Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 23 of 24 - 710 releases, newest first.
One Universal Key, Multiple Sites - Manage Domains From Your Dashboard
Added
- Site management in your account - one license = one key + N site slots. Register each site's domain (e.g.
siteadi.com) under My Licenses, up to your plan's limit. Adding a site beyond the limit is blocked - Strict activation - a site only activates if its domain is pre-registered for that license; an unregistered domain is rejected with a clear message. You control exactly which sites use your license
- Upgrade path - move to a higher plan for more sites; your key stays the same
Simpler Pricing - Same Everything, Only Site Count Differs
Improved
- Every plan now includes the exact same features and support - all 14+ themes, all SEO & automation tools, priority support, lifetime updates. The only difference between plans is how many sites you can run
- Clear tiers: Personal $29 / 1 site · Standard $79 / 3 · Professional $149 / 10 · Unlimited $349 / ∞. The confusing dual "Agency $299 / Enterprise $599" tiers were replaced by one Unlimited plan
Fixed
- Pricing data was inconsistent across the site, checkout and license server (Agency was 50 domains in one place, unlimited in another, $299 vs $599). Now a single consistent model end-to-end
New Plugin: Google Console (Analytics + Search Console + AdSense)
Added
- Google Console plugin - Search Console (clicks, impressions, queries, URL inspection and one-click index submission), Analytics GA4 (traffic and channels) and AdSense (earnings) on one screen, through a single Google sign-in
- Tag insertion - GA4, Tag Manager and AdSense tags are placed on your site from the panel, with no theme file to edit
- Built to keep running - access tokens are stored encrypted, responses are cached so you do not burn through Google's quotas, each API reports its own status, and an expired connection says "reconnect" instead of failing quietly
Infrastructure Hardening - Security, Performance & SEO
Security
- Payment webhooks now fail closed (Stripe + iyzico): an order is marked paid only on a valid signed webhook, and the paid amount is verified against the order total
- Admin payment/customer/order pages now require admin role; maintenance scripts locked to CLI; session cookie set to
SameSite=Lax(fixes being logged out when returning from external links)
Improved
- Faster page loads - plugin scan cached per request, composite DB indexes, and N+1 query batching on list pages. SEO: correct archive titles, paginated-page noindex, dynamic html lang
Fixed
- Analytics plugin (ZeroTrack) and Smart Backup now create their database tables on first use, fixing a 404/500 on fresh installs
Hero Trimmed to a Hook + Features Grid Expanded
Improved
- Hero copy trimmed to a hook - the 8-vendor laundry list ("Analytics (Plausible). SEO schema (Rank Math)...") was too long. Replaced with a sharp hook: "Not plugins. Core." + a single subtitle quantifying the savings (20+ features, ~$624/yr). Same message, half the words, double the impact
- Features grid expanded from 14 to 20 cards - added 6 cards for built-in capabilities that were previously hidden: Social Publisher (Buffer/Hootsuite - 18+ networks auto-publish), Instant Indexer (IndexMeNow - IndexNow + WebSub + Web Push), Newsletter (Mailchimp - campaigns + subscribers + digest), AI Image Generator (Canva - Gemini-driven post covers), AI Bulk Publisher (ContentBot - n8n + bulk queue), and they collectively replace another ~$390/yr in subscriptions
Hero Copy Forced from Code - DB Override Bypass
Fixed
- Hero subtitle was empty on production - load_marketing_translations() pulls hero_subtitle from the marketing_translations table when present, which still held a stale pre-v2.8.1 entry on production (the 8-vendor copy never displayed). Fix: after merging defaults+DB layers, header.php now force-overrides hero_title and hero_subtitle from the code defaults. Marketing-investment copy is a release-time concern, not a CMS admin concern
A Homepage That Names What jekcms Replaces
Improved
- The homepage says what you actually get - instead of an abstract feature list, it names the tools jekcms replaces (analytics, SEO, backup, security, two-factor login, redirects, image optimisation, caching) so you can compare against what you pay for today.
Performance Suite - Redirect Manager + Image Studio + Critical CSS, Built-In
Added
- Redirect Manager (NEW) - a panel screen where you add, edit and delete 301, 302, 307, 308 and 410 redirects. The lookup runs before the page is built, so a redirect costs no extra page load. Each rule shows a hit counter and the date it was last used, so you can see which old addresses people still open.
- 404 logger + Orphan 404s tab - every 404 hit is logged with referrer + UA. The admin sees URLs with 3+ hits in the last 30 days and can create a 301 with one click + a target URL field. Solving SEO recovery becomes a feed scroll
- 404 records stay clean - the log table repairs itself on first use, and panel, API and analytics requests are skipped so your own traffic never shows up as a broken link.
- Image Studio - the media optimisation screen now covers what a paid image plugin does: convert your whole library in batches, generate responsive sizes from 320 to 1920 pixels, produce tall Pinterest images and stamp your domain as a watermark.
- Critical CSS Studio - the performance tools now have their own screen: inline the styles the first screen needs, defer the rest of the JavaScript, add preload hints and read the Core Web Vitals suggestions in one place.
- Three new feature cards - Redirect Manager, Image Studio and Critical CSS Studio join the feature list on the website.
TOTP 2FA - Surfaced + Coverage Tracker in Security Center
Added
- Security Center → 2FA Status tab - lists all admin/editor/author users, their 2FA enabled state (ENABLED / NOT ENABLED pill), role, last-login timestamp. "Enable Now" button for the current user (jumps to Settings). For other users: instruction that they must enable from their own profile (TOTP is a personal credential)
- 5th KPI card: 2FA Coverage - percentage of admin/editor/author users with TOTP enabled. Color codes: green ≥80%, neutral 40-80%, red <40%. Sub-label shows raw count (e.g. "3 / 5 users")
- About TOTP card - documents the setup flow (Settings → Two-Factor Authentication → Initialize → scan QR → confirm), login flow, recovery path (DB-level unlock if authenticator is lost). Explicitly positions jekcms's TOTP as a replacement for WP 2FA + Wordfence Login Security (~$50/yr combined)
- features.php 11th card: TOTP 2FA - RFC 6238, Google Authenticator/Authy/1Password compatible
Security Center - WAF Dashboard + File Integrity Monitor, Built-In
Added
- Security Center admin page - a single tabbed dashboard for WAF/login attempts, security events, and file integrity. It surfaces protections that were already running silently - attack detection, the login-attempt log and the file integrity check - so you can watch attempts as they happen. Replaces Wordfence Premium ($119/yr)
- WAF tab - recent login attempts (last 30), top attackers by failed-login count (last 7d), blocked IPs table with manual block/unblock, one-click "Block this attacker" from the top-attackers list. KPIs at the top: failed logins (24h), unique IPs (7d), blocked count, FIM status
- Security Events tab - parses
logs/security.log- where blocked injection, cross-site scripting and path-traversal attempts are recorded - and shows a timeline with the address, the message and the context. The 30 most recent events are listed. - File Integrity tab - shows the install fingerprint, a verified-or-changed status pill, the last tamper report and a "Scan now" button that re-checks every core file. A short card tells you what to do if something has changed.
- Self-healing blocked_ips table - created automatically on first visit to the page. Idempotent: ON DUPLICATE KEY UPDATE preserves existing blocks. CSRF-protected admin operations throughout
- Sidebar link - new "Security Center" entry directly below Backups in the admin nav. Shield icon. Standard active-state highlighting
Smart Backup - Scheduled Daily Backups, Built-In
Added
- Smart Backup scheduled cron - turn on daily auto-backups in the admin (Backups → Smart Backup Schedule card). Pick the hour (default 03:00, low-traffic window). Cron runs
BackupManager::scheduledRun()which is idempotent (one backup per day, even if cron fires multiple times). Replaces UpdraftPlus Premium ($70/yr) - Retention policy - configurable 7-365 days. Auto-backups older than the cutoff are deleted automatically after the daily run. Manual backups are never auto-deleted. Storage stays bounded
- Pure-PHP backups - no
mysqldumpdependency (Hostinger and shared hosts often disable it). Streaming row-by-row dump handles large post tables without exhausting memory. Output is a single ZIP withdb.sql+uploads/+manifest.json - External sync hint - the schedule card documents the recommended
rclonepattern for syncing thebackups/folder to S3, Google Drive, or Dropbox. Native cloud SDK support is on the v2.6.x roadmap
Schema Studio - 13 Schema.org Types, Built-In
Added
- Schema Studio plugin family - 13 Schema.org types, all driven from the post editor with form-based UI. The full set: Article, BlogPosting, NewsArticle, TechArticle, ScholarlyArticle, Report, FAQPage, HowTo, Product, Event, Review, Course, Recipe (new), and LocalBusiness (new). Replaces Rank Math Pro's schema-builder module ($59/yr) - no subscription, no add-ons
- Recipe schema - food bloggers can now ship Google Rich Recipe cards: prep/cook/total time (ISO 8601), yield, category, cuisine, calories, ingredient list, step-by-step instructions, aggregate rating. Drives 30-40% CTR uplift on recipe-intent queries
- LocalBusiness schema - drives Google Maps + local-pack ranking. 18 business subtypes (Restaurant, Store, MedicalBusiness, Dentist, BeautySalon, TravelAgency, …). Full PostalAddress + GeoCoordinates + opening hours + price range + aggregate rating
- CSV-style data entry - ingredients, instructions and opening-hours all accept one item per line in a textarea. No fragile JavaScript arrays, no clicking +/- buttons; copy-paste works directly from your notes
- Schema preview + Google Rich Results Test link - the editor shows the live JSON-LD payload AND a one-click handoff to Google's validator. Zero guesswork
ZeroTrack Analytics - Privacy-First, Cookie-Free, Built-In
Added
- ZeroTrack Analytics plugin - a built-in, privacy-first replacement for Google Analytics, Plausible and Matomo. Zero cookies. Visitor data never leaves your server. KVKK/GDPR-compliant by design: IP addresses are SHA-256 hashed with a daily-rotated salt, making cross-day correlation mathematically impossible. Auto-activated on install
- Privacy dashboard in admin → ZeroTrack: page views, unique visitors, sessions, bounce rate, daily trend chart, top pages, referrers, countries, devices, UTM sources. Date range selector (today / 7d / 30d / 90d)
- Smart filtering out of the box - respects browsers' Do-Not-Track header; excludes logged-in admins; filters Googlebot, GPTBot, ClaudeBot, headless Chrome and 20+ other automation user-agents; configurable IP and path exclusions
- Reverse-proxy aware - picks up the real visitor IP behind Cloudflare and LiteSpeed (no double-counting your CDN). Country detection via Cloudflare CF-IPCountry header - no third-party GeoIP database needed
- Self-cleaning - raw pageview rows are deleted after a configurable retention window (default 90 days). Daily aggregates are kept forever for long-term trend analysis with tiny storage footprint
Sharper Homepage Hero - A Concrete Hook
Improved
- The hero now says what jekcms actually is - the vague "Smart Next-Gen CMS" line was replaced with a concrete, provable hook: everything you would normally add to WordPress (SEO, internal linking, AVIF media, bulk import, AI publishing) is already in the core, self-hosted, with no plugin stack to buy or maintain. One clear message instead of a buzzword
Newsletter Email: Branded Dark Header
Improved
- Email design now has a real branded identity - the previous version rendered too plain in clients that strip CSS backgrounds. The header is now a solid dark band with the brand wordmark and an accent eyebrow, plus a thin accent rule under it, a card frame, and a tinted footer band. Backgrounds use both inline CSS and
bgcolorattributes so the design survives in Gmail/Outlook. Auto-applied to system templates via a schema bump
Redesigned Newsletter Email Templates
Improved
- Professional, brand-consistent email templates - the newsletter emails (confirmation, welcome, campaign, unsubscribe, new-post) were replaced with a polished, English, email-safe design: a clean white card on a soft background, branded header with an accent eyebrow, strong typographic hierarchy, a proper rounded brand CTA button, and a complete footer (unsubscribe, website, copyright). Table-based + inline CSS for reliable rendering across email clients; all placeholders preserved
- Auto-applied across all installs via a plugin schema-version bump - system templates refresh automatically on the next load, while any template you customized is left untouched
Blog Editor: Featured Post & Empty-Content Fix
Fixed
- Blog post editor opened empty for the featured post - the editor treated
?id=0(the featured post, which carries id 0) as "new post" because of aid > 0check, so it never loaded it. It now loads any post when an id is present (0 included); a truly new post is one with no id parameter. Additionally, if a row's body is empty (legacy posts whose content lived only in the static blog data file), the editor pre-fills the form from that source by slug/id for review - saving persists it into the database (display-only, non-destructive, never overwrites existing edits)
Plugin System Restored on the Main Install (Newsletter Now Lists)
Fixed
- Newsletter (and all plugins) now appear in the plugin manager - the main install's bootstrap (cloned long ago from an older codebase) was entirely missing the plugin-loader block, so the plugin registrar never ran and no plugin could register itself. The block was restored, identical to the canonical source; the registrar now runs (with the self-healing plugin-table schema), so Newsletter registers automatically and is listed/activatable
Marketing Blog Editor Now Reachable in Admin
Fixed
- Blog posts are editable again - the bilingual marketing blog (the EN/TR posts shown on jekcms.com/blog) has its own admin editor that reads the same table the public blog uses, but it had no link in the admin menu, so it looked like the posts weren't manageable (the CMS Posts page only lists the separate site-content table). A "Blog Posts (jekcms.com)" entry was added to the admin sidebar - the existing posts are now listed and editable
Wizard Network Error, Profiles & Plugin Registration Fixed
Fixed
- "Network error" on Generate fixed - the wizard's generate step was missing on most installs, so the button failed with a network error. It now ships with every install and works on every site.
- Plugins now register on cloned installs - on installs cloned from an older database the
pluginstable could be missing newer columns, which made plugin registration fail silently - so the Newsletter plugin never appeared in the plugin manager. The scanner now self-heals the table schema, so Newsletter (and any new plugin) registers and is visible/activatable
Root Admin Fixes - Content Fixer, Newsletter Link, Wizard Keys
Fixed
- Content Fixer 404 fixed - the SEO Optimizer's Content/Heading Fixer page existed in the canonical source but was missing from the main install's admin, returning 404. It is now present
- Newsletter admin link corrected - the Newsletter plugin manifest pointed its admin page to a non-existent path; corrected so the dashboard opens from the plugin manager (the sidebar entry still requires the plugin to be activated)
- Wizard keys fixed on the main site too - the previous translation-key parity fix covered demo sites but missed the main install;
cq_assistant_*keys are now mirrored there as well, so the JSON Generation Wizard no longer shows raw keys
Content Queue Wizard - Raw Keys Fixed on All Sites
Fixed
- JSON Generation Wizard now reads properly on every site - the content-queue assistant translation keys (
cq_assistant_*) existed only on a couple of sites, so other sites showed raw keys like "cq_assistant_title" instead of labels. All sites now carry the full key set, mirrored byte-for-byte from the canonical source
Newsletter Signup Live on the Marketing Site
Fixed
- Newsletter subscription now works on jekcms.com - the footer "Subscribe" form was built but silently failed when the subscriber table did not exist. The handler now self-creates the table (idempotent, identical schema to the Newsletter plugin, so the plugin admin reads the same subscribers). Homepage stat figures also unified site-wide
Sub-Page SEO Audit - Documentation Title Fixed
Improved
- Documentation title is now descriptive & branded - the docs
was a bare "Documentation"; it is now "jekcms Documentation | Setup, Admin Guide, REST API & Automation" (and category/page docs titles now carry the brand). Stronger, unique titles for search - Full sub-page meta/SEO audit: every marketing sub-page verified to have a unique, bilingual (EN/TR) meta title and description, valid canonical + hreflang (en/tr/x-default) + Open Graph; no missing, empty or duplicate meta found
Accurate WordPress-Alternative Page (Verified Features Only)
Improved
- Stronger, honest "why jekcms vs WordPress" page - now built strictly from verified features: it maps the paid WordPress plugins jekcms replaces in its core (SEO/Yoast, internal linking/LinkWhisper, broken-link detection, AVIF media/ShortPixel, security/Wordfence, payments/WooCommerce), plus jekcms-only JSON bulk import and n8n+Gemini AI automation. Modern, readable, theme-consistent table; long-tail keyword focused; FAQ with FAQPage structured data
Fixed
- Removed an inaccurate capability claim - a "multi-site / fleet management" line was wrongly added to the comparison page, structured data and llms.txt. jekcms has no such product feature; it has been removed everywhere and replaced with verified, real capabilities only
No Orphan Pages - Full Internal Linking
Fixed
- No orphan pages - every public marketing page is now reachable via the footer + sitemap + clean URL with EN/TR variants. The "Report Piracy" page was orphaned (no link anywhere) and is now footer-linked and crawlable; the WordPress-alternative page was already footer-linked (verified)
AI-Search Visibility & WordPress-Alternative Positioning
Added
- WordPress Alternative comparison page - a new, honest
/wordpress-alternative(TR:/tr/wordpress-alternatifi) page with a factual jekcms-vs-WordPress table and FAQ (FAQPage structured data), sitemap + hreflang + footer-linked - llms.txt - a machine-readable summary at
/llms.txtso AI assistants can accurately describe jekcms as a self-hosted CMS / WordPress alternative
Improved
- Discoverable in AI search - AI answer/search engines (ChatGPT, Perplexity, Gemini, Claude, Copilot) are now explicitly allowed (server-level block removed for them; named robots groups added). Low-value SEO-scraper bots stay blocked
- Clearer entity for search & AI - structured data now classifies jekcms as a Content Management System with a precise CMS / WordPress-alternative description and feature list; site meta sharpened to say "self-hosted CMS / WordPress alternative" (factual, no keyword stuffing)
Marketing-Site SEO Hardening
Improved
- No duplicate page URLs - direct
.phphits (e.g./features.php) now 301-redirect to the clean URL (/features), so each page has a single indexable address and a single canonical - Single redirect hop -
http://wwwnow goes straight tohttps://non-www in one 301 instead of two chained redirects (faster, stronger SEO signal) - Audited & confirmed correct: error pages return real 404 (no soft-404, noindex), dynamic robots.txt with environment-aware sitemap, bilingual sitemap with hreflang, self-referencing canonical + en/tr/x-default hreflang,
?lang=tr→/tr/…301
Article Rendering & Internal-Link Integrity Fixes
Fixed
- Broken internal links repaired at the source - The auto internal linker could run over raw Markdown and inject a link inside a Markdown link, which the renderer then turned into corrupted, half-visible anchor markup. Markdown links/images are now protected, so internal linking can never mangle content again. The link cleaner was also hardened to fully remove any pre-existing corrupted/leaked link debris - re-running the internal-link scan on an affected site now self-heals old content
- Checklists render properly - Markdown task lists (
- [ ]/- [x]) now show real checkbox glyphs instead of literal "[ ]" text - Tables are styled - Markdown tables in articles now render with borders, padding and header styling instead of columns running together
- No more double bullets - list items showed both a default bullet and a custom marker; the duplicate is gone
- Related posts fixed - the related section rendered twice, once as full-width stacked images; the broken duplicate was removed, leaving the clean card grid
- Featured image aspect ratio - single-post cover images now use a proper 16:9 frame instead of a cropped near-square
- Table of contents shows accented characters correctly - the on-page contents list double-escaped HTML entities, showing things like "Güncel" instead of "Güncel"; titles are now decoded before display (anchors stay in sync)
- Front-end fixes now go live immediately - deploys purge the page cache, so a fix is no longer masked by up-to-5-minutes of stale cached HTML
JSON Wizard Rename & Calendar Visibility Fix
Improved
- "Content Assistant" renamed to "JSON Generation Wizard" - name now reflects what it actually does: builds a ready-to-import JSON + prompt
- "Continue below" marker is now built-in - typing
{devam}in a post renders a centred "content continues below" button that smooth-scrolls to the next section. It now lives in the core renderer (theme-independent), so theme resets can no longer wipe it - Checklist fix also covers articles already stored as HTML, not just Markdown
Fixed
- Content calendar fixed - schedule is visible again - On some installs the whole calendar silently came back empty: the underlying query referenced a column that older content-queue tables never had, so it failed and showed nothing. The query is now schema-independent and self-healing, and the month view also shows every scheduled item regardless of its state (draft / approved / in-progress / done), colour-coded by status
- Calendar hover preview used the wrong image field in one branch - corrected
Get your site live
The setup wizard gets a site live in about 30 minutes. See the prices and the free edition.
View Pricing- Setup and live in 30 minutes
- 15 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO - Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)