Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 22 of 24 - 710 releases, newest first.
Admin Sessions No Longer Drop After a Few Hours Idle
Fixed
- You stay signed in until you actually sign out - even with the session cookie and garbage-collection lifetimes already raised to 30 days, an inactivity check was still destroying the session after ~2 hours of no activity (its threshold constant was undefined, so it fell back to a 2-hour default). The idle limit now matches the 30-day session lifetime, so leaving the dashboard open and coming back hours later keeps you logged in
Admin Language Consistency - Plugin Text Now Follows TR/EN
Fixed
- The newer plugins no longer leak the wrong language in the admin - Google Console, Traffic & Distribution, and parts of Social Publishing hardcoded their interface text in a single language (mostly Turkish), so it showed Turkish in the English admin (and vice-versa). All of these are now bilingual and follow the admin language setting
- Google Console’s plugin-list description is now bilingual - it was missing from the localized description map and fell back to the Turkish manifest text
- The Two-Factor Authentication card in Settings → Security is now bilingual - its labels, steps, badges and buttons were Turkish-only
- Social Publishing platform help/how-to, cost and warning texts are now bilingual for all platforms - these registry strings rendered in a single language regardless of admin locale
Performance (N+1) and Security/SEO/Plugin Hardening
Improved
- List pages issue far fewer database queries - loading a post list with relations ran 6 queries per post (author, categories, tags, meta, SEO, comments); a 12-post page hit ~72 queries. It now batches all of them into 6 total via IN() lookups
- Image dimension lookups no longer scan the media table on every render - the per-image width/height query used a leading-wildcard LIKE (full-table scan per image); it now uses exact-path matching plus a per-request cache
- Saving a post no longer wipes the entire object cache - cache invalidation is now targeted to the affected namespaces instead of a global flush
- Faster LCP on article pages - the hero/featured image on travel and health single-post templates now carries fetchpriority="high"
Fixed
- Client IP detection is now trustworthy for blocking - forwarded headers are accepted only when they carry a public IP, so the address used for IP blocking is reliable
- Redirect Manager blocks dangerous redirect schemes - javascript:/data:/vbscript: targets are refused at emit time
- Admin error messages no longer leak internals - Security Center and Redirect Manager now show a generic message and log the detail
- Cross-domain Sitemap line removed from the shipped robots.txt fallback - robots is served dynamically with the site’s own domain; the static fallback no longer carries a hardcoded foreign domain
- Google Console snippets can no longer double-inject - the head injector is guarded against firing on both head hooks
- Removed the misleading dead Pinterest-template dropdown in Social Publishing settings (it was never read)
Deep Audit Fixes - CSRF Enforcement, Cache, SEO & Systems
Fixed
- CSRF protection is now enforced centrally across the admin - validation blocks state-changing authenticated requests centrally (clean 419, JSON for AJAX) without affecting public forms or page rendering
- "Clear Cache" buttons work again - they called a method that did not exist and fataled (purging nothing). Added the missing prefix-delete method and hardened the handler
- Sitemap index no longer miscounts pages as posts - the posts-sitemap presence/lastmod now filter on post type, fixing false "empty posts sitemap" and wrong freshness signals
- Update manifest hash guard now fully active - the signed update manifest exposes the core package hash under the field the client checks
- Social Publishing "Hold for approval" no longer silently stops publishing - held items now appear in the queue with one-click Approve / Approve-All / Cancel actions
- Traffic & Distribution now verifies TLS - IndexNow/WebSub/Web-Push calls now enforce certificate verification
Security Center Now Matches the Admin Design System
Fixed
- The Security Center looked disconnected from the rest of the admin - it shipped its own stylesheet with hardcoded light-mode colors (white cards, grey borders) instead of the admin’s shared design tokens, so it ignored dark mode and its tabs/cards/tables didn’t match the other panels. Every color now uses the admin theme variables, so it adapts to dark/light and looks like one consistent product. Status indicators keep a subtle tinted badge instead of solid blocks, and the brand wordmark was corrected to lowercase
Strip Byte-Order Marks From Core Files - Fixes Admin Layout & AJAX
Fixed
- Admin pages no longer render with broken styling - several core PHP files (bootstrap, constants, helpers, theme functions) carried an invisible UTF-8 byte-order mark (BOM) before their opening tag. That BOM was emitted before the document’s doctype, which forced browsers into "quirks mode" and broke list/table layouts across the admin. The BOM has been stripped from every PHP file across every installation
- AJAX actions no longer fail with a JSON parse error - the same BOM was prepended to JSON responses (e.g. "Match Images"), so the browser threw
Unexpected token … is not valid JSON. With the BOM removed, responses are clean JSON again
Match Images - Build Article Image Plans From Your Generated Files
Fixed
- Bulk image matching now actually imports your files - the media importer used PHP’s upload-only move function, which always fails for files already on the server (e.g. images you place in the uploads/temp folder). A server-side "sideload" path now imports those files correctly, and a valid uploader id is always supplied so the database insert no longer fails outside a browser session
- "Match Images" understands multi-image articles - drop files named
{slug}-img01..04in the temp folder and the matcher attaches them as the article’s image plan: image 01 becomes the featured image and the rest are placed in the body after the article’s headings. When the article already has a plan, empty slots are filled in order - Admin thumbnails resolve relative image paths - queue list and calendar previews now prefix the uploads URL for plan images stored as relative paths, so the thumbnail shows instead of a broken image
Match Images - In-Memory Matching, Seconds Instead of Minutes
Fixed
- "Match Images" now finishes in seconds on large queues - the previous version ran two full-table
LIKE '%slug%'scans per item and re-normalized every media filename for every item, which on a queue of hundreds against thousands of media files took minutes and hit a server gateway timeout (the generic "server error"). The media library is now normalized once and all items are matched in memory - no per-item database queries, no repeated work
Match Images No Longer Times Out on Large Queues
Fixed
- "Match Images" no longer fails with a generic server error on large queues - with hundreds of queued items and thousands of media files, the slug-to-media scan could exceed PHP’s execution limit and return a raw 500. It now skips items that already have an image attached through the image-matching flow (so nothing is re-scanned needlessly), and the time limit is raised for the bulk pass
- Queue actions now always return a readable error - any failure in a content-queue action is converted to a proper JSON message instead of a raw 500 page, so the browser shows the real reason rather than a generic "server error"
Reliable Manual Publishing - No More "Spinning then Failed"
Fixed
- Publishing no longer crashes when a session cannot start - if output had already begun (e.g. a slow image URL emitting a warning), the session layer threw a fatal "headers already sent" error that aborted the publish even though the post itself was fine. The session now degrades gracefully (logs and continues, fail-closed) instead of crashing background work
- A dead or slow featured-image URL can’t freeze the publish anymore - image download now has an 8-second connect and 25-second total cap (was 60s with no connect timeout), the single biggest cause of the publish button spinning for up to a minute. A failed download simply falls back to publishing without that image
- Already-published posts are no longer mislabeled "failed" - if a post was created but a later side-step (cache, session, search-engine ping) errored, the queue now finds the post by slug as well as title and correctly marks it completed
- The optional in-content image localization can no longer abort a publish - the whole step is now isolated; any error there is skipped and the post still goes live
Content Queue - Recover Stuck Posts & Fix Missing Thumbnails
Fixed
- Scheduled posts can no longer vanish silently - if publishing was interrupted by a fatal error mid-run, the item used to stay frozen in a "processing" state that appeared in no queue tab and was never retried. Publishing now catches every failure type and the auto-publisher reclaims any item stuck longer than 15 minutes, so the backlog clears on the next visit
- Failed and stuck items are now visible and recoverable - a new "Failed" tab surfaces every problem item (failed or processing) with a one-click retry, instead of leaving them invisible while still showing on the calendar
- Featured thumbnails show in the admin again - completed posts whose image was attached through the image-matching flow stored the picture in the rich payload, not the legacy column, so the queue list and calendar showed an empty box even though the live post had the image. The admin now reads the matched image as a fallback
- Calendar hover preview image fixed - the tooltip was building the image path the wrong way around (a local path treated as an external URL and vice-versa), so the preview was always broken. It now uses the same single image resolver as the rest of the queue
Security Hardening - Per-Install Unique Keys
Improved
- Every installation now generates its own unique security keys - authentication, session and JWT secrets are created with cryptographic randomness on first run and stored outside the distributed package. No two installs share secrets, so a token issued on one site is meaningless on another
- Install-time integrity manifest - the wizard now signs the tamper-detection manifest with the install’s own key at the end of setup, so a fresh installation never shows a false "integrity" warning
Migration Polish - Author Links Show Everywhere, Bulletproof .htaccess
Improved
- The installer now guarantees jekcms’ own .htaccess is used - on most WordPress sites the .htaccess is stuffed with SEO/sitemap-plugin rewrite rules that can break clean URLs. The installer detects whether jekcms’ signature is present; if not, it backs the old file up to
.htaccess.wp-backupand writes the canonical jekcms .htaccess (read straight from the package, so no drift). Routing is correct even if the host locked the file or the archive lacked it
Fixed
- Migrated author social links now actually appear - several themes (Personal, Trends, Lifestyle, Pets, Finance) were reading the old column names and silently showed nothing. They now read the real
social_x / social_facebook / social_instagram / social_linkedin / websitefields, so the profiles imported in 2.16.0 are visible on author and article pages
WordPress Migration - Richer, Safer, Cleaner Imports
Added
- Author profiles now come over in full - biography, website, social links (X, Facebook, Instagram, YouTube, Pinterest, LinkedIn) and a Gravatar-based avatar, instead of just the name. Existing authors are enriched only where fields are empty (never overwritten)
Improved
- Re-running a migration no longer creates duplicates - posts already imported (matched by their original slug) are skipped, so an interrupted migration can be safely resumed
- Empty categories are cleaned up - WordPress’ default "Uncategorized" and any category with no posts are removed after import, so your category list stays meaningful
- A clear warning before deleting old files - if you migrated without downloading images (so your content still points at the old site), the cleanup step now warns that deleting the old files would break those images
Installer Renamed to jekcms-install.php (avoids WordPress clash)
Improved
- The setup file is now
jekcms-install.phpinstead of the genericinstall.php. A leftover WordPressinstall.phpon the server can no longer be confused with - or shadow - the jekcms installer. All "not installed yet" redirects and robots rules were updated to match
Setup Wizard - Clean WordPress Switchover (Safe Cleanup + Logo)
Added
- The wizard now finishes a WordPress migration cleanly - after importing your content, a Cleanup step lists exactly which old WordPress files will be removed and asks you to confirm (with a clear "this cannot be undone" warning). It then deletes them with a live progress bar, and optionally drops the old WordPress database too
- Safe by design - only genuine WordPress files are removed (a strict allow-list:
wp-admin,wp-includes,wp-content,wp-*.php,xmlrpc.php…). jekcms’ own files are never touched - even where names overlap (e.g. license/readme). The wizard also refuses to drop jekcms’ own database - Logo support - your site logo is pulled automatically from WordPress when migrating, or you can upload one (PNG/SVG/JPG/WebP). For a fresh install, just upload your logo. It’s saved to your site settings
Setup Wizard - English & Turkish, English by Default
Added
- The setup wizard now speaks English and Turkish, defaulting to English. A language toggle (EN/TR) sits next to the theme switch in the top bar, and your choice is remembered. Every label, hint, button, alert and progress message is fully translated
Setup Wizard - A Polished, Modern First Impression
Improved
- The setup wizard was redesigned from the ground up - a glassy, animated interface with a numbered progress tracker, the jekcms wordmark logo, soft animated background auras, smooth card transitions and a live progress bar. It now supports both dark and light themes with a one-tap toggle (your choice is remembered)
- The database step is much clearer - it now explicitly states that this is a new, empty database for jekcms, with a prominent note for WordPress users that it is not their existing WordPress database (that comes in the next step). No more mixing them up
Setup Wizard - WordPress Migration Verified End-to-End
Fixed
- The WordPress import step now connects to the correct database. Three real-world bugs found during a live migration test (a 114-post WordPress site) were fixed: the framework is loaded in global scope so the site's configuration is read correctly, database seeding no longer collides with open result cursors, and AJAX responses are now always clean JSON (no stray warnings)
New Setup Wizard - Install Fresh or Migrate From WordPress in Minutes
Added
- A modern, guided installer (install.php) - drop it next to the jekcms archive in your site root, open it in a browser, and it walks you through everything: a system requirements check, database connection (with step-by-step phpMyAdmin guidance and auto-create if the database is missing), site details, theme choice and admin account. It then unpacks the files, builds the database, applies your settings automatically, and cleans itself up afterwards
- WordPress migration built into the wizard - choose "Migrate from WordPress", enter your WordPress database details, and the installer previews how many posts, pages, categories and comments it found, pre-fills your site name and tagline from WordPress, then imports content, downloads & converts images to AVIF, and brings over approved comments. At the end it checks for leftover WordPress files and warns you to remove them to avoid conflicts
- Finishes with clear next steps - two cards to open the Admin Panel or view your site, with your details already filled in
Account & License Security Hardening
Fixed
- License site-limit race condition closed - registering domains for a license is now serialized (row-locked), so two simultaneous requests can no longer slip past your plan's site limit
- Logout now fully ends the session - the session is destroyed and its cookie cleared (previously only the user id was removed), removing a session-fixation surface
Reliability Audit - Newsletter Cron, Scheduled-Posts Link & Contact Inbox Fixed
Improved
- Trimmed remaining developer-oriented notes across the admin (technical jargon, internal details) down to plain, end-user labels
Fixed
- Newsletter sending cron was broken across all sites (a comment line accidentally ended early and broke the file). Scheduled campaigns now send again
- Scheduled-posts link in the top bar led nowhere - it now opens the scheduled posts list correctly
- Contact-form inbox could load the wrong site's configuration (a hard-coded path) - now resolved per-site
Google Console - One Clear "Scan" Button
Improved
- Index Coverage now has a single Scan button (auto-completes the whole site; becomes Re-scan when done) instead of three overlapping controls. Each card carries one short line explaining what it does
Google Console - Cleaner, Less Cluttered Copy
Improved
- Trimmed long explanatory notes in the Google Console panel down to short, action-focused labels - less clutter, faster to scan
Google Console - Cleaner Search Console Flow + Responsible Bulk Indexing
Added
- Bulk "Submit to Index" - notify Google about your not-indexed pages in one click. Built responsibly: a daily cap (well under quota), the same URL is never re-sent within 14 days, and only genuinely not-indexed pages qualify (404 / noindex / redirects are skipped). A clear notice explains that Google officially supports the Indexing API only for job-posting / livestream pages
Improved
- Search Console tab decluttered - the redundant single-URL inspector was removed (Index Coverage already shows every URL's status). One clear flow: coverage summary → problem list → indexing actions
- Auto-scan reliability fixed - coverage now scans in short, fast batches with automatic retry, so it no longer trips the "connection error" on stricter hosts
Google Console - One-Click Auto Scan for Index Coverage
Improved
- Index Coverage now scans automatically - one "Auto scan" click runs the whole site in the background, batch by batch, with a live X/Y checked… progress counter, instead of clicking "Next batch" a dozen times. Google's URL Inspection API is rate-limited and ~one URL takes a few seconds, so the panel paces itself and resumes until every URL is checked
- Resilient & cached - each batch is time-guarded so it never hangs the page, results are cached 24h, and a single-batch manual button plus Reset remain for fine control
Google Console - Pick Your Analytics Property From a List (No More ID Typing)
Improved
- GA4 is now a dropdown, not a number to copy - Settings → Auto-discovery lists the Analytics accounts and properties your Google account can access, so you just pick yours instead of hunting for the numeric Property ID. Matches the existing one-click selection for Search Console site and AdSense account. Manual entry stays as a fallback
- Index Coverage is clearer before scanning - instead of a confusing row of zeros, the card now shows a clear "ready to scan" prompt, and explains that its totals won't exactly match Search Console's "Page indexing" numbers (Google also counts category/tag/system and old URLs; the panel checks your published content)
Google Console - See Which Pages Google Isn't Indexing
Added
- Index Coverage in the Search Console tab - a new card scans your site's URLs and groups them by Google's indexing status: Indexed, Not indexed (crawled/discovered but not added, unknown to Google) and Error (404, server error, blocked by robots). You finally see your indexing problems in one list instead of checking URLs one by one
- Quota-friendly, incremental scan - built on Google's URL Inspection API (the only API that exposes per-URL index status). Each click inspects ~10 URLs, results are cached 24h, and a wall-clock guard keeps it responsive - large sites finish in a few clicks. Problem URLs link straight to Submit to Index
Google Console UI - Now Fully Native to Your Admin Theme
Improved
- The Google Console panel was rebuilt on the admin design system - it now follows your dark/light theme, uses the same cards, pill buttons, segmented date controls and typography as the rest of the admin instead of a separate light-only look. A more professional, cohesive dashboard
- Cleaner data presentation - connection status shown as a clear pill badge, neutral monochrome trend charts (no decorative color noise), refined KPI cards, tables and diagnostics that read at a glance
Google Console Now Ships With Every Theme
Added
- The Google Console plugin is now bundled with every jekcms theme - Search Console performance, GA4 traffic, AdSense earnings and frontend GA4/GTM/AdSense snippet injection in one panel, behind a single Google sign-in. Previously available on one theme, now on all of them
- One-click connect, encrypted tokens - OAuth refresh/access tokens are stored encrypted; the connection survives even if your admin session drops mid-flow (server-side one-time state, 10-min window)
Get your site live
The setup wizard gets a site live in about 30 minutes. See the prices and the free edition.
View Pricing- Setup and live in 30 minutes
- 15 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO - Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)