covering both the homepage meta tag and the SEO setting. Meta description: presence and length of the homepage description (target 120–160 characters).
Improved
- The dashboard got a design pass: the five category cards now sit in a single equal-width row with ellipsized titles (no more ragged two-line wrapping), and the previously empty right side of the score hero hosts a compact "maturity - honest note" summary with a link to the full text. Status filters became a proper segmented control, fix buttons are now solid primary actions, cards gained consistent depth and hover states, and the score ring color follows the overall verdict instead of the raw number - no more green ring next to "fix the gaps".
Fixed
- Legal pages were reported missing on sites that serve them through the built-in route templates instead of database pages. jekcms renders complete, AdSense-compliant legal texts at /privacy-policy, /cookie-policy and friends even when no page row exists - the audit now recognizes both paths (plus every slug alias, Turkish and English), and the About/Contact checks follow the same logic: a database page, a theme template or the contact-form plugin all count; only sites left with the bare built-in fallback get a warning.
- Clicking a category card scrolled the section heading under the fixed admin header, landing mid-section. Anchor targets now reserve headroom, so every jump lands with the section title fully visible.
Get your site live
The setup wizard gets a site live in about 30 minutes. See the prices and the free edition.
View Pricing- Setup and live in 30 minutes
- 15 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO - Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)