Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 21 of 24 - 710 releases, newest first.
No More Style Flash on Inner Pages, Analytics Beacon Restored
Fixed
- Pages no longer flash unstyled for a split second. The Personal theme async-loaded its full stylesheet while the inline critical CSS did not fully cover any page type; navigation briefly rendered bare. The stylesheet now loads normally - it is same-origin, versioned and immutable-cached, so the change costs nothing after the first visit.
- ZeroTrack page views are recorded again. The tracker posted to a plugin route that 404'd in production; it now uses the standalone /zt-track endpoint that works independently of plugin bootstrap.
- Cloudflare Insights no longer triggers console CSP errors. Its beacon origin was missing from the Content-Security-Policy script allowlist.
Zero Validator Errors: noscript Guard & Footer Style Leftovers
Fixed
- The font-defer optimizer no longer touches noscript fallbacks. It could wrap the fallback link inside an existing noscript block, producing nested noscript markup and a dead stylesheet for no-JS visitors.
- Personal footer layouts dropped their duplicate legal bar. All eight variants carried a leftover legal-links block and an in-body stylesheet from before the standard bottom bar; links were doubled and the markup failed validation.
Three Gaps Caught by the New Live Signal Checks
Fixed
- Health theme now emits the WebSite/Organization schema. Its header never called the central schema emitter, so sites on this theme published no structured data - invisible to Google's site-name and rich-result systems.
- Personal theme search pages are noindexed again. The header skipped the robots-meta helper entirely, leaving search results indexable.
- News-theme language attribute reads the correct setting. A legacy key left Turkish sites reporting lang="en".
Theme Integrity: Every Theme File Now Ships From One Source
Fixed
- Recipe featured images resolve to the correct URL everywhere. A media-path fix that lived on a single install (cards/hero images could 404 when stored without the uploads prefix) is now part of the core Recipes theme.
- Theme copies can no longer silently drift. Previously only ~30 hand-picked theme files were integrity-checked; now every theme template and stylesheet is verified against the canonical source, and deliberately customized installs are tracked explicitly instead of being overwritten.
- Hardened against a class of update crashes. Syncing a theme's function file onto a customized install could remove helpers its templates still call, cutting pages off mid-render. Sync tooling now knows about customized theme sets and never overwrites them.
Valid Markup, Correct Language Tags & Faster Font Loading
Improved
- Fonts no longer block first paint. Google Fonts and icon stylesheets across all themes now load with the non-blocking preload pattern, improving Core Web Vitals.
Fixed
- Turkish search pages are no longer indexable. The /arama route escaped the noindex rule that /search already had, leaving thin search results crawlable - a "low value content" risk for ad-network review.
- Removed the hidden duplicate H1 from homepages. An old experiment injected an invisible site-name heading on every homepage, producing two H1 elements on themes that render their own. Each page now has a single, visible heading.
- Article pages no longer break on customized Entertainment installs. A sidebar helper call could crash mid-page on sites with a customized theme copy, cutting the page off before the footer. The sidebar now degrades gracefully.
- Markup validates cleanly. Headings inside inline wrappers, a mis-scoped ARIA label and the footer bar's in-body stylesheet (now emitted in the head) were the last W3C validator errors.
- Language attribute now follows your site language. Five themes hard-coded lang="en"; Turkish sites reported the wrong language to browsers and crawlers.
Your Site Name Now Reaches Google Exactly As You Typed It
Fixed
- Google could show your domain instead of your site name in search results. The system auto-generated a spaceless copy of your site name as a schema alternate name, and a Turkish-character comparison bug let this domain-lookalike value slip into the page. Google's site-name algorithm could then fold your brand into the bare domain. The auto-generated alternate name is gone, the comparison now transliterates Turkish characters correctly, and existing installs clean up the stray value automatically - the Site Name setting is now the single source of truth, emitted verbatim.
- Removed weaker duplicate schema emitters from five themes. Personal, Trends, Recipes, News and Lifestyle carried their own WebSite/OpenGraph generators missing fields Google uses for site-name selection; all themes now use the central, complete emitter.
- Admin SEO preview now matches the real page output. The preview showed a different homepage title pattern than what the site actually emitted.
Content Rendering, Performance & AdSense-Ready Theme Pass
Improved
- Faster pages with responsive images. Article cards and thumbnails now load an appropriately sized image variant instead of the full-resolution original, cutting page weight significantly.
- Navigation and footers are data-driven. Menus, category bars and footer links now come from your real categories, so a fresh site never shows dead example links - better for visitors and for ad-network review.
- Dark mode stays correct with custom colors. Setting brand colors no longer overrides the dark theme; dark mode renders reliably regardless of customization.
- Cleaner article intros. The first paragraph is auto-capitalized at publish, so content never starts lowercase.
Fixed
- Markdown headings no longer leak as raw “###” text. Content that mixed HTML with Markdown could print literal “### Heading” or merge a heading and its first paragraph into one oversized block. Headings are now correctly separated and rendered, both at publish time and on render - across every theme.
- Queued articles that silently failed to publish now go out reliably. A session-cookie error during manual publishing could leave items stuck as “failed”. The underlying call is now guarded, so publishing completes instead of aborting mid-way.
- Removed placeholder/demo content from themes. Sample authors, demo article bodies, fabricated statistics and dead example links could appear on real pages; these are gone, so only your real content is shown.
- Legal links now appear in the Personal theme footer. The standard bottom bar (copyright · legal links · credit) was missing from all Personal footer layouts, so privacy/terms pages existed but were unreachable from the footer. Every footer variant now renders the shared bottom bar.
- Theme stylesheets update reliably after an upgrade. Tech, Entertainment and Pets linked their CSS without a version stamp, so browsers could keep serving a cached stylesheet indefinitely; the link is now stamped per file change.
No More Dead-End Update Banner on Centrally Managed Sites
Fixed
- The “Update available / Update Now” banner no longer appears on centrally managed sites. On these installations self-update is disabled and new versions are delivered by operator deployment, so the banner, the header update icon and the sidebar update badge were a dead end - clicking “Update Now” did nothing. They are now hidden whenever the install is centrally managed, matching the System Updates page which already showed “Central deployment ready”.
Professional Single-Bar Footer & Permanent CSS Cache Fix
Improved
- The footer bottom is now a single clean bar - copyright, legal links and the credit line share one row instead of a separate, duplicated legal strip below the copyright. Legal links used to render twice (in the footer columns and again in an injected bar); the redundant strip is removed across all themes.
Fixed
- Theme CSS no longer serves a stale cached copy after an update - the stylesheet is cache-busted by its file modification time, so visitors get the current styles without a hard refresh.
Canonical Cleanup: /page Redirects, Alias Consolidation & AdSense Readiness
Improved
- robots.txt is now AdSense- and Google-safe - the Googlebot group mirrors the base disallow rules (a crawler obeys only its most-specific group, so admin/api paths were previously left crawlable), and the AdSense crawler
Mediapartners-Googleis now explicitly allowed. - The site now serves a valid
ads.txtdeclaring the authorised AdSense publisher, resolving the “authorised sellers” warning that appears when the ad code is present but ads.txt is missing.
Fixed
- The duplicate
/page/{slug}URL now 301-redirects to the clean/{slug}and is no longer emitted in the sitemap - previously every static page was reachable at two URLs (a soft-duplicate that dilutes ranking signals and trips content-quality audits). The clean slug is now the single canonical address. - Legal, about and contact aliases consolidate onto one canonical URL with a 301 - language and spelling variants (e.g.
/privacy,/privacy-policy,/gizlilik) used to each return 200 with their own canonical, signalling duplicate pages. They now redirect to the page’s real address and the canonical tag matches the redirect target. - About/Contact pages that have no content now return 404 instead of an empty soft-200 - an alias with no template and no published page no longer renders a blank page whose canonical pointed at the homepage.
Image SEO: In-Content Images in Schema & Sitemap
Improved
- Article structured data now lists every image, not just the featured one - the Article/BlogPosting
imageproperty is now an array of ImageObjects covering the featured image plus the images embedded in the article body, each resolved with width, height and caption from the media library. This gives the in-content images a real shot at ranking in Google Images. - The image sitemap now includes in-content images - previously only the featured (and gallery) image of each post was submitted; the images inside the article body are now listed too, so Google can discover and index them.
- Fixed a silent bug where the featured image carried no dimensions in structured data - the media lookup queried a non-existent column, so width/height/caption were always dropped. Image objects now include their real dimensions.
SEO: Archive Canonicals, Unique Titles & Schema Fixes
Improved
- The homepage FAQ is now eligible for rich results - FAQPage structured data is emitted from the marketing site’s FAQ section.
Fixed
- Category, tag and author pages now point their canonical to themselves - in the travel theme these archive pages were inheriting the homepage’s canonical, title and description, which told search engines they were duplicates of the home page and effectively dropped them from the index. They now emit their own canonical URL, a unique title and description, and correct rel=prev/next for pagination.
- Every page now has a unique title and meta description - the recipes and finance themes were falling back to the site name on all pages (and recipes single posts had no meta description at all). Titles and descriptions now come from the page’s own content.
- The finance theme showed a hard-coded “FinancePro” heading regardless of the site’s real name, and rendered a second H1 on article pages - both fixed (real site name, single H1 per page). The news theme’s duplicate H1 was also resolved.
- News article structured data is now generated by the central engine - replacing an older version that referenced a missing logo file and could emit an invalid date, so news articles now carry correct Article/NewsArticle schema with the configured logo.
PageSpeed: Responsive Images, Accessibility & Security Headers
Security
- Content-Security-Policy now declares
script-srcand a Cross-Origin-Opener-Policy header is sent - script sources are restricted to the site itself plus the required Google advertising, analytics and font origins, closing the “missing script-src / COOP” findings without affecting ads.
Improved
- Images now download at the size they are displayed - the responsive image engine was emitting wrong width descriptors, so browsers fetched the 1600px version into ~800px slots. Descriptors now match the real variants (800/1600) and the size hint reflects the actual layout, cutting roughly 500 KiB from a typical page. Tip-card and recipe-card covers, which shipped a single full-size source, now serve responsive variants; continent illustrations were resized to their display size and the footer logo serves AVIF/WebP.
- Accessibility fixes across the travel theme and marketing site - section labels, hero chips and the newsletter button use an accent that meets WCAG AA contrast; decorative continent images no longer repeat adjacent link text; tip “Read” links carry the article title for screen readers; footer headings follow proper heading order.
- Smoother homepage animation - the step progress bar animates with a compositor-friendly transform instead of width, and the FAQ accordion no longer triggers a forced reflow on open.
Security Hardening from a Full Code Audit
Security
- Hardened the content scheduler's status filter - it now uses a strict allow-list and a parameterized query.
- The post listing helper now enforces a column allow-list - sort field, direction and limits are validated and type-cast before they touch the query.
- The automation webhook secret falls back to an installation-unique key - when no webhook secret is configured it is now derived from the per-install security key instead of a guessable time-based value.
Publisher Catalog & Backlink Opportunities, Verified for 2026
Improved
- The Backlink Opportunities module now lists real, verified programs - every niche grew from a couple of search shortcuts to 10-19 named opportunities checked live in 2026: Source of Sources and the relaunched free HARO, unlinked-mention reclamation, Lonely Planet Correspondents, BoardingArea, Matador Creators, foodgawker, mindbodygreen, the Plutus Awards, CryptoPanic, BlogPaws, Google/Bing/Apple business listings and more - each with priority, effort, and a concrete first step.
- The News Publishers catalog was re-verified for 2026 - Apple News (ANF, four countries), Flipboard (program closed; magazine + bookmarklet path documented), SmartNews and NewsBreak requirements updated; Bundle and SQUID added as open application channels; Pocket and Yandex Dzen removed.
Brand Consistency, robots.txt Compliance & Full Turkish Admin
Improved
- The Turkish admin is now fully Turkish - dozens of hardcoded English labels were localized across the post editor (Recipe/LocalBusiness schema fields), backups schedule, comment replies, duplicate finder, media upload, banner manager, theme customizer, user profiles and the traffic plugin menu (now "Hızlı İndeksleme", "Anında Bildirim", "RSS Beslemesi", "Backlink Fırsatları", "Tarayıcı Bildirimi"). The English admin remains fully English.
Fixed
- robots.txt now passes Bing validation - the non-standard
Host:directive (a legacy Yandex extension that Bing flags as an error) was removed from the generated robots.txt on every site. - The brand reads "jekcms" everywhere - a repo-wide sweep replaced every wrong-case variant across emails, feeds, installer screens, API docs, theme metadata, user-agent strings and comments. License-key format and code identifiers are untouched, so nothing breaks.
Proper-Noun Anchors in Internal Linking
Improved
- Auto internal linking now recognises single-word proper nouns - place, brand and topic names such as a city or a dish (capitalised, 5+ letters) can now become link anchors, not just multi-word phrases. Lowercase generic words stay excluded, so the links remain relevant. This noticeably improves internal linking on niche sites (travel, food, local guides) where titles are often a single proper noun.
Fixed
- Fixed the content-import wizard showing the "External authority links" label in English on a Turkish admin (it now follows the admin UI language).
Smarter Internal Linking & E-E-A-T Outbound Links
Added
- External authority links in the content generator - the content-queue import wizard can now request a set number (0–5) of in-content outbound links to high-authority, non-competitor sources. When enabled, the AI prompt weaves them naturally into the body on descriptive anchors (never a "Sources" list), strengthening E-E-A-T.
Improved
- Auto internal linking now waits for a real library - on a brand-new site there is nothing useful to link to, so auto-linking stays dormant until a configurable minimum number of published posts exists. The Auto Linker screen explains the threshold and shows current progress. As before, only published posts are link targets - queued/scheduled content is never linked.
Pinterest Production Setup Instructions
Improved
- Clearer Pinterest go-live instructions - after Pinterest grants Standard access, the setup guide now tells you to remove the existing connection and connect again in Production mode, instead of using plain Reconnect (which can silently stay in Sandbox).
Admin Customer Detail Fix
Fixed
- The customer detail screen in the admin panel opens reliably again - orders, licenses, invoices, support tickets and internal notes loaded with queries that did not match the production database, so the page returned a server error. Every section now reads the live schema correctly, and the customer create/edit forms save address details to the right fields.
Clearer Product Positioning Copy
Improved
- jekcms is now described the same way everywhere - a next-gen smart CMS that installs on any PHP + MySQL hosting. The vague "self-hosted" label (which could read as if hosting were included) and the inaccurate "plugin-free" label were removed from the homepage, the WordPress-alternative page, site metadata and structured data.
Category Archive Filter Fix
Fixed
- Category pages now show only their own posts - on themes that query archives by category ID, the post list ignored the category filter and showed every published post. The core query layer now accepts both category ID and slug, so every category archive lists exactly the posts that belong to it.
Invoicing, Customer Portal Language & Support System
Added
- Real PDF invoices - admins can now generate an invoice for any order and email it to the customer, and customers can download a proper PDF from their portal. Invoices render with full Turkish characters and work on any shared host (no server extensions required).
- Turkish-law VAT handling - domestic sales carry 20% VAT (KDV); sales to customers outside Turkey are treated as a VAT-exempt service export and the exemption note is printed on the invoice automatically.
- Company billing settings - a new admin screen for your seller details (company title, tax office, tax number, address, IBAN) that appear on every generated invoice.
- Billing profile for customers - buyers can now enter their tax number, address and country so their invoices are complete and the correct VAT rule is applied.
Improved
- Customer portal fully bilingual - every page of the customer portal (orders, licenses, invoices, support, profile, sign-in/up) now follows the selected language, so Turkish users no longer see stray English labels.
Fixed
- Support tickets hardened - fixed an issue where a second ticket from a customer could fail, added missing attachment storage, corrected priority handling, and customers now get an email when staff reply (and staff get one on new tickets).
- Portal pages that referenced old data fields now load correctly - order detail, new-ticket and invoice pages were updated to the live data model.
- Two admin tools gained CSRF protection and several blog/theme pages had social-share image and metadata issues corrected for better SEO.
Automatic Internal Links on Publish
Added
- New posts get internal links automatically when published - the moment a post goes live (manual publish, scheduled date, or content queue), 3-5 contextual links to your existing published posts are added inside it, so you no longer have to run the linker site by site. Only published posts are used as link targets; queued or scheduled items are never linked.
Security Hardening Pass: Payment, CSRF, Uploads, SSRF, API
Fixed
- Marketing homepage hardening guard aligned - the direct-access guard in the constants file only accepted one context flag, while the marketing site and update-server bootstrap use different ones; the guard now matches the loader so the public site renders normally
- Payment webhook is now fail-closed - the iyzico webhook now rejects any unsigned or invalid-signature event (matching the Stripe gateway) before an order can be marked paid
- CSRF enforcement extended to GET admin actions - central CSRF enforcement now also covers authenticated GET action handlers (delete/toggle/activate)
- API input is column-whitelisted - the categories/tags update endpoints now accept only known fields
- SVG uploads disabled - SVG is no longer an allowed upload type; standard image formats are unaffected
- SSRF guards added to server-side fetchers - bulk-import and remote content-image fetching now validate the URL against private/loopback/metadata ranges and no longer follow redirects
- Customer portal forms fixed - the CSRF token field referenced a non-existent method (so it rendered empty); corrected to the proper token, and a status parameter in pagination links is now URL-encoded
- Removed a leftover temporary password-reset utility from the web root
In-Article Images Now Match on Items That Already Have a Pinterest Slot
Fixed
- Image matching no longer skips the in-article photos when an item only had a Pinterest slot - after a re-import added a Pinterest slot to an item that had no content image plan, the matcher mistook that lone Pinterest slot for a full plan and never built one from the article's headings, so the cover and pin matched but the in-article images (img02, img03…) stayed in temp. The matcher now ignores the Pinterest slot when deciding whether a content plan exists, builds the heading-based plan when needed, and preserves the existing Pinterest slot
Re-Importing JSON Now Updates Existing Queue Items (Pinterest + Prompts)
Improved
- Re-importing a JSON now enriches items already in the queue instead of skipping them - previously a duplicate (same source id) was skipped entirely, so content imported before a feature existed could never gain it. Now a re-import fills in any empty image prompts from the new file and adds the Pinterest brief (hook, title, description, tags, image prompt) and pin slot - while preserving already-matched image URLs, the schedule, and any manual edits. The import result reports how many items were updated
Content Queue Image Column Now Counts the Matched Cover
Fixed
- The image-status column no longer shows “—” when the cover is actually matched - items imported without a full image plan store their cover in the
featured_imagecolumn rather than the plan, so the queue list read “no images” even though the cover thumbnail was clearly set (and the image dialog said “1/1 matched”). The column now counts a column-matched cover too, so the list and the dialog agree
End-to-End Pinterest Pins: Custom Copy, Per-Category Boards, and Baked Designs
Added
- Per-article Pinterest copy now publishes - a pin's title and description come from the imported brief (
_pinterest_title/_pinterest_description) instead of the generic post title and template, so each pin reads the way it was written - Pins route to the matching board automatically - a pin is posted to the board whose name matches the article's category (with the connected account's default board as fallback), so a multi-topic site keeps its Pinterest boards organized with no manual selection
- Designed-in-full pins are supported - when the image already bakes in its own headline and domain bar, the CMS skips its own stamp (
stamp:false), so there is never a double bar
Improved
- The AI content wizard now writes premium pin briefs - when Pinterest is enabled, it produces an editorial brief (short hook, ≤100-char title, ≤500-char keyword-rich caption, tags, the
<slug>-pinterestfilename, and a full split-layout image prompt with the site domain baked in) ready for image generation
Hands-Off Pinterest Pins and Bulk Image Matching in the Content Queue
Added
- Pinterest pins now match automatically - drop a
<slug>-pinterest.jpginto the uploadstempfolder alongside your article images and the queue picks it up on the next “Match Images” run, stamps your site’s domain bar onto it, and attaches it to the post. No more uploading pins one at a time - Pinterest captions travel with the content - the import schema now carries a pin hook (the headline on the image), a meta description (the caption shown under the pin) and tags, and writes them to the published post so a Pinterest publisher can fill those fields without guesswork
- An image-status column in the queue list - every row shows how many article images are matched (e.g. 2/3) and whether a Pinterest pin is present and matched, at a glance
Improved
- The content queue list was redesigned - the action buttons (view, images, publish, delete) are now a compact, single-row icon group instead of a stack that overflowed the column, and the new image-status chips are monochrome and uncluttered
- Image matching now shows a real progress bar - a clean progress window reports matched count, percentage and a live log as it processes the temp folder in batches, instead of a number ticking in a button
- Content Studio is now the calm starting point for publishing - the dashboard gathers the publishing calendar, queue health, next action and entry points for AI draft, planned batches and content packs into one compact two-language screen
- Imports are more forgiving - image entries that use
role/promptinstead ofslot/image_promptare now understood, so content generated by different tools imports correctly without hand-editing the JSON
Get your site live
The setup wizard gets a site live in about 30 minutes. See the prices and the free edition.
View Pricing- Setup and live in 30 minutes
- 15 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO - Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)