Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 20 of 24 - 710 releases, newest first.
International Payments via Polar, Instant License Delivery, and an Account Security Overhaul
Added
- International card payments via Polar (Merchant of Record). Every paid Polar order automatically creates the customer account, issues the license key, generates the invoice and emails the key - no manual steps. Deliveries are idempotent, webhook signatures are verified, and the checkout thank-you page shows the license key the moment it is ready.
- Email verification for customer accounts. New registrations receive a verification link (sign-in is never blocked); changing your email re-requires verification of the new address and notifies the old one. A new resend-verification page replaces links that previously led nowhere.
- Account deletion (GDPR/KVKK). Customers can permanently anonymize their account from the Security page with password confirmation; order and invoice records are retained as required by law.
- Real login history. The Security page now shows actual sign-in attempts (date, IP, outcome) - the old list was wired to a table nothing ever wrote to.
Improved
- Brute-force protection is now database-backed. The old limiter counted attempts inside the visitor's own session, so clearing cookies reset it; limits are now enforced per email and per IP across sessions, and every attempt is audit-logged.
- Changing your password now confirms it by email and refreshes the session; the non-functional "Remember me" checkbox was removed (sessions already persist for 30 days).
Fixed
- The email verification page queried columns that never existed in production, so verification links could not work; it now uses the real schema.
- Viewing a support ticket linked to an order could fail due to a query against a non-existent table.
- Site-validation bots of payment providers were blocked by an over-broad user-agent filter, which made provider onboarding fail with "could not reach this URL".
Sign-In Flow Streamlined: Session-Aware Header and Google-Only Social Login
Improved
- The site header now recognizes signed-in customers. After signing in or registering, the "Sign In / Get Started" buttons are replaced with "Dashboard" and "Sign Out" - on desktop and in the mobile menu.
- Signing in no longer pulls you away from the page. Logging in or registering from the site keeps you where you were instead of forcing a redirect to the customer dashboard; Google sign-in returns you to the page you started from.
- Your language choice follows you into the customer portal. Browsing the site in English opens the dashboard in English after sign-in; browsing in Turkish opens it in Turkish.
- Social sign-in is now Google only. The rarely used GitHub, Facebook and Microsoft sign-in options were removed from the sign-in modal, the portal pages and the admin settings.
- Signing out now returns you to the homepage instead of the login screen.
Fixed
- Google sign-in errors are now shown. The login page listened for the wrong URL parameter, so OAuth errors (cancelled sign-in, misconfiguration, inactive account) were silently swallowed; all error codes now surface with bilingual messages.
- The registration modal accepted submissions without the Terms of Service checkbox being ticked; acceptance is now enforced.
- Sign-in and registration API calls resolved to the wrong path on subfolder installations; they now respect the site base path.
- Password reset now works on installations missing its table. The password_resets table only existed in a development migration; when absent, the forgot-password form crashed. The table now self-heals on first use, and a mail delivery failure no longer breaks the flow.
- Login error messages mixed English and Turkish regardless of the chosen portal language; they now follow it.
Content Tables Are Now Styled in the Personal Theme
Fixed
- Tables inside articles now have proper borders, a header row and spacing. The Personal theme had no table styling, so tables rendered as plain unbordered columns that were hard to read. They now have cell borders, a shaded header row, comfortable padding, zebra striping and horizontal scrolling on small screens.
Schema Gaps Closed for Voting, AI SEO Analysis and IP Blocking
Fixed
- Article voting now works. The up/down vote feature (used by the crypto theme) wrote to a post_votes table and a posts.votes column that the schema never created - and an old migration even defined the table with mismatched column names. The table and column are now part of the schema, self-heal on existing sites, and the stale migration was corrected.
- AI SEO analysis is now saved. The editor's AI analysis wrote to seo_meta columns (ai_score, ai_analysis, ai_analyzed_at) that did not exist, so results were never persisted. The columns were added to the schema and self-heal on existing sites.
- The IP block list has a proper schema table. Previously it only existed when an admin happened to open the Security Center; it is now part of the core schema and self-heals.
Schema Consistency: Silent Database Errors Fixed + Drift Guard
Improved
- A schema drift guard now runs in the release pipeline. A new tool cross-checks every table/column written by the code against the schema and plugin definitions; any newly introduced mismatch fails the release, preventing this class of fresh-install error from recurring.
Fixed
- Comment replies and API comment creation now save reliably. Both wrote to a column name (ip_address) that did not exist on the comments table (the correct column is author_ip), so these paths failed on every install. They now use the correct column.
- Automatic IP blocking now actually blocks. The security module wrote a non-existent blocked_at column, so blocks were silently dropped; it now uses the correct column.
- Theme switching and settings saves are safe on fresh installs. The settings table gained created_at/updated_at columns (added to the schema and self-healed on existing sites) - code wrote these timestamps but the fresh-install schema lacked them.
- ZeroTrack registers correctly on activation. Its plugin record used the wrong column names (active/core instead of is_active/is_core).
Log and Data Hygiene: A Self-Limiting CMS
Improved
- Automatic maintenance now covers every accumulating store. Raw view records (180 days), auto-link logs, SEO ping logs and expired Google Console cache entries are pruned on the existing maintenance schedule, and oversized log files (including php-errors.log) are rotated centrally with 30-day cleanup of old rotations.
Fixed
- The database error log can no longer grow without bound. It now rotates at 5 MB with a single backup kept, matching the application log. A recurring cron error had been able to grow this file indefinitely.
- Two chronic error sources were silenced at the root. The webhook queue self-heals missing api_tokens columns on older installs (and the webhook feature starts working), and the AI bulk worker skips quietly when its table is not installed - both had been writing an error entry every minute.
ZeroTrack: Interactive Trend Chart and Full Localization
Improved
- The trend chart was redesigned from scratch. The bare line chart is now an interactive bar chart: hovering highlights the bar and its neighbors, shows a tooltip with views and unique visitors, and updates the live value in the header. Days with no data render as zero instead of being skipped, and the "Today" range now shows an hourly breakdown.
- KPI cards now compare against the previous period. Page views, unique visitors and sessions show a rise/fall percentage next to the label.
- The whole plugin follows the admin design system and language. Every label on the dashboard and settings pages is fully localized (Turkish admin shows Turkish everywhere), and hard-coded light-theme colors were replaced with design tokens so dark mode renders correctly. Top pages gained proportional usage bars.
Google Console: Consistent Reports and a Permanent-Connection Guide
Improved
- Search Console and Analytics now report the same date window. GA4 requests previously ended "today" while Search Console ended yesterday, so overview KPIs compared different periods. Both now use the identical range, making trends directly comparable.
- Keyword and page tables show up to 50 rows (previously 20), and indexing-coverage scans now cover up to 2,000 URLs (previously 500) in line with Google's URL Inspection daily quota.
- Reconnect banner now explains the most common cause. When Google drops the connection with invalid_grant - typically because the OAuth app was left in "Testing" mode, which expires grants after 7 days - the panel says so and walks through publishing the app to production for a permanent connection. The setup guide covers this too.
- Search Console site addresses are normalized on save. Entering a bare domain becomes a proper domain property (sc-domain:), and URL-prefix properties get their required trailing slash - malformed values used to fail silently with empty reports.
Newsletter Result Pages Work on Every Theme, in Both Languages
Fixed
- Newsletter subscribe/confirm/unsubscribe pages no longer crash on non-Personal themes. These pages called a Personal-theme helper directly, which caused a server error on any other active theme. They now use a theme-safe helper and render their texts in the site language (Turkish or English) instead of hard-coded Turkish.
Visible Spam Protection, Reliable Newsletter Signup, Consistent Plugin Naming
Improved
- The built-in spam filter is now visible and explainable. The Comments screen links directly to Spam Protection settings, flagged comments show their spam score with the reasons that triggered it, and the spam tab offers a one-click "Not Spam" action. The filter itself (link limits, keyword/IP/e-mail blacklists, submit-speed and repeat-offender checks) was already scoring every comment behind the scenes.
- Plugin names and ordering are consistent everywhere. The sidebar now uses the same localized plugin names as the Plugins screen, and both lists are sorted alphabetically by the displayed name.
- Theme customizer is fully localized. Tab and theme descriptions now appear in Turkish on Turkish admin panels, and the page title follows the admin language.
Fixed
- Newsletter signup now works from every theme. Several themes posted their subscribe forms to endpoints that did not exist (/newsletter, /api/v1/newsletter/subscribe), so signups silently failed. Both endpoints now reach the newsletter plugin, and the API works in sub-directory installs too.
- Fresh installs no longer break on comments or subscribers. The installer schema was missing the spam-score columns on comments and the subscribed_at column on newsletter subscribers; both are now in the schema and self-heal on existing sites.
- New-post notification e-mails render correctly. The notification campaign stored post data as raw JSON that would have been printed into the e-mail; the sender now resolves it into the template placeholders.
- Crypto theme footer now obeys the customizer. The "Brand blurb" field is actually rendered, the social-icons toggle works, the site name is no longer hard-coded, and the footer subscribe form posts to the correct endpoint.
Instant Admin Asset Updates, Dropdown Clipping Fix
Fixed
- Admin CSS/JS updates now reach the browser immediately. Stylesheet and script URLs are versioned by file modification time instead of the CMS version number, so hotfixes no longer require a hard refresh or a version bump to become visible.
- Custom dropdown panels are no longer clipped by their card. When a select panel (such as the Author picker in the post editor) is open, its containing card temporarily allows overflow so the full option list is visible.
Author Picker on the Post Editor, Sentence-Aware Excerpts
Added
- Posts can now be assigned to a different author from the editor. A new Author dropdown in the Publish box lists the site's writers; the change is saved with the post. Autosave and quick-edit paths are unaffected.
Fixed
- Auto-generated excerpts no longer cut off mid-phrase. The generator now prefers the last full sentence within the window, ignores version-number dots (like "GPT-3.5"), is UTF-8 safe for Turkish characters, and inserts spaces where block tags met. Existing truncated excerpts across all sites were regenerated from content.
Pro Theme Customizer: Font Previews, Import/Export, Turkish UI, Deeper Options
Added
- Theme settings can now be exported and imported as JSON - move a finished design to another install in one click, with schema-validated import, cross-theme confirmation and a one-click "Reset to defaults" that preserves footer-builder data.
- Font pickers became real font pickers. A central 38-family library backs every font field (empty dropdowns are gone), the current font sits selected at the top, every option renders in its own typeface, and a live preview line updates as you browse.
- Deeper per-theme options, all wired to real output: the Personal theme gained homepage controls (hero slide count, popular section and count, categories toggle, posts-per-page for the latest grid) and a Post Page tab (sidebar, author card, related posts and count, comments) - every switch verified to change the rendered page.
Improved
- The customizer speaks Turkish now. Over a hundred remaining English field and tab labels across all theme schemas were translated for Turkish admin sessions.
Fresh-Install Audit: Theme Switching, Customizer and Setup Hardened End-to-End
Fixed
- A full customer-journey audit (installer → theme switching → customizer → import) fixed nine fresh-install bugs. Subdirectory installs no longer hit an infinite redirect on About/legal pages; single-post pages now receive author data, so the News theme no longer crashes; the Tech theme's missing helper, the Finance theme's missing comments partial, and Health theme null-image crashes are all resolved.
- Search works on every host now. Reusing one SQL placeholder twice broke search with an SQL error on servers where PDO prepares are not emulated - fixed in the core query builder, the Health theme and the quiz plugin.
- Saving the Theme Customizer no longer wipes other settings. It used to replace the theme's whole customization record, silently deleting footer-builder data; it now updates only its own fields. The footer builder likewise activates only on themes that render it, instead of corrupting other themes' footer settings.
- Setup polish: application logging now creates its log directory on first use (it was silently dead on fresh installs), broken absolute-path ErrorDocument rules were removed, and session ini warnings on first requests are gone.
Media Library: Click-to-Edit Restored, Smarter Alt Text Editing
Improved
- Alt text editing got a live character counter and guidance (ideal ≤125 characters) so image SEO fields are filled properly, not just filled.
Fixed
- Clicking an image in the media library opens its detail/edit screen again. The lightbox was capturing every click on image cards, so the screen where alt text, caption and description are edited had become unreachable. Zooming now has its own magnifier button on the card (and clicking the preview on the detail page).
Ad Placements Standardised Across All Themes, Honest Slot Panel
Improved
- Every theme now renders the standard ad placement set. An audit found the personal and trends themes rendered no ad slots at all, health and recipes only one or two - ad code pasted in the admin simply never appeared. All themes now support: below navigation, above/inside/below the article, between archive cards and above the footer.
- The ad manager now tells the truth per slot. Each slot card shows whether the active theme actually renders it ("In theme" / "Not in theme" badge), and the four legacy slots that no current theme uses are hidden unless they hold saved code.
Hotfix: Footer Customizer Save No Longer Rejected
Fixed
- The real root cause of the footer customizer's "CSRF token mismatch" was a field-name mismatch, now fixed at the core. The form emits its token as
_tokenwhile the handler readcsrf_tokenand passed an empty string, which blocked the fallback lookup - so every save was rejected even in a fresh session. The validator now treats an empty token as "not provided" and falls back to all accepted field names; invalid tokens are still rejected.
Footer Customizer Redesign, Newsletter Styling, Session-Lifetime CSRF
Improved
- The footer customizer got a visual overhaul. Templates are now picked from illustrated layout thumbnails instead of a text list, sections follow a consistent card design, and a sticky save bar keeps the action always in reach.
- The footer newsletter block is now fully configurable. Besides the title and intro, you can set the input placeholder, the button text and a display style - plain, boxed card or accent-tinted card - with matching styles for dark footers and mobile.
Fixed
- "CSRF token mismatch" on save is gone. Security tokens used to hard-expire after one hour, so any admin form left open longer - the footer customizer, a long post edit - died on submit. Tokens are now valid for the whole login session, per the standard per-session pattern.
One-Click Edit for Every Legal Page
Improved
- Every row in the legal page status table now has an Edit button. For pages still served from the theme's built-in template, clicking Edit creates the page from the ready-made text using your site settings and opens the editor immediately - no detour through the generator form. The explanatory text on the screen was also rewritten in plain language.
Pages Hub With Inner Navigation, Legal Pages Finally Editable at a Glance
Improved
- The Pages screen is now a proper hub with an inner sidebar - the same pattern as Settings. Modules are grouped under headings: Pages (all pages, new page) and Legal Pages (status & edit, generator). The old single-scroll screen that mixed the generator, a status table and a legacy record list into one confusing page is gone.
- Every legal page now has a clear path to editing. Pages backed by a CMS record show an Edit button; pages currently served from the theme's built-in template are labelled "theme default" and offer a one-click Create action that jumps to the generator with that page preselected.
Fixed
- Hover row actions (Edit | View | Trash) in content lists are left-aligned under the title again. A shared action-cell style had pushed them to the right edge of the title column in posts, categories, tags and quiz lists.
- The legacy legal-records block was removed from the CMS admin. It edited a marketing-site table that has no effect on a CMS site's public pages, which made the screen genuinely misleading.
Category Slug Renames Get Automatic 301s, 404 Logging Heals Itself
Added
- Renaming a category slug now creates a 301 redirect automatically - in both the admin panel and the REST API. Combined with v2.18.8's post-slug redirects, no rename anywhere in jekcms can silently orphan an indexed URL anymore.
Fixed
- 404 logging works on every install now. The not-found log table was only created when an admin first opened the Redirects page; on sites where that never happened, every 404 was silently discarded and the "suggest redirect" list stayed empty forever. The logger now creates its own table on first use.
Automatic 301 on Slug Change, Legacy URL Guard, Cleaner Crawl Budget
Added
- Renaming a published post now creates a 301 redirect automatically. Previously every slug change silently left the old URL as a 404 in Google until someone noticed and added a manual redirect - a across every installation Search Console audit found exactly this pattern in the wild. The redirect is created on save, existing chains pointing at the old slug are re-pointed at the new one, and duplicate sources are never inserted.
- Built-in guard for legacy WordPress URL families. Retired Turkish tag archives (/etiket/…) now return 410 instead of soft-404 redirects, taxonomy AMP leftovers (/author/…/amp, bare /amp, /amp/page/N) redirect in a single hop, so migrated sites stop accumulating Search Console errors.
Improved
- Crawlers no longer waste budget on write-only endpoints. robots.txt now disallows the analytics beacon (/zt-track) and webhook paths, which previously showed up as "other 4xx" noise in Search Console.
Search Console Cleanup: Retired Tag URLs Are Now Crawlable (410)
Fixed
- Retired /tag/ URLs can now leave Google's index. robots.txt disallowed /tag/ while the pages correctly returned 410 Gone - but a crawler that is blocked can never see the 410, so hundreds of dead tag URLs stayed frozen in Search Console error reports indefinitely. The disallow is removed; Google can now crawl the 410 responses and drop the URLs for good.
Comprehensive Legal Pages, Unified Footer Credit, Author Card Fix
Improved
- Legal pages are now comprehensive and professional out of the box. The default Privacy Policy, Terms of Service, Cookie Policy and Disclaimer texts were rewritten editorially in both languages: data categories, legal bases, retention periods, Google AdSense/analytics disclosures with opt-out links, a cookie category table, permitted-use and liability sections. Sites that publish their own legal pages are unaffected - defaults apply only when no custom page exists.
- One footer credit everywhere. The footer bottom bar now reads "Powered by jekcms" in every language - the former Turkish translation of the credit was dropped in favor of a single brand-standard phrase.
Fixed
- Legal pages are readable on dark-bodied themes. The universal legal template had no background of its own, so themes with a dark page body rendered near-invisible headings on a dark surface. The template now pins an explicit light panel with fixed text colors, plus proper list and table styling.
- Author card uses its full width. The author bio in the crypto theme was capped at 480px, wrapping sentences into a cramped column next to the avatar; the cap is removed.
Crypto Theme: Legacy TOC Cleaner No Longer Swallows Article Bodies
Fixed
- Articles no longer render truncated. A legacy WordPress-import cleaner in the single template removed inline tables of contents with overly broad patterns: any H2 merely containing the word "içerik" - e.g. "AI content production" - triggered deletion of everything up to the next list, silently cutting up to 90% of an article at render time (the database content was intact). The cleaner now only scans the first 3000 characters, matches exact TOC phrases, and caps the removal window.
Crypto Theme: Full-Width Layout and Styled Content Tables
Improved
- Homepage post grid and single articles now align with the header width. The "All Posts" section and the article layout previously used a narrower container, and the article body was additionally capped at 736px - both now follow the site's full 1400px line, so wide screens are actually used.
Fixed
- Content tables render properly in articles. Table styling was scoped only to static pages, so tables inside posts appeared bare (no borders, no header background). Article bodies now get the same professional table look, with zebra rows and horizontal scrolling on mobile.
Winning Content: Traffic Trends on Your Dashboard
Added
- Winning Content card on the dashboard. Your top 5 posts of the last 30 days with rise/fall indicators, powered by the built-in privacy-first ZeroTrack analytics - no external service, no cookies. Appears automatically once traffic data exists.
- Content Trend report in ZeroTrack. A rising/falling comparison (last 30 days vs the previous 30) at post level; falling posts are labelled as refresh candidates, so you know exactly which articles need attention before rankings slip further.
Uniform Row Actions Across All SEO Lists
Improved
- List action buttons follow one clean standard. In Heading Fixer, Content SEO, Content Optimization and Orphan Content, row actions (Preview / Fix / Save / Edit) no longer wrap onto multiple lines or mix button styles - they sit in a single compact row with a consistent look; secondary validator shortcuts (Rich Results, Schema) are now subtle links instead of heavy buttons.
- Less noise in the Content SEO list. The redundant content-type label before each slug was removed; pages are marked with a small badge only when relevant.
Advanced SEO Panel v2: One Navigation, Auto-Linked Orphans, Brand-Safe Headings
Added
- Orphan content fixes itself. The Orphan Content module gained an Auto-Link action: for every post with no inbound internal links, related posts (same category first) are scanned and a natural internal link pointing at the orphan is injected automatically - no manual editing, with the full markup-safety net and at most one new link per source post.
- SEO Health Check is now tabbed. Identity, AdSense, content, files and HTTP checks each get their own tab with issue-count badges - no more scrolling through long card columns.
Improved
- One navigation, zero duplication. The Advanced SEO panel sidebar is now grouped (Overview, Content, Images, Links, Site) and each optimizer tab is its own module; inside the panel the old duplicate top tab bar is gone, and confusingly-named entries were renamed (Image SEO vs. Featured Images).
- Redirects & 404 opens clean. The module previously rendered the whole Settings page - including its own settings menu - inside the panel; it now opens as a standalone tool.
- Year Updater and Content Optimization follow the design line. Cards, tables and buttons match the rest of the admin; action buttons no longer wrap into circle-shaped blobs, and the Edit button got its missing style.
Fixed
- Technical terms are no longer "fixed" into broken casing. Heading checks flagged titles like "cPanel Guide" or "iptables and ufw" as lowercase errors, and title-case would mangle them (cPanel → Cpanel). Brand-like words - mixed-case names, terms with digits or dots, and a broad list of lowercase tool names - are now left untouched in both detection and repair; Turkish conjunctions (ve, ile, için…) also stay lowercase in title case, in both languages.
Advanced SEO Overhaul: Internal Linking Repaired, Turkish-Aware Matching, New Modules
Added
- Turkish-aware internal linking. On Turkish sites the linker now recognizes inflected forms ("e-posta pazarlamasında" matches "E-posta Pazarlama"), and posts' multi-word tags become anchor candidates - noticeably more natural internal links, with the same markup-safety net that reverts anything suspicious.
- Orphan Content module. Lists published posts with no inbound internal links and uncategorized posts, with linking-candidate suggestions from the same category.
- Bulk meta editor. Edit meta title/description inline in the post list with live character counters; scores recompute on save. CSV export is one click away.
- The panel now surfaces SEO Health Check, Redirects & 404 log and the SERP Identity test - previously hidden in Settings.
Fixed
- Posts that matched no links are no longer excluded from future scans. A "processed, no links" marker made such posts invisible to the incremental scan forever and miscounted the panel statistics; they are now retried as your library grows, and the stats distinguish processed, linked and awaiting posts.
- Internal-linker silence is over. Every skipped, failed or successful on-publish linking attempt is now recorded to a dedicated log, so "why did this post publish without links?" is answerable - a read-only diagnostic page shows settings truth, log distribution and a live dry-run.
- The SEO panel no longer breaks inside its frame. Saving a form could render a second admin shell inside the panel, and edit links trapped you inside the frame; both fixed.
- Turkish content scores are measured correctly. Word counting was not UTF-8 aware, so Turkish posts scored artificially low; generated meta titles also respect your title separator and site name now.
- All SEO tools require administrator rights and use a single heading-hierarchy engine, ending inconsistent results between modules.
Get your site live
The setup wizard gets a site live in about 30 minutes. See the prices and the free edition.
View Pricing- Setup and live in 30 minutes
- 15 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO - Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)