Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 18 of 20 — 576 releases, newest first.
Installer Renamed to jekcms-install.php (avoids WordPress clash)
Improved
- The setup file is now
jekcms-install.phpinstead of the genericinstall.php. A leftover WordPressinstall.phpon the server can no longer be confused with — or shadow — the jekcms installer. All "not installed yet" redirects and robots rules were updated to match
Setup Wizard — Clean WordPress Switchover (Safe Cleanup + Logo)
Added
- The wizard now finishes a WordPress migration cleanly — after importing your content, a Cleanup step lists exactly which old WordPress files will be removed and asks you to confirm (with a clear "this cannot be undone" warning). It then deletes them with a live progress bar, and optionally drops the old WordPress database too
- Safe by design — only genuine WordPress files are removed (a strict allow-list:
wp-admin,wp-includes,wp-content,wp-*.php,xmlrpc.php…). jekcms’ own files are never touched — even where names overlap (e.g. license/readme). The wizard also refuses to drop jekcms’ own database - Logo support — your site logo is pulled automatically from WordPress when migrating, or you can upload one (PNG/SVG/JPG/WebP). For a fresh install, just upload your logo. It’s saved to your site settings
Setup Wizard — English & Turkish, English by Default
Added
- The setup wizard now speaks English and Turkish, defaulting to English. A language toggle (EN/TR) sits next to the theme switch in the top bar, and your choice is remembered. Every label, hint, button, alert and progress message is fully translated
Setup Wizard — A Polished, Modern First Impression
Improved
- The setup wizard was redesigned from the ground up — a glassy, animated interface with a numbered progress tracker, the jekcms wordmark logo, soft animated background auras, smooth card transitions and a live progress bar. It now supports both dark and light themes with a one-tap toggle (your choice is remembered)
- The database step is much clearer — it now explicitly states that this is a new, empty database for jekcms, with a prominent note for WordPress users that it is not their existing WordPress database (that comes in the next step). No more mixing them up
Setup Wizard — WordPress Migration Verified End-to-End
Fixed
- The WordPress import step now connects to the correct database. Three real-world bugs found during a live migration test (a 114-post WordPress site) were fixed: the framework is loaded in global scope so the site's configuration is read correctly, database seeding no longer collides with open result cursors, and AJAX responses are now always clean JSON (no stray warnings)
New Setup Wizard — Install Fresh or Migrate From WordPress in Minutes
Added
- A modern, guided installer (install.php) — drop it next to the jekcms archive in your site root, open it in a browser, and it walks you through everything: a system requirements check, database connection (with step-by-step phpMyAdmin guidance and auto-create if the database is missing), site details, theme choice and admin account. It then unpacks the files, builds the database, applies your settings automatically, and cleans itself up afterwards
- WordPress migration built into the wizard — choose "Migrate from WordPress", enter your WordPress database details, and the installer previews how many posts, pages, categories and comments it found, pre-fills your site name and tagline from WordPress, then imports content, downloads & converts images to AVIF, and brings over approved comments. At the end it checks for leftover WordPress files and warns you to remove them to avoid conflicts
- Finishes with clear next steps — two cards to open the Admin Panel or view your site, with your details already filled in
Account & License Security Hardening
Fixed
- License site-limit race condition closed — registering domains for a license is now serialized (row-locked), so two simultaneous requests can no longer slip past your plan's site limit
- Logout now fully ends the session — the session is destroyed and its cookie cleared (previously only the user id was removed), removing a session-fixation surface
Reliability Audit — Newsletter Cron, Scheduled-Posts Link & Contact Inbox Fixed
Improved
- Trimmed remaining developer-oriented notes across the admin (technical jargon, internal details) down to plain, end-user labels
Fixed
- Newsletter sending cron was broken across all sites (a comment line accidentally ended early and broke the file). Scheduled campaigns now send again
- Scheduled-posts link in the top bar led nowhere — it now opens the scheduled posts list correctly
- Contact-form inbox could load the wrong site's configuration (a hard-coded path) — now resolved per-site
Google Console — One Clear "Scan" Button
Improved
- Index Coverage now has a single Scan button (auto-completes the whole site; becomes Re-scan when done) instead of three overlapping controls. Each card carries one short line explaining what it does
Google Console — Cleaner, Less Cluttered Copy
Improved
- Trimmed long explanatory notes in the Google Console panel down to short, action-focused labels — less clutter, faster to scan
Google Console — Cleaner Search Console Flow + Responsible Bulk Indexing
Added
- Bulk "Submit to Index" — notify Google about your not-indexed pages in one click. Built responsibly: a daily cap (well under quota), the same URL is never re-sent within 14 days, and only genuinely not-indexed pages qualify (404 / noindex / redirects are skipped). A clear notice explains that Google officially supports the Indexing API only for job-posting / livestream pages
Improved
- Search Console tab decluttered — the redundant single-URL inspector was removed (Index Coverage already shows every URL's status). One clear flow: coverage summary → problem list → indexing actions
- Auto-scan reliability fixed — coverage now scans in short, fast batches with automatic retry, so it no longer trips the "connection error" on stricter hosts
Google Console — One-Click Auto Scan for Index Coverage
Improved
- Index Coverage now scans automatically — one "Auto scan" click runs the whole site in the background, batch by batch, with a live X/Y checked… progress counter, instead of clicking "Next batch" a dozen times. Google's URL Inspection API is rate-limited and ~one URL takes a few seconds, so the panel paces itself and resumes until every URL is checked
- Resilient & cached — each batch is time-guarded so it never hangs the page, results are cached 24h, and a single-batch manual button plus Reset remain for fine control
Google Console — Pick Your Analytics Property From a List (No More ID Typing)
Improved
- GA4 is now a dropdown, not a number to copy — Settings → Auto-discovery lists the Analytics accounts and properties your Google account can access, so you just pick yours instead of hunting for the numeric Property ID. Matches the existing one-click selection for Search Console site and AdSense account. Manual entry stays as a fallback
- Index Coverage is clearer before scanning — instead of a confusing row of zeros, the card now shows a clear "ready to scan" prompt, and explains that its totals won't exactly match Search Console's "Page indexing" numbers (Google also counts category/tag/system and old URLs; the panel checks your published content)
Google Console — See Which Pages Google Isn't Indexing
Added
- Index Coverage in the Search Console tab — a new card scans your site's URLs and groups them by Google's indexing status: Indexed, Not indexed (crawled/discovered but not added, unknown to Google) and Error (404, server error, blocked by robots). You finally see your indexing problems in one list instead of checking URLs one by one
- Quota-friendly, incremental scan — built on Google's URL Inspection API (the only API that exposes per-URL index status). Each click inspects ~10 URLs, results are cached 24h, and a wall-clock guard keeps it responsive — large sites finish in a few clicks. Problem URLs link straight to Submit to Index
Google Console UI — Now Fully Native to Your Admin Theme
Improved
- The Google Console panel was rebuilt on the admin design system — it now follows your dark/light theme, uses the same cards, pill buttons, segmented date controls and typography as the rest of the admin instead of a separate light-only look. A more professional, cohesive dashboard
- Cleaner data presentation — connection status shown as a clear pill badge, neutral monochrome trend charts (no decorative color noise), refined KPI cards, tables and diagnostics that read at a glance
Google Console Now Ships With Every Theme
Added
- The Google Console plugin is now bundled with every jekcms theme — Search Console performance, GA4 traffic, AdSense earnings and frontend GA4/GTM/AdSense snippet injection in one panel, behind a single Google sign-in. Previously available on one theme, now on all of them
- One-click connect, encrypted tokens — OAuth refresh/access tokens are stored encrypted; the connection survives even if your admin session drops mid-flow (server-side one-time state, 10-min window)
One Universal Key, Multiple Sites — Manage Domains From Your Dashboard
Added
- Site management in your account — one license = one key + N site slots. Register each site's domain (e.g.
siteadi.com) under My Licenses, up to your plan's limit. Adding a site beyond the limit is blocked - Strict activation — a site only activates if its domain is pre-registered for that license; an unregistered domain is rejected with a clear message. You control exactly which sites use your license
- Upgrade path — move to a higher plan for more sites; your key stays the same
Simpler Pricing — Same Everything, Only Site Count Differs
Improved
- Every plan now includes the exact same features and support — all 14+ themes, all SEO & automation tools, priority support, lifetime updates. The only difference between plans is how many sites you can run
- Clear tiers: Personal $29 / 1 site · Standard $79 / 3 · Professional $149 / 10 · Unlimited $349 / ∞. The confusing dual "Agency $299 / Enterprise $599" tiers were replaced by one Unlimited plan
Fixed
- Pricing data was inconsistent across the site, checkout and license server (Agency was 50 domains in one place, unlimited in another, $299 vs $599). Now a single consistent model end-to-end
New Plugin: Google Console (Analytics + Search Console + AdSense)
Added
- Google Console plugin — Search Console (clicks, impressions, queries, URL inspection and one-click index submission), Analytics GA4 (traffic and channels) and AdSense (earnings) on one screen, through a single Google sign-in
- Tag insertion — GA4, Tag Manager and AdSense tags are placed on your site from the panel, with no theme file to edit
- Built to keep running — access tokens are stored encrypted, responses are cached so you do not burn through Google's quotas, each API reports its own status, and an expired connection says "reconnect" instead of failing quietly
Infrastructure Hardening — Security, Performance & SEO
Security
- Payment webhooks now fail closed (Stripe + iyzico): an order is marked paid only on a valid signed webhook, and the paid amount is verified against the order total
- Admin payment/customer/order pages now require admin role; maintenance scripts locked to CLI; session cookie set to
SameSite=Lax(fixes being logged out when returning from external links)
Improved
- Faster page loads — plugin scan cached per request, composite DB indexes, and N+1 query batching on list pages. SEO: correct archive titles, paginated-page noindex, dynamic html lang
Fixed
- Analytics plugin (ZeroTrack) and Smart Backup now create their database tables on first use, fixing a 404/500 on fresh installs
Hero Trimmed to a Hook + Features Grid Expanded
Improved
- Hero copy trimmed to a hook — the 8-vendor laundry list ("Analytics (Plausible). SEO schema (Rank Math)...") was too long. Replaced with a sharp hook: "Not plugins. Core." + a single subtitle quantifying the savings (20+ features, ~$624/yr). Same message, half the words, double the impact
- Features grid expanded from 14 to 20 cards — added 6 cards for built-in capabilities that were previously hidden: Social Publisher (Buffer/Hootsuite — 18+ networks auto-publish), Instant Indexer (IndexMeNow — IndexNow + WebSub + Web Push), Newsletter (Mailchimp — campaigns + subscribers + digest), AI Image Generator (Canva — Gemini-driven post covers), AI Bulk Publisher (ContentBot — n8n + bulk queue), and they collectively replace another ~$390/yr in subscriptions
Hero Copy Forced from Code — DB Override Bypass
Fixed
- Hero subtitle was empty on production — load_marketing_translations() pulls hero_subtitle from the marketing_translations table when present, which still held a stale pre-v2.8.1 entry on production (the 8-vendor copy never displayed). Fix: after merging defaults+DB layers, header.php now force-overrides hero_title and hero_subtitle from the code defaults. Marketing-investment copy is a release-time concern, not a CMS admin concern
A Homepage That Names What jekcms Replaces
Improved
- The homepage says what you actually get — instead of an abstract feature list, it names the tools jekcms replaces (analytics, SEO, backup, security, two-factor login, redirects, image optimisation, caching) so you can compare against what you pay for today.
Performance Suite — Redirect Manager + Image Studio + Critical CSS, Built-In
Added
- Redirect Manager (NEW) — a panel screen where you add, edit and delete 301, 302, 307, 308 and 410 redirects. The lookup runs before the page is built, so a redirect costs no extra page load. Each rule shows a hit counter and the date it was last used, so you can see which old addresses people still open.
- 404 logger + Orphan 404s tab — every 404 hit is logged with referrer + UA. The admin sees URLs with 3+ hits in the last 30 days and can create a 301 with one click + a target URL field. Solving SEO recovery becomes a feed scroll
- 404 records stay clean — the log table repairs itself on first use, and panel, API and analytics requests are skipped so your own traffic never shows up as a broken link.
- Image Studio — the media optimisation screen now covers what a paid image plugin does: convert your whole library in batches, generate responsive sizes from 320 to 1920 pixels, produce tall Pinterest images and stamp your domain as a watermark.
- Critical CSS Studio — the performance tools now have their own screen: inline the styles the first screen needs, defer the rest of the JavaScript, add preload hints and read the Core Web Vitals suggestions in one place.
- Three new feature cards — Redirect Manager, Image Studio and Critical CSS Studio join the feature list on the website.
TOTP 2FA — Surfaced + Coverage Tracker in Security Center
Added
- Security Center → 2FA Status tab — lists all admin/editor/author users, their 2FA enabled state (ENABLED / NOT ENABLED pill), role, last-login timestamp. "Enable Now" button for the current user (jumps to Settings). For other users: instruction that they must enable from their own profile (TOTP is a personal credential)
- 5th KPI card: 2FA Coverage — percentage of admin/editor/author users with TOTP enabled. Color codes: green ≥80%, neutral 40-80%, red <40%. Sub-label shows raw count (e.g. "3 / 5 users")
- About TOTP card — documents the setup flow (Settings → Two-Factor Authentication → Initialize → scan QR → confirm), login flow, recovery path (DB-level unlock if authenticator is lost). Explicitly positions jekcms's TOTP as a replacement for WP 2FA + Wordfence Login Security (~$50/yr combined)
- features.php 11th card: TOTP 2FA — RFC 6238, Google Authenticator/Authy/1Password compatible
Security Center — WAF Dashboard + File Integrity Monitor, Built-In
Added
- Security Center admin page — a single tabbed dashboard for WAF/login attempts, security events, and file integrity. It surfaces protections that were already running silently — attack detection, the login-attempt log and the file integrity check — so you can watch attempts as they happen. Replaces Wordfence Premium ($119/yr)
- WAF tab — recent login attempts (last 30), top attackers by failed-login count (last 7d), blocked IPs table with manual block/unblock, one-click "Block this attacker" from the top-attackers list. KPIs at the top: failed logins (24h), unique IPs (7d), blocked count, FIM status
- Security Events tab — parses
logs/security.log— where blocked injection, cross-site scripting and path-traversal attempts are recorded — and shows a timeline with the address, the message and the context. The 30 most recent events are listed. - File Integrity tab — shows the install fingerprint, a verified-or-changed status pill, the last tamper report and a "Scan now" button that re-checks every core file. A short card tells you what to do if something has changed.
- Self-healing blocked_ips table — created automatically on first visit to the page. Idempotent: ON DUPLICATE KEY UPDATE preserves existing blocks. CSRF-protected admin operations throughout
- Sidebar link — new "Security Center" entry directly below Backups in the admin nav. Shield icon. Standard active-state highlighting
Smart Backup — Scheduled Daily Backups, Built-In
Added
- Smart Backup scheduled cron — turn on daily auto-backups in the admin (Backups → Smart Backup Schedule card). Pick the hour (default 03:00, low-traffic window). Cron runs
BackupManager::scheduledRun()which is idempotent (one backup per day, even if cron fires multiple times). Replaces UpdraftPlus Premium ($70/yr) - Retention policy — configurable 7-365 days. Auto-backups older than the cutoff are deleted automatically after the daily run. Manual backups are never auto-deleted. Storage stays bounded
- Pure-PHP backups — no
mysqldumpdependency (Hostinger and shared hosts often disable it). Streaming row-by-row dump handles large post tables without exhausting memory. Output is a single ZIP withdb.sql+uploads/+manifest.json - External sync hint — the schedule card documents the recommended
rclonepattern for syncing thebackups/folder to S3, Google Drive, or Dropbox. Native cloud SDK support is on the v2.6.x roadmap
Schema Studio — 13 Schema.org Types, Built-In
Added
- Schema Studio plugin family — 13 Schema.org types, all driven from the post editor with form-based UI. The full set: Article, BlogPosting, NewsArticle, TechArticle, ScholarlyArticle, Report, FAQPage, HowTo, Product, Event, Review, Course, Recipe (new), and LocalBusiness (new). Replaces Rank Math Pro's schema-builder module ($59/yr) — no subscription, no add-ons
- Recipe schema — food bloggers can now ship Google Rich Recipe cards: prep/cook/total time (ISO 8601), yield, category, cuisine, calories, ingredient list, step-by-step instructions, aggregate rating. Drives 30-40% CTR uplift on recipe-intent queries
- LocalBusiness schema — drives Google Maps + local-pack ranking. 18 business subtypes (Restaurant, Store, MedicalBusiness, Dentist, BeautySalon, TravelAgency, …). Full PostalAddress + GeoCoordinates + opening hours + price range + aggregate rating
- CSV-style data entry — ingredients, instructions and opening-hours all accept one item per line in a textarea. No fragile JavaScript arrays, no clicking +/- buttons; copy-paste works directly from your notes
- Schema preview + Google Rich Results Test link — the editor shows the live JSON-LD payload AND a one-click handoff to Google's validator. Zero guesswork
ZeroTrack Analytics — Privacy-First, Cookie-Free, Built-In
Added
- ZeroTrack Analytics plugin — a built-in, privacy-first replacement for Google Analytics, Plausible and Matomo. Zero cookies. Visitor data never leaves your server. KVKK/GDPR-compliant by design: IP addresses are SHA-256 hashed with a daily-rotated salt, making cross-day correlation mathematically impossible. Auto-activated on install
- Privacy dashboard in admin → ZeroTrack: page views, unique visitors, sessions, bounce rate, daily trend chart, top pages, referrers, countries, devices, UTM sources. Date range selector (today / 7d / 30d / 90d)
- Smart filtering out of the box — respects browsers' Do-Not-Track header; excludes logged-in admins; filters Googlebot, GPTBot, ClaudeBot, headless Chrome and 20+ other automation user-agents; configurable IP and path exclusions
- Reverse-proxy aware — picks up the real visitor IP behind Cloudflare and LiteSpeed (no double-counting your CDN). Country detection via Cloudflare CF-IPCountry header — no third-party GeoIP database needed
- Self-cleaning — raw pageview rows are deleted after a configurable retention window (default 90 days). Daily aggregates are kept forever for long-term trend analysis with tiny storage footprint
Sharper Homepage Hero — A Concrete Hook
Improved
- The hero now says what jekcms actually is — the vague "Smart Next-Gen CMS" line was replaced with a concrete, provable hook: everything you would normally add to WordPress (SEO, internal linking, AVIF media, bulk import, AI publishing) is already in the core, self-hosted, with no plugin stack to buy or maintain. One clear message instead of a buzzword
Go live today
Setup, content management, SEO and image optimization — all in one platform. Get started in 30 minutes.
View Pricing- Setup and live in 30 minutes
- 14 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO — Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)