Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 18 of 24 - 710 releases, newest first.
New Plugin: AdSense Readiness - a Full Site Audit Through a Reviewer's Eyes
Added
- AdSense Readiness plugin: one click scans your site the way an AdSense reviewer would - about 30 real measurements across five areas. Content: published post count against the 25+ target, average post length, thin posts under 300 words listed one by one, category structure (no empty or 3-post-starved categories), duplicate titles, publishing freshness, leftover "lorem ipsum" and still-installed sample content. Legal & trust: all four legal pages (privacy, cookie, terms, disclaimer - the built-in generator creates them in one click if missing), a real About page, a reachable contact channel and the cookie-consent banner. Authors: every active author checked for a real bio in the 3–5 sentence sweet spot (overlong "epic" bios are flagged too), job title, photo, and posts piled onto a single admin account. Technical: HTTPS, site name/tagline/logo, live homepage fetch (indexability, schema, og:site_name, single H1), sitemap.xml, robots.txt access for Googlebot and Mediapartners-Google, 404 behavior and Search Console verification. AdSense: snippet detection with an explicit double-loader warning, and ads.txt validation against your pub-id.
- Every finding shows the measured value - "18 posts (target: at least 25)", not a vague tip - and ships with a direct fix link into the right admin screen: legal page generator, user profiles, category manager, settings. A weighted 0–100 readiness score with an animated gauge, per-category progress bars and status filters (missing / warnings / passed) make the gap list actionable at a glance.
- The report is honest by design: an unscored "maturity" panel states clearly that technical hygiene is necessary but not sufficient - real traffic, site age and perceived content value drive the final decision - and documents the typical 2–14 day review window and the wait-before-reapplying rule. The plugin never promises approval; it removes every reason to be rejected on the measurable side.
Person Publisher Support, an SEO Signal Test Matrix for All Themes, and Single-H1 / Language Fixes
Added
- Publisher type setting: a personal site can now publish its structured-data publisher as a Person instead of an Organization. Pick "Person" under Settings → SEO and the WebSite node, article publisher references and the about-page reference all switch to a single Person identity - with the contact e-mail expressed the way a Person node expects it. Business sites are untouched: the default remains Organization, and nothing changes unless you opt in.
- An SEO signal regression matrix now guards every release. It activates all fourteen themes in sequence on a live test install and asserts, for each one: exactly one WebSite JSON-LD node; the site name - Turkish characters included - reproduced identically in WebSite.name, og:site_name and the page title; no auto-generated alternateName; the correct publisher type (both Organization and Person modes are exercised); exactly one visible H1; the right html lang; canonical equal to og:url; valid JSON-LD; and no character corruption. The harness ships in the repository and runs as part of the release gate.
Improved
- One positioning sentence, everywhere: jekcms is a self-hosted blog CMS with built-in SEO and image optimization, running on standard PHP + MySQL hosting. The vague "Next-Gen Smart CMS" phrasing is gone from the homepage, metadata, structured data and the admin login - and so are claims we can't prove: "24/7 support" now reads as support actually works (e-mail, response within 24–48 business hours), "Enterprise Security" now names the real controls (2FA, CSRF protection, rate limiting), and the theme count says exactly 14. The n8n integration is described in one place, as what it is: content arrives as drafts and publishes only after your editorial approval. A security.txt contact file is now published as well.
Fixed
- The minimalist theme's homepage rendered two H1 headings - the brand in the header and the featured post title. The featured post title is now an H2, so every page has exactly one visible H1 and the brand heading keeps carrying the site-name signal to Google.
- Seven themes read the site language through a helper that falls back to Turkish, while the other themes fell back to English - on a fresh install where no language row existed yet, the same site could declare html lang="tr" on one theme and lang="en" on another. All fourteen themes now read the same source, which follows the language chosen during installation.
- The crypto theme's error and maintenance pages hardcoded lang="tr" regardless of the site's language; they now follow the site language setting.
- The "Powered by jekcms" footer credit across all themes now carries rel="nofollow". It is a technology credit for readers, not an SEO signal - sitewide template links from one network shouldn't pass link authority, and search engines discount them anyway.
Theme Switching Verified End-to-End - About and Contact Now Work on Every Theme
Improved
- Theme switching itself was exercised the way a real user would do it: all fourteen themes were activated in sequence on a live test install - each activation running the theme's own migration hook - and after every switch, eight real pages (home, a post, a category, search, about, contact, a static page, and the 404 page) were fetched over HTTP and checked for errors. 112 page loads, zero failures. Per-theme customizations were also verified to survive a switch away and back, without leaking into the other theme's settings. The test harness ships in the repository so this can be re-run before any release.
Fixed
- Switching themes no longer breaks the About and Contact pages. Eleven themes ship without their own about template (and two without a contact template); on a site that hadn't created those pages yet, switching from a theme that had the template to one that didn't turned working footer links into 404s. The router now falls back to an honest built-in default rendered through the theme's page template - with the contact form auto-injected - and the moment you create a real "about" or "contact" page in the admin, your content takes over.
- Three themes (crypto, minimalist, health) ignored page content handed to them by the router and re-queried the database by slug, which broke the new built-in defaults and any router-provided page. They now use the provided content first, exactly like the other eleven themes.
AI Keys Encrypted at Rest Everywhere, and the Main CI Pipeline Now Runs Every Quality Gate
Security
- AI provider API keys are now stored encrypted everywhere. The multi-key Gemini list and the flat provider key fields (OpenAI, Groq, Cohere, Claude) are encrypted with authenticated AES-256-GCM before they touch the database, the settings form shows only a masked hint and never echoes a stored key, and every consumer - content tools, cron, connection tests - reads through the same decryption gate. A one-shot migration converts existing records automatically on the next cron pass, verified end-to-end on a real database.
- Signing out is a pure POST form now. The interim design carried the CSRF token in a GET link, which could land in access logs, browser history and prefetchers; the admin logout links are now styled POST forms, so the token never appears in a URL.
- A short mixed-version window could crash AI key reads: the migration check called a brand-new method without guarding against the older class still being loaded mid-deploy. All migration detection now runs behind a guarded helper and inside its own try block, with failures logged instead of swallowed.
Improved
- The main GitHub deployment pipeline now runs the same quality gates as a local release: the fresh-install acceptance test, the hardening regression suite, the schema linter and the i18n linter all execute on every push to main - a regression in any of them stops the deployment before it reaches production. The hardening suite itself grew to 37 checks, including real cryptographic behavior tests for the new key vault (plaintext never lands in the stored JSON, legacy entries migrate, masked hints never leak the full value).
- The fresh-install schema now includes the multi-key AI columns, which previously existed only in a secondary schema file - saving multiple Gemini keys on a brand-new install could fail with a database error.
Review Follow-up: Crypto Edge Case, Transparent Secret Migration, CSRF-Protected Logout, and Permanent Hardening Tests
Security
- Stored secrets now migrate to authenticated encryption on their own. When an AI provider key or a Google OAuth token stored in the legacy format is read successfully, it is transparently re-saved in the new integrity-checked format - long-lived secrets no longer wait for the user to re-enter them.
- Signing out is now CSRF-protected. A plain GET to the logout address could previously be triggered by an external page to force-end an admin session; logout now requires a valid token (admin links carry it - still one click) and shows a small confirmation page otherwise.
- The audit fixes are locked in by a permanent hardening test suite that runs on every release: encryption round-trips including the empty-value and tampering cases, route targets that must exist, fail-closed API role checks, the cron result contract, and error-message masking. A regression in any of these now blocks the release.
Fixed
- Decrypting an encrypted empty value works again. The new authenticated-encryption format rejected the shortest valid packet (a zero-byte ciphertext), breaking the encrypt/decrypt round-trip contract for empty strings.
- The schema linter's success message now reports the number of currently open findings instead of the raw baseline line count, which had kept showing already-resolved entries.
Audit Fixes: Reliable Cron Output, Working /login Route, and Authenticated Encryption
Security
- Stored secrets are now protected with authenticated encryption. Encrypted values (AI provider keys, Google OAuth tokens) are written as versioned AES-256-GCM with integrity checking; existing records keep decrypting and migrate transparently as they are re-saved.
- The API's write authorization is now fail-closed: a user record with an empty or unknown role gets no write capabilities.
- API error responses no longer echo raw exception details. Clients receive a fixed message with a correlation ID; the full detail goes only to the server log.
Fixed
- The cron runner no longer crashes when a run is already in progress. The lock branch returned a bare error string while the CLI reporter expected structured results, producing a fatal error on every overlapping run - and the shutdown path then tried to send an HTTP status from the command line, masking the original error. The result contract is now uniform, the reporter is defensive, and CLI errors go to stderr with a proper exit code.
- The public /login and /logout routes work again. They pointed at an auth/ directory that never shipped, so every hit returned a server error; they now redirect to the admin login and logout pages.
- The optional AI bulk worker no longer logs database errors on installations without its table: the web-side tick now checks for the table first, exactly like the cron side always did.
- Two more fresh-install schema gaps closed by the new acceptance test: scheduled task results and the social queue's completion timestamp now exist in the shipped schema, and failed tasks write to the correct error column.
Offline Documentation in Every Package, and Fresh-Install Schema Repairs
Added
- The installation package now ships the full documentation offline. All 37 guides are bundled as self-contained HTML in both English and Turkish under documentation/ - no external assets, readable without an internet connection. The admin panel's "How to use this" links open the local copy first and only fall back to jekcms.com when the folder is absent, so in-product help keeps working even if the vendor site is unreachable.
- One-click sample content. On an empty site, the Posts screen now offers to load six short, well-formatted starter articles across three categories - with generated cover images - so a fresh install shows what your theme really looks like. The samples double as a formatting guide (headings, lists, quotes, images) and are removed with a single click, covers and categories included, without touching anything you created yourself.
- Fresh-install acceptance testing joined the release pipeline. Every release now installs the shipped database schema into a clean MySQL and runs the product's critical write paths against it in strict mode - the class of bug where code writes a column the packaged schema doesn't know is caught before a package ever reaches a customer. The internationalization check runs in the same pipeline, so untranslated admin text can no longer slip into a release unnoticed.
Fixed
- Creating an API key on a fresh install works again. The admin screen stores API keys as a SHA-256 hash, but the shipped schema still described the old plaintext-token layout, so the very first "Create key" click on a new install failed with a database error. The schema now matches the code, and existing installations are repaired automatically on their next cron pass.
- Automation logging and the social share queue no longer lose data on strict-mode databases. The automation log rejected entries whose source was "system" or "admin" (values the code actually writes), and the social queue had nowhere to store the published-at time and the platform's post ID after a successful share. Both tables are aligned with the code and heal themselves on existing installations.
- The pricing page FAQ no longer claims online payments are "coming soon" while the checkout buttons on the same page are live - it now explains card payment, instant delivery, and the invoice/bank-transfer option honestly, in both languages.
Auto-Activated Plugins Now Create Their Tables, a Rate-Limited License Endpoint, and Gates That Are Honestly Green
Security
- License activation is rate limited (20 attempts per IP per hour), matching the limiter the heartbeat already had.
Fixed
- Auto-activated plugins now install their database tables on a fresh install. A plugin marked AutoActivate was switched on automatically, but its activate.php - which creates the tables - only ever ran when you toggled the plugin by hand in the admin. On a brand-new install Newsletter therefore appeared active while newsletter_campaigns, email_templates, newsletter_queue, newsletter_clicks and email_logs were never created, and the Campaigns screen died with a fatal error. Activation now runs once per plugin version, is idempotent, adds no query on the hot path, and repairs installations that are already in the broken state on their next request. If one plugin fails to install its schema, the site stays up and the attempt is retried.
- Author social links, the reader-facing editorial box and the similarity gate carry the fixes shipped since 2.41.0: social profiles were invisible on author archives in seven themes, and the similarity gate now uses roughly a quarter of the memory it used to on large sites (measured: 64MB → 16MB on a 2,000-post blog).
Editorial Transparency Readers Can See, Paraphrase-Aware Similarity, and a Test That Actually Runs
Added
- "How this content was made" box: the editorial fields you fill in (AI usage disclosure, original-contribution note, sources, YMYL flag) are now shown to readers under the post - in every theme, with no template edits. Sources also continue to be emitted as schema.org citations. The box appears only when you have filled the fields in, and it can be turned off in Settings.
- Editorial fields are now part of the REST API: every post response carries an "editorial" object (ai_disclosure, original_notes, sources, ymyl), so external editors, archives and n8n flows can read and act on them.
- Editorial checklist in the post editor: missing sources, missing original-contribution note or an undisclosed AI usage are listed as informational reminders. YMYL-flagged posts without sources or without a human approval are called out. Nothing here ever blocks publishing.
Improved
- Content-similarity protection now catches rewrites, not just copies. Three measures work together: verbatim overlap (5-gram), partial copy (containment - a copied section buried inside an otherwise original post), and term overlap (TF-IDF cosine - the same article rewritten with different sentences). Each has its own threshold in Settings. The comparison window grew from the last 120 posts to a configurable 500, and each post is compared over its first 12,000 characters (chunked, so a wider scope does not raise memory use).
- Honest naming: this is lexical near-duplicate and term-overlap protection, not embedding-based semantic analysis. It catches verbatim copies, near-duplicates, reordered sentences, embedded partial copies and same-term rewrites; it does not claim to catch two posts that target the same search intent with entirely different wording. The acceptance test fails the build if the product ever over-claims this.
Fixed
- The publishing-policy acceptance test now proves behaviour instead of matching text. It builds an isolated MySQL fixture and measures the real decisions on real SQL: publish/block outcomes, gate_state persistence, the absence of fabricated approvals, approval invalidation on edit, seven content-similarity scenarios (verbatim, near-duplicate, reordered, partial, paraphrase, false-positive control, and window depth) and the editorial-field consumers. It runs on every push in CI. Previously it could report success while a fatal error had occurred; a fatal now fails the build.
Editorial Transparency, Near-Duplicate Protection, and a Tighter CSP
Added
- Editorial Details panel in the post editor: declare the sources a post is based on (one URL per line - they are emitted as schema.org citations on the published page), record an original-contribution note, disclose AI usage (none / AI-assisted / AI-generated, human-reviewed), and flag YMYL content. Everything is optional, stored per post, and requires no theme changes.
- Content-similarity protection in the quality gate: in addition to the existing title checks, the gate now measures body-level overlap between a new post and the last 120 published posts. Content that overlaps above the threshold (default 80%, configurable in Settings) is blocked before publishing; noticeably-similar content produces a cannibalization warning. This closes the near-duplicate class that title checks alone cannot see.
- The publishing-policy acceptance test now runs automatically: it is wired into both the local release gate and the CI pipeline, so no future change can silently reopen a publish path around the quality gate.
Security
- Content-Security-Policy hardened: 'unsafe-eval' removed from script-src after a full inventory (no first-party or third-party script in use requires eval). 'unsafe-inline' remains by documented decision - themes use inline scripts and the Custom Header Scripts feature outputs user-pasted snippets that cannot carry nonces.
Publishing Policy: One Gate, Your Choice, an Honest Record
Added
- A single publishing policy now governs every path that can put a post live - the AI draft screen, the content queue, scheduled publishing, the REST API and n8n webhooks. Automatic publishing remains entirely your choice: if you turn it on, posts go live without review, exactly as you asked. What changed is that no path can quietly skip the quality gate while it is switched on, and every publication is recorded honestly.
- Publication audit trail: each post now records how it reached the reader - its source (manual, AI, JSON, n8n, API, queue) and its publication mode (draft, scheduled, automatic, reviewed). When a human editor approves a post, jekcms stores who approved it, when, and a fingerprint of the exact content they approved. Automatic publishing never fabricates a human approval - it is recorded as automatic, plainly.
- Approval invalidation: if an approved post is edited afterwards, the stored fingerprint no longer matches and the old approval is treated as void.
- Risk notices in the admin: the AI Draft, JSON Import and content automation screens now carry a permanent, non-blocking note explaining that generated or imported content can be inaccurate or low-value, that publishing without review can affect search visibility, and that the choice of draft, schedule or direct publish is yours. Turning auto-publish on, or turning the quality gate off, shows a visible warning next to the setting - never a modal, never a forced checkbox.
Fixed
- The AI draft screen wrote posts straight to the database and never consulted the quality gate, even when the gate was switched on. It now goes through the same publishing policy as every other path; if the gate holds a post back, it is saved as a draft and the reasons are shown.
Honest Freshness Signals, a Content Quality Gate for Automation, and Full-Document Revision Restore
Added
- Editorial date model: posts now track "last meaningful content change" separately from internal system touches. Schema.org dateModified, article:modified_time and sitemap lastmod are generated from the new signal - so bulk SEO passes, counters and cache refreshes no longer make hundreds of posts look "updated today" to search engines. When editing a published post you can also override the automatic detection: mark a save as a content update or a technical fix.
- Content Quality Gate: every automated publish path - content queue approval and publish (single and bulk), scheduled publishing, REST API and n8n webhooks - runs the same deterministic quality checks before anything goes live: minimum content length, duplicate and near-duplicate titles, and broken local image references block publication with visible reasons; missing featured image, internal links or headings raise warnings. The gate re-runs at the moment of publishing (so post-approval edits are re-checked), and fails closed: if the check itself errors, nothing is published. Thresholds are configurable in Settings.
- Full-document revisions: each revision now stores a complete snapshot - SEO meta, categories, tags, featured image, author, status and dates - and restoring one brings back the content, SEO, taxonomy, featured image and author. Publication status and dates are deliberately not restored, so restoring never unpublishes a live post or rewrites its history. The state before a restore is saved as its own revision, and the revision limit is now configurable (default raised from 10 to 50).
- Author Person schema now includes verifiable sameAs links built from the author's social profiles and website, alongside the job title, bio and photo added in the previous release.
Improved
- The REST API now returns explicit ISO 8601 editorial dates (content_modified_at, reviewed_at) on post endpoints and accepts content_modified_at on writes, so migrations and rewrites can preserve original dates.
Fixed
- Schema dateModified and sitemap lastmod could report a date earlier than the publish date on scheduled posts; both are now clamped so a modification date never precedes publication.
- The sample admin account seeded by a manual database import now ships with an unusable password hash, and the installer sets real credentials as before.
Legal Pages Repaired and Expanded, Author Archives Fixed, Tag Indexing Made Consistent
Improved
- The default Cookie Policy was rewritten to be genuinely comprehensive in both languages: cookie categories with purposes, legal bases and durations in a table, first/third-party and session/persistent distinctions, named third parties with opt-out links, consent management and withdrawal, browser instructions, Do Not Track / Global Privacy Control, and a legal-basis section (KVKK on Turkish sites, GDPR/ePrivacy on English ones).
Fixed
- The built-in legal page templates shipped with corrupted text in all 13 themes - Turkish characters and arrow symbols rendered as garbage ("→", "Çerez") on fresh installs that had not saved their own legal pages. The templates were re-encoded and every character now renders correctly in both languages.
- Opening an author archive on the Personal theme returned a server error: a routing variable leaked into the template and shadowed the real author record. Author pages now render on every theme, and a non-existent author correctly returns 404.
- Tag archives could be indexed by search engines even while tag archives were disabled in SEO settings - the sitemap respected the setting but the page-level robots meta did not. With tag archives off (the default), every tag page is now noindex.
- On the Finance theme, the author box at the end of a post showed the author's name as plain text; it now links to the author's archive page, and the Pets theme's archive pages now emit a proper page title and meta description instead of just the site name.
Personal Theme: Full-Width Brand Logo with Automatic Light/Dark Switching
Added
- The Personal theme now supports a full-width brand logo in the header: upload your logo (and an optional dark variant) under Settings → Branding and it replaces the icon + site-name pair, switching automatically with the visitor's light/dark preference. The site name stays in the markup as a visually-hidden heading, so the Google site-name signal is preserved. Nothing changes for sites without an uploaded logo.
Stories, the Instagram Way: One "Latest Posts" Bubble That Plays Your Recent Content
Improved
- Automatic post stories were redesigned around how Instagram actually works: instead of one bubble per post crowding the strip, there is now a SINGLE "Latest Posts" bubble - tap it and the posts from your chosen window (3, 7, 15, 30 days… up to 90) play as slides, newest first, each with its featured image, title and a "Read Post" button. The bubble is fully virtual: nothing is written to the stories database, new posts appear in it the moment they are published, old ones drop off as they leave the window, and the ring lights up again whenever a new post arrives.
- The bubble's name follows the site language ("Son İçerikler" / "Latest Posts") and can be customized in settings. Bubbles you created by hand are untouched and keep their place next to it; the per-post bubbles generated by the previous version are cleaned up automatically.
Fixed
- Opening the Stories admin page by its direct URL (without a module parameter) returned a server error - a strict-mode array access crashed before the page could render. The page now opens correctly from anywhere.
Stories Strip Becomes a True Latest-Posts Showcase
Improved
- With auto-stories enabled, the strip now carries EVERY post published within the story lifetime window (7 days by default) - not just posts published after the feature was switched on. Older posts are backfilled automatically every hour, each story retires based on its post's publish date, and the newest post always sits first in the strip, Instagram-style.
- The strip now announces itself: when auto-stories are on and no custom heading is set, a heading in the site's language appears above the circles - "Son İçerikler" on Turkish sites, "Latest Posts" on English ones. Set your own heading to override it, or enter "-" to hide it entirely.
Image Captions Done Right: Visible Captions Are Now a First-Class Editor Feature
Added
- New "Caption" field in the image details dialog: add a visible caption under any image, shown identically on every theme via self-contained styling. The dialog now clearly separates the two concepts - alt text is invisible and for search engines and screen readers; the caption is the text readers actually see. Captions render live in the editor and are editable with one click.
Fixed
- Editing a post that contained figure-wrapped images could leak the old caption markup as a visible plain paragraph under the image - the editor did not understand the figure/figcaption structure, so saving unwrapped it and turned caption text into body text. The editor now parses figures natively: real captions survive editing round-trips intact, and legacy captions that merely duplicated the alt text are dropped automatically instead of becoming visible.
- Opening the image details dialog could scroll the page behind it, so you lost sight of which image you were editing. The background now stays exactly where it was while the dialog is open and after saving.
Click, Resize, Align: Full Image Editing Inside the Editor
Added
- Images in the post editor are now fully editable in place, the way WordPress users expect. Click an image and a floating toolbar appears right on it: size presets (Small 300px / Medium 600px / Full width), left-center-right alignment, a details button and remove - plus four corner handles you can drag to resize freely, with a live pixel readout while you drag. Aspect ratio is always preserved.
- New image details dialog (toolbar pencil or double-click the image): see and edit the alt text, title tooltip, exact pixel width and the image URL in one place, with a live preview. Alt text finally gets a proper editing home after insertion - good for accessibility and image SEO.
- Sizing and alignment are written into the content as self-contained inline styles, so they render identically on every theme - no theme CSS support required, and images never overflow on mobile (max-width is built in).
Fixed
- The alt text label in the image insert dialog was hardcoded in Turkish and appeared untranslated on English admin panels.
Posts List: One-Click SEO Score Refresh, Editor and List Finally Agree
Added
- New "Recalculate SEO Scores" button on the posts list: refreshes every post's stored SEO score with the current scoring engine - in batches of 100 with live progress, so a 1,000-post site takes seconds instead of hitting a timeout. Useful after upgrading, since scores saved by older versions used the old scoring rules.
Fixed
- The score in the editor and the score in the posts list could differ: the editor's live analyzer inspects the actual page structure (headings, tables, snippet blocks) while the save-time engine cannot, so recomputing on save produced a different number. The editor now passes its own score along when you save - the list shows exactly what the editor dial showed.
- The "Analyze All" AI button appeared on every installation, including ones with no AI provider configured, where clicking it could only show a setup notice. The button now appears only when AI is actually configured.
SEO Score You Can Trust: Fixed Budgets, No More Reward for Leaving Fields Empty
Improved
- Each check group in the SEO widget now shows its point contribution (e.g. "20/25p" next to Keyword) so you can see exactly where a score comes from and which section is worth fixing first.
Fixed
- A post with NO focus keyword could score 80-90, and the score DROPPED the moment you entered one - the old ratio model removed the keyword checks from the denominator when the field was empty, so withholding information was mathematically rewarded. Scoring now uses fixed category budgets (keyword 25, content 20, structure 15, basics 15, readability 10, visuals 10, schema 5): an empty keyword field burns its whole 25-point budget, and filling in information can only raise your score, never lower it. The same flaw existed in the score saved on every post update (an even stronger version: keyword-less posts were graded out of 50 and could reach 100) - post saves now use the same fixed-budget engine as the SEO Optimizer page, so all scores finally speak the same language.
- Turkish keywords containing İ/I (e.g. "İçerik Pazarlaması") silently failed every match - title, content and density checks all reported "keyword not found" because of a Unicode case-folding quirk. Keyword matching is now Turkish-aware across the editor widget, the save-time score and the SEO Optimizer. Density also counts whole words only (a short keyword inside longer words no longer inflates the percentage) and word counting is UTF-8 correct.
- The title length check said "good" up to 70 characters while the SERP preview's pixel meter showed the same title being cut at ~580px - the two now agree (60-character budget), and a keyword missing from the title is no longer punished twice.
SEO Assistant: Content Structure Checks, Pixel-Accurate SERP Preview, Wider AI Analysis
Added
- New "Content Structure" check group in the editor's SEO assistant - seven checks that mirror how editors actually review a draft: duplicate H1 in the body (your title is already the page H1), skipped heading levels (H2→H4), a too-thin intro before the first heading, a missing conclusion/summary section on long posts, table and list usage, and a featured-snippet readiness check that looks for a question heading followed by a concise 40–60 word answer.
- The SERP preview now measures your title and description in pixels, the way Google actually truncates them (~580px for titles, ~990px for descriptions on desktop). Character counts stay, pixel widths appear next to them and turn red when the limit is exceeded - no more titles that pass the character check but still get cut in results.
- AI deep analysis covers four new dimensions: overall content quality (informativeness, originality, freshness), Google Helpful Content fit, AI-search readiness (would an AI Overview cite this page?), and AdSense policy suitability - including thin-content and clickbait-mismatch warnings before you publish.
Fixed
- The SERP preview showed a broken icon instead of your favicon: it pointed at a file path that only exists on jekcms.com, not on customer installations. The preview now resolves the site's real favicon through the same priority chain the front end uses (uploaded favicon, site-root favicon files, generated icon), with a letter-badge fallback so the slot is never empty.
Google Console: PageSpeed Tab, Fresh Search Data, Stability Fixes
Added
- New PageSpeed tab: measure any page of your site with Google PageSpeed Insights (Lighthouse) right from the panel - mobile and desktop scores for Performance, Accessibility, Best Practices and SEO, lab metrics (FCP, LCP, TBT, CLS, Speed Index) and real-user Core Web Vitals (CrUX) when Google has field data for your site. Works without a Google connection; results are cached for 24 hours. An optional API key setting raises the measurement quota.
Fixed
- Search Console reports were consistently thinner than the GSC interface: the API omits the last ~2 days by default ("final" data), so recent queries and clicks simply never appeared - the exact "my search terms don't show up" complaint. All Search Console reports now request fresh data, matching what the GSC UI shows.
- The Top Queries and Top Pages cards swallowed API errors and displayed a misleading "No data" - a quota or permission problem now shows its actual, actionable message on the card itself (same for the Analytics tables).
- When Google was unreachable, every page load fired the full set of live API calls with 20-second timeouts each, freezing the panel; failed responses are now briefly cached so the page stays responsive, and the Refresh button retries immediately. The response cache table also cleans up its expired rows, which previously accumulated forever.
ZeroTrack Analytics: Data Collection Restored on Production Sites
Fixed
- ZeroTrack silently stopped recording visits on production installations: the standalone beacon endpoint read database credentials only from .env, but production installs keep the real credentials in .env-production (the installer writes them there). The endpoint could never connect, answered every beacon with a polite 204, and the dashboard showed zeros while the site had traffic. The endpoint now uses the same environment-file priority as the rest of the CMS (.env-production first), and a failed database connection is written to the error log instead of disappearing without a trace.
- Page views could be counted twice: both the plugin hook and the core footer injected the tracker script, and the plugin side ignored the once-per-page guard. The guard is now honored on both paths - one tracker, one beacon, one count per view.
SEO Analyzer: Turkish-Correct Matching, Keyword Cannibalization Warning, New Checks
Added
- Keyword cannibalization warning: as you type a focus keyword, the analyzer checks whether another post already targets it and names that post - the classic premium-plugin feature, built in.
- Three new checks: a warning when the meta description merely copies the title, a nudge when no image alt text contains the focus keyword, and a heads-up for slugs containing Turkish/special characters.
Fixed
- Turkish focus keywords were silently failing: JavaScript lowercases dotted İ into a combining character, so a title like "İçerik Rehberi" never matched the focus keyword "içerik" - the analyzer wrongly reported the keyword missing from the title, description, headings, and first paragraph. A Turkish-aware folder now backs every comparison, and the slug check ascii-folds the keyword ("beslenme önerileri" correctly matches "beslenme-onerileri").
- Keyword density counted substrings ("spor" also counted "sporcu"); it now counts whole words. Internal/external link detection resolves the real hostname instead of matching the site name anywhere in the URL. The analyzer also stopped re-rendering every 2.5 seconds, which used to force categories you had collapsed back open.
- On installations without the AI settings table, the editor died mid-page with "Server Error" while rendering the AI tab; the check is now failure-safe and the editor always loads.
- The social preview card showed a broken image for uploads-relative featured paths; description length limits were aligned to 160 everywhere.
Health Theme Speaks Your Site Language on the Frontend
Fixed
- On Turkish sites the Health theme still printed dozens of hardcoded English strings - section titles (Most Popular, Trending Topics, Latest Articles, Recommended), the entire footer navigation (About, Categories, For You, Editorial, Connect and every link inside them), the author card (About Author, View All Articles), the comment form (Leave a comment, Name, Email, Post comment), search, 404, tags, and the fallback header menu (Home, About). All of them now follow the site language setting: Turkish sites read fully Turkish, English sites are unchanged.
Health and Travel Headers No Longer Leak Broken Markup
Fixed
- On the Health and Travel homepages the brand link's H1 was printed inside the aria-label attribute, breaking the attribute and leaking a literal « - home"> » text next to the logo (most visible on fresh installs without a logo). The H1 now renders inside the link body where it belongs; the accessibility label and the SEO site-name signal both work as intended.
Wizard Polish: Come Back Days Later, Nothing Is Lost
Improved
- Take the prompt, close the browser, come back next week with the AI's JSON: the wizard now remembers every choice, greets you with a "Jump to import" shortcut, and the step chips are clickable so you can move to any step directly - no more starting over.
- The Content Studio menu is now one flat list in a clear order (Overview, Content Wizard, AI Content, Automation, Content Queue) - the confusing "Advanced" sub-group is gone - and it stays visible inside the Content Queue and Automation pages too, so sub-pages no longer feel like leaving the studio.
- The Pinterest and external-link option cards were realigned (checkbox beside the title instead of floating above it) and light up when selected.
Fixed
- The sample JSON no longer carries a fixed example date in scheduled_at - some AIs copied that stale date into every article. Scheduling belongs to the wizard's own final step.
- The old JSON generator form inside the import tab was removed (the wizard replaced it); the tab now cleanly hosts the raw import tools (JSON file, Google Sheets, CSV) with a pointer to the wizard.
Content Wizard: Plan, Create, and Schedule in One Guided Flow
Added
- The new Content Wizard (Content Studio → Content Wizard) replaces the old maze of JSON wizard, batch planner, and import tab with one step-by-step experience: how many articles → topic and keywords → richness (word count, images, Pinterest, authority links) → who creates it → schedule. Your theme profile is auto-detected, so recipe, travel, and finance themes automatically request their special fields.
- Two creation paths, same quality contract: use your own ChatGPT/Claude/Gemini account for free (copy one prompt, drop the returned JSON back - the wizard imports and validates it), or let jekcms generate everything through your API key, article by article with a live progress bar. Both land in the same review queue.
- The final step schedules the whole batch on a rhythm (daily, every 2-3 days, weekly) with a randomized time window, and explains the image workflow plainly: every article ships with a ready image plan (per-image generation prompts); generate covers automatically via the AI Images plugin, or create them anywhere, name them by slug, upload to uploads/temp and press Match Images.
Improved
- Content Studio's inner menu was decluttered (Posts and New Post moved back to the main sidebar where they belong) and it now stays visible on every studio sub-page, so you never lose your bearings. The n8n automation planner and raw queue live under a clearly labeled "Advanced" section.
- The single-draft AI tool now shares one AI client with the wizard (Gemini, Groq, and OpenAI - OpenAI upgraded to gpt-4o-mini).
The Finance Footer Shows Your Logo Instead of Plain Text
Fixed
- The Finance theme footer always printed the site name as plain text and never used the logo you uploaded. It now shows the logo, preferring the dark-mode variant because the footer background is dark in both themes. Sites without a logo keep the text heading exactly as before.
A Newly Uploaded Logo Now Appears Immediately
Fixed
- Replacing your logo from Settings → Branding could leave visitors looking at the old one for a long time. Uploads are served with a one-year "immutable" cache header, so once a browser or CDN had the file at that address it never asked again - and a CDN could keep serving a stale copy even after the file on the server changed. Logo URLs now carry the file's modification time, so a new upload is a new address and every visitor sees it on the next page load.
Get your site live
The setup wizard gets a site live in about 30 minutes. See the prices and the free edition.
View Pricing- Setup and live in 30 minutes
- 15 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO - Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)