Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 4 of 20 — 576 releases, newest first.
Audit hardening: recipe filters, reaction schema, webhook brakes
Improved
- Membership payment bridge (released earlier today) hardened after an adversarial pass: unverified webhook requests can no longer grow the database or log files (flood brake), the delivery log rotates itself, and Stripe checkouts completed with a free trial or a 100% discount now correctly open Premium.
Fixed
- Recipes theme: the archive's time and difficulty filters (and the "quickest" sort) now actually work — they queried post columns that never existed, so every filtered visit logged a database error and returned nothing. Filters now read the Recipe plugin's real data.
- Post reactions: installations carrying the old reaction table layout repair themselves on first use — previously every post view on such a site logged a database error and reaction counts stayed frozen. Existing reactions are preserved during the repair.
- Recipes theme: posts without recipe data no longer show invented "15 min prep · 30 min cook · 4 servings · easy" badges — the badges now read the Recipe plugin's real values and simply stay hidden when there are none.
Membership payment bridge: automatic Premium via Stripe / Lemon Squeezy webhooks
Added
- Paid memberships no longer need manual bookkeeping: connect your own Stripe or Lemon Squeezy account's webhook to your site and members are marked Premium the moment their payment completes — and downgraded automatically on full refunds and subscription expiry. Matching uses the member's registration e-mail, and the provider's customer reference is remembered so subscription-end events match even when they carry no e-mail.
- Set-up lives in Settings under the membership section: paste the signing secret, copy the ready-made webhook address, and watch the "last webhook" line confirm deliveries. Secrets are stored encrypted, never echoed back into the form, and every notification is verified against its signature — unsigned or tampered requests are rejected. Money still flows entirely through your own provider account: jekcms never sees card data.
Migrate from Medium and Blogger + new Security & Trust pages
Added
- Migrate from Medium: upload the ZIP from Medium's "Download your information" as-is and your stories arrive with their full body, subtitle (kept as the excerpt), publish date and URL slug — drafts stay drafts, and re-running the import safely skips what is already there. With image localization on, Medium-hosted images are pulled into your media library and converted to AVIF/WebP.
- Migrate from Blogger: upload the XML backup from Blogger's "Back up content" (a Google Takeout ZIP works too) and posts, pages and drafts import with their labels mapped to tags, publish dates and URL slugs preserved. Settings and comment entries in the backup are recognized and left out instead of turning into broken posts.
- jekcms.com now has a Security page listing the concrete protections in the product — two-factor sign-in, Argon2id password hashing, encrypted stored secrets, signed webhooks, update integrity checks — plus a responsible-disclosure channel, and a Trust Center explaining data ownership, the perpetual license model and our honesty principles. Both pages exist in English and Turkish.
Improved
- The API reference now documents all five outgoing webhook events — new-comment and new-member notifications had shipped earlier but were missing from the docs, so integrations could not discover them.
SEO core: multilingual sitemap discovery + consistency fixes
Added
- Multilingual sites are now fully discoverable: the posts sitemap lists published posts in EVERY public language (previously only the site language, which left translated posts — and any post in another language without a pair — invisible to crawlers), and translation pairs are announced with xhtml:link hreflang alternates including x-default, the format Google recommends.
Fixed
- Category and tag sitemap entries no longer count future-dated scheduled-style posts: that mismatch could announce an archive in the sitemap while the page itself said noindex (a "submitted but noindex" contradiction in Search Console) and could even emit a future lastmod date.
- A parent category whose posts all live in child categories is now announced in the sitemap index consistently with the category sitemap itself.
- Posts embedding YouTube via iframe embed URLs now get VideoObject structured data on the page, matching what the video sitemap already announced.
- /feed.xml and /rss.xml now 301-redirect to the canonical /feed instead of serving duplicate copies of the feed.
- The installer's sample welcome post is now marked noindex — identical text across thousands of installs should not enter search indexes, and deleting it leaves no index residue.
First-install experience polish + plugin management fix
Added
- New sites start friendlier: the installer now localizes the default category to your site language (Genel/General instead of "Uncategorized") and seeds an editable welcome post with first-step tips — so the homepage is alive from minute one instead of empty. WordPress migrations remove the sample post automatically once real content arrives.
- /rss now 301-redirects to the canonical /feed, so readers and tools typing the WordPress-style address no longer hit a 404.
Fixed
- Activating or deactivating a plugin from the admin panel works again: a token-name mismatch introduced by an earlier security hardening made every plugin toggle fail with "Invalid security token" on fresh installs. The page now validates the token explicitly, and the shared helper accepts both token field names so the same class of mismatch cannot recur.
Ad A/B, RUM and Critical CSS: measurement accuracy and hardening
Fixed
- Ad A/B click counting is now much more accurate: starting a scroll gesture on an ad box no longer registers as a click on touch devices, switching tabs while hovering an ad is no longer mistaken for an ad click, and an empty ad container (ad blocker or unfilled ad) no longer counts as an impression — so CTR comparisons between variants reflect real behavior.
- The Ad A/B panel no longer shows "Test ACTIVE" when the ad slot itself is disabled (which silently produced zero data); it now shows a clear "slot disabled" warning. Variant changes also flush the full-page cache immediately, so old variants stop being served the moment you edit the test.
- RUM now records a perfect CLS score of 0 correctly. Previously only visits with some layout shift were counted, which made the CLS p75 look worse than reality; browsers without layout-shift support are recorded as "no data" instead of a fake perfect score.
- Posts whose slug merely starts with "ara", "api" or "admin" (e.g. /araba-bakimi, /api-design) are no longer misclassified in RUM page types or silently excluded from analytics collection.
- Critical CSS extraction keeps more valid selectors: :is()/:not() lists with commas, escaped class names and non-ASCII class names are no longer dropped (which could cause a brief unstyled flash), a stylesheet link inside an HTML comment can no longer confuse the transform, and a single unusually small page can no longer permanently disable critical CSS for the whole site.
Critical CSS: inline above-the-fold styles with async theme stylesheets
Added
- Pages now render faster: the CSS needed for the visible part of the page is inlined into the document head, and the theme's full stylesheets load asynchronously in the background (with a no-JavaScript fallback). This removes render-blocking CSS from the critical path and improves LCP and FCP.
- The critical subset is generated automatically per theme from your site's real pages — no configuration, no theme edits, and it refreshes itself whenever the theme's CSS changes. Works on every theme.
- Built-in safety rails: if the generated subset looks too small or too large, the page is served exactly as before; original stylesheet links are kept in a noscript fallback; and the feature can be switched off from the Performance panel (the RUM p75 numbers there will show you the effect).
Performance (RUM): real-visitor Core Web Vitals panel
Added
- A new Performance panel shows how fast your site really is for visitors: LCP, CLS, INP, FCP and TTFB are collected from real page views and reported as 75th-percentile values — the same method Google uses for Core Web Vitals — overall, by device, by page type, and as a "slowest pages" list that tells you exactly where optimization pays off.
- The collector is a tiny inline script (no external CDN, no cookies) that sends a single measurement as the visitor leaves the page. It respects Do Not Track, skips logged-in users and bots, and works on every theme.
- Privacy-first by design: only the page path, the metric values and a coarse device class are stored — no IP address, no session, no fingerprint. Collection can be switched off in the panel, and the switch is enforced on the server, not just in the page.
- Data is kept for 90 days and old rows are cleaned up automatically.
Ad A/B testing: placement and size variants with impression/click measurement
Added
- Ad slots can now run A/B tests: define two or more code variants (different sizes, formats or layouts) for any slot under Ads → Ad A/B Testing, with per-variant traffic weights. Each visitor gets a sticky, cookieless variant assignment, so the same person always sees the same variant.
- Impressions (counted when the ad is at least half visible) and clicks are now measured per variant, with bots filtered out. The panel shows 30-day impressions, clicks and CTR per variant, plus an estimated revenue column driven by a manually entered RPM.
- The variant is chosen in the browser, so full-page caching keeps working at full speed — the cached HTML is identical for every visitor and no cache page needs to be bypassed for the test.
- A lightweight standalone beacon endpoint records the events: it accepts only same-site requests, validates that the reported variant belongs to the reported slot, rate-limits per visitor, and stores only a salted daily hash — never the raw IP address.
Link health checker: SSRF hardening
Security
- The outbound link-health checker (used by SEO and affiliate link monitoring) now validates the FINAL connection address, not just the originally saved URL: if a link redirects or its DNS resolves to an internal or cloud-metadata address (localhost, 127.x, 169.254.169.254, private ranges, IPv6 loopback/ULA), the probe reports it as unverifiable instead of revealing the internal service's status. This closes a server-side request forgery (SSRF) avenue where a crafted redirect could have been used to probe internal infrastructure.
- Literal IPv6 URLs (e.g. http://[::1]/) are now correctly recognized and blocked by the safety gate.
Affiliate + Search Console Insights: reliability hardening
Security
- Hardened the affiliate link-health monitor against SSRF: a target pointing at an internal or cloud-metadata address (localhost, 169.254.169.254, private ranges) is no longer added to server-side health probing.
Fixed
- Search Console Insights no longer shows misleading trends when Google's API partially fails: if any part of a scheduled fetch errors out, the previous snapshot is kept and a retry is scheduled, instead of rebuilding the panel from incomplete data (which could have made every page look like it was rising or falling).
- Insights comparison windows are now exact 28-day / previous-28-day ranges (ending yesterday, since today's data is always incomplete), so the totals and the per-page changes always agree.
- Scheduled Search Console fetches now backfill any gap since the last successful run and are protected against overlapping runs, so a slow day or a missed cron no longer leaves holes in the daily trend.
- Affiliate links keep working when a link is paused: a paused link's existing in-content links and /go/ clicks still resolve (pausing only removes it from new auto-cloaking) — previously a paused link 404'd and its [aff] shortcode vanished from the post.
- An [aff] shortcode with a slug that no longer exists now preserves your custom anchor text as plain words instead of deleting it from the sentence.
- Affiliate targets are validated harder on save: over-length URLs (which MySQL would silently truncate) and links that point back at your own /go/ cloak (a redirect loop) are now rejected with a clear error.
Affiliate + Search Console Insights: polish and fixes
Improved
- Small polish: the Search Console Insights "new" badge is now localized for English sites, the affiliate panel and schema check are lighter (one fewer query per request), and a couple of dead code paths were removed.
Fixed
- Affiliate cloak links now use only temporary redirects (302/307): a permanent 301 could be cached indefinitely by browsers and CDNs, which would stop counting clicks and prevent you from repointing a link — the two things the feature is for. Any existing 301 link is served as 302 from now on.
- Affiliate targets containing control characters (a pasted URL with hidden line breaks) are now rejected on save instead of producing a broken, destination-less redirect.
- Auto-cloak matching now lowercases only the host, not the path — case-sensitive affiliate paths (e.g. Amazon product IDs) can no longer collide and cloak a link to the wrong destination.
Affiliate Links: a new revenue channel
Added
- New "Affiliate Links" plugin to manage affiliate and outbound links in one place — a new revenue channel alongside ads. Each link gets a clean cloaked URL (yoursite.com/go/slug) that records the click server-side (bot-filtered, privacy-safe: no raw IP stored) and redirects to the target, so you can rename, disable or repoint a link without touching any post.
- Automatic SEO safety: a content filter adds rel="sponsored nofollow noopener" to affiliate links (Google requires "sponsored" for paid links, and the wrong markup can cost you rankings) and can auto-nofollow all other outbound links. It can also auto-cloak any raw link in your content whose destination you've registered — existing posts are covered without editing them.
- Drop a tracked link anywhere with [aff slug] (uses the link's name as anchor) or [aff slug]custom text[/aff]. Code blocks are left untouched.
- A dashboard shows clicks per link (human vs bot separated), a 30-day click trend, and link status. Dead affiliate targets surface in the existing SEO → Broken Links checker, so you catch expired offers before they cost you.
Search Console Insights: data-driven SEO
Added
- New "Insights" tab in Google Console that turns your real Search Console history into an action list — no more guessing which post to update. It keeps a daily history (previously the panel only showed a live snapshot) and every day highlights: Declining pages (clicks dropped ≥30% — top refresh priority), Striking-distance keywords (ranking 8–20 with high impressions — a small push lands them on page one), Keyword cannibalization (multiple pages competing for the same query), and Rising pages (what's working — make more like them).
- Each page row links straight to the post editor, so you go from "this is declining" to editing it in one click.
- The history is fetched automatically once a day in the background; a "Fetch now" button pulls it on demand. Insights keep showing even if the Google connection later expires (your history stays valuable), with a clear "reconnect to keep updating" notice.
- Built entirely on the existing Google connection — no new setup, no extra permissions. Reuses the same one-click OAuth and encrypted token storage.
Advanced SEO: second deep pass (contracts + content-torture)
Improved
- On installs without the Advanced SEO plugin (or with it disabled), the SEO Overview page now shows a "More SEO tools" strip linking Heading Fixer, Auto Internal Links, Featured Images, Orphan Content, Year Updater, Slug Repair and the redirect manager — previously those shipped but were unreachable.
- The auto-linker progress log is now fully bilingual for English admins.
- The two SEO score engines (editor dial vs SEO panel) now use the same title/description length thresholds, so a post no longer shows two different scores in the two places.
- Meta text truncation is multibyte-safe (an em-dash at the cut boundary can no longer produce a broken character), and the AI image generator now stores featured images as an uploads-relative path so size variants and AVIF/WebP negotiation work and no dev URL leaks into social cards or the sitemap.
- The auto-link ledger is no longer age-pruned, so posts linked months ago don't revert to "orphan" and get a duplicate link.
Fixed
- The editor's "Canonical URL", "OG Title/Description" and "Twitter Title/Description" fields now actually take effect on the live page — they were saved and shown in the admin preview but no theme ever emitted them, so republished/syndicated posts could not point search engines at the original source and social cards ignored your custom titles.
- Auto-generated focus keywords are Turkish-correct: a title containing İ (İstanbul, İş…) no longer produces a keyword with an invisible combining character that failed the analyzer's own "keyword in title" check and silently cost score points.
- The image alt-text fixer no longer corrupts alt values containing a dollar sign (deal/price titles) and no longer stamps the wrong description onto a different image whose filename ends with the same name ("a.jpg" vs "data-a.jpg"); it also stops mistaking a "data-alt" attribute for a real alt.
- Heading Fixer and Content Optimizer now leave headings inside HTML comments and code samples untouched, so a commented-out heading can no longer skew the fix and code examples are never rewritten.
- Renaming a post's slug and then renaming it back no longer creates an infinite redirect loop that made the post unreachable (the same loop-hygiene the year tool already had is now in the core rename path and slug-repair tool).
- SEO CSV import now maps columns by their header names instead of fixed positions, so a file built from the on-screen help no longer writes values into the wrong fields; it enforces the character limits, only touches non-empty cells (an empty cell no longer erases an existing value), validates robots/schema values, recomputes the score, and reports per-row errors.
- SEO Health Check no longer hides real "missing core file" errors as "could not be measured" when the site can't reach itself, and it no longer pulls the entire post corpus into memory when scanning for numbered lists.
- Redirect targets keep their query string, and a legacy protocol-relative redirect can no longer become an open redirect on the marketing site.
- SERP Identity Check reads values containing an apostrophe correctly ("Maggie's Kitchen" no longer reports a false mismatch).
Advanced SEO panel: deep audit of all 16 tools
Improved
- SEO Health Check is faster and more honest: on hosts where the site cannot reach itself it stops after one connection attempt instead of blocking for a minute, marks the affected checks as "could not be measured" instead of inventing phantom schema errors, and category/author/content-quality counts now use the same visibility rules as the real sitemap.
- SERP Identity Check never certifies "clean" when the live chain could not be measured, failing checks now show the expected-vs-actual values, and its HTML parsing tolerates attribute order and single quotes (fewer false alarms with custom themes).
- Generated image alt text is Turkish-aware (İstanbul stays İstanbul), media-library fallbacks no longer keep the file extension, and the alt fixer no longer produces a duplicate alt attribute when the image tag lists alt before src.
- The SEO tools' heavy statistics scans now run only on the tabs that display them, making the other tabs noticeably faster on large sites.
Fixed
- Heading Fixer no longer flattens sub-headings: content starting at H3 keeps its H4/H5 structure when shifted up (previously every heading could end up as H2, which also broke theme-generated tables of contents).
- "Send All Posts to IndexNow" now submits only publicly visible, indexable posts — member-only, private and noindex posts are excluded from the batch and from the counter.
- The single-post "Fix" button on the Content SEO tab now fills only the missing meta fields, matching "Fix All" — a hand-written meta title is no longer replaced when only the description was missing.
- The inline meta editor caps titles and descriptions at the real database budget (70/160 characters), so very long entries save cleanly instead of failing with a generic error.
- "Ping Sitemap" reports the real result: the retired Google/Bing ping endpoints no longer produce a false green success — the button now submits the sitemap via IndexNow and shows what actually happened.
- Slug Repair keeps its promise: repaired slugs now create automatic 301 redirects, only genuinely broken slugs are touched by default (hand-tuned slugs stay), and a new opt-in mode regenerates everything from titles when you really want that.
- Year Updater now also updates the SEO title used in Google results (previously only the on-page heading changed while the search snippet kept the old year), and running it back and forth can no longer create redirect loops.
- Redirect manager refuses rules that would loop (A→B while B→A exists, or a redirect pointing at itself via the full site URL) — these previously took the page down with an endless redirect.
- The "fix old URLs" scanner and fixer now share one pattern list built from your own site address, so the banner count and the actual fix always agree (the fixer previously used a stale fixed list and fixed nothing on most sites).
- Batch scans (strip links, fix URLs) use cursor paging so a row the transform cannot change no longer makes the progress loop run forever.
- Auto-linker and Orphan Content now handle Turkish İ/ı correctly — titles containing İ (İstanbul, İş...) can finally receive automatic internal links — and only publicly visible posts are suggested or linked.
- Content Optimizer preserves code blocks: cleanup no longer collapses indentation inside pre/code samples, keeps intentionally empty anchor/placeholder elements, and "reset" no longer deletes the content backups that make revert possible.
- Several admin listing screens in the SEO tools now escape post titles and scan results before rendering, and a few tool endpoints that write content are now administrator-only.
Post SEO analyzer: accuracy fixes and new checks
Improved
- Two new writing checks in the SEO analyzer: a transition-word check (are your sentences connected for flow?) and a long-section check (a stretch of 300+ words with no subheading is now suggested for a subheading) — both work in Turkish and English.
Fixed
- The live SEO score now judges the title by its full rendered length (your title plus the " | Site Name" the theme adds), so a title that looked fine but gets cut off in Google is now flagged — and the SERP preview's length number matches what is actually shown.
- Internal vs external link counting is corrected: a protocol-relative link to another site ("//example.com/…") is no longer miscounted as an internal link.
Migration/import and support module hardening
Improved
- The WordPress migrator plugin (for exporting a WordPress site) now writes its export into a private, per-run randomized folder and deletes the intermediate data files right after packaging, so an export can't be pulled from a predictable URL on servers where directory rules aren't enforced.
Fixed
- Imported content from every WordPress path (CSV, package and REST) now passes through the same content-cleaning step the editor uses, so a hand-edited export or a compromised source site can no longer smuggle active markup into your published posts.
- The REST and wizard migration tools are now administrator-only (they create posts and users and fetch remote content), and the wizard's per-post import step now requires a valid security token — matching the rest of the admin panel.
- Imported posts with an unknown status now land as drafts (in the review queue) instead of going straight live.
- Support ticket attachments can be downloaded again — the download link pointed at a page that did not exist, so staff could attach files but never open them; downloads are now served admin-only through a path-checked handler.
- Support ticket status and priority updates are validated against the allowed set, and the average-resolution-time metric now uses the real resolved/closed timestamps.
SEO plugins audit: social, distribution, Google, recipe
Improved
- Hardening across the SEO surface: social share links now use the canonical URL (so shared and syndicated links never point at a redirect), recipe structured-data text fields are stripped to plain text as Google expects, the browser-push subscribe endpoint is restricted to real push services (SSRF hardening) with a proper per-IP rate limit, and shipped recipe/quiz scripts and push fallback text no longer leak Turkish onto English sites.
Fixed
- Auto-publishing to social networks no longer broadcasts private, members-only, paid or password-protected posts — only fully public posts are shared, and a gated post's social description can never fall back to its full body (which also protected the Dev.to/Hashnode full-body syndication).
- The Google panel's GA4 / Tag Manager / AdSense settings actually take effect now — they were wired to a hook the themes never call, so enabling analytics in that panel injected nothing. They now flow through the site's single, consent-aware analytics injector, so there is one tag set (no double-counting) and cookie-consent is respected.
- The IndexNow "ping on publish" switch is now a real switch — instant indexing could not actually be turned off before, and the panel's "last submit" status was always blank; it now reflects real submissions.
Quiz plugin: premium polish and reliability
Improved
- Result sharing is steadier: X, WhatsApp and Facebook buttons always appear (previously the whole share row vanished on some browsers), a native share sheet is offered on mobile, and copy-link stays where the clipboard is available.
- Keyboard support: press 1–9 to pick an answer and Enter to advance — faster and more accessible play.
- The public play endpoints are now rate-limited against flooding, the instant-feedback endpoint too, and answer keys are returned only for the questions actually answered (no leaking a whole question bank).
- Completion IP addresses in the stats screen are now masked for privacy, and the standalone quiz page no longer shows its title twice.
Fixed
- Embedded quizzes could render with no styling and never start on themes that build a table of contents (they parse the post twice) — the quiz's stylesheet and script are now emitted on every embed, so quizzes always work wherever [quiz] is placed.
- The question/answer image picker stored an absolute URL that the front-end then prefixed again, producing broken images; picked images are now stored correctly and existing broken paths are healed automatically.
- Deleting a quiz now removes its questions, answers, result bands and play records instead of leaving them orphaned, and editing a quiz no longer accumulates dead answer rows; a one-time cleanup clears any leftovers on upgrade.
- Typing a slug that already belongs to another quiz no longer errors and loses your edit — it is made unique automatically.
- Personality quizzes ignore the question-bank subset setting so every result band stays reachable and two identical answer sets always give the same result.
Theme customizer: numeric dropdowns now save correctly
Fixed
- In the theme customizer, dropdown fields whose choices are numbers (for example the Recipes and Travel themes' "Grid columns" 2/3/4 selector) silently reverted to the default whenever you picked a different value — the saved value now sticks. every theme' customizer fields were verified end to end (513 fields across colors, fonts, ranges, toggles, selects, code and image inputs) and theme switching, preview and one-click rollback were confirmed to keep a single clean settings row.
Newer-plugin audit: audience, editorial, edge & forms
Improved
- The editorial kanban board now supports real drag & drop between stages (the card's owner, date and note are preserved), overdue due-dates are highlighted, and editors — not just administrators — can use the board; plugin shortcuts in the admin sidebar are shown only to roles that can open them.
- CRM quality-of-life: a per-contact delete button (for erasure requests), segments show how many members are actually e-mailable, the contact list says when it is truncated, and the activity timeline no longer mixes in other people's form submissions for addresses containing wildcard characters.
- A/B tests: editing, activating or deleting an experiment now clears the page cache immediately (a just-activated test could look dead for the cache lifetime), the winner trophy waits for a sufficient sample, and equal conversion rates are compared exactly.
- Digital downloads and form autoresponders now throttle outgoing e-mail per recipient/site-wide, form values have a sane length cap, and the Cloudflare panel explains that HTML is only edge-cached if you add a Cache Rule.
Fixed
- Audience (CRM): unsubscribed and bounced newsletter contacts are no longer pulled into the audience or its CSV export, the export now carries a newsletter-consent column and streams any list size, contacts deleted at their source are removed on the next refresh, and the audience is refreshed automatically right before a segment broadcast so late subscribers are included.
- Editorial calendar: scheduled posts now actually appear on the calendar on their scheduled day (they were invisible before), a post set to pending elsewhere shows in the Review column, moving a card can no longer race a simultaneous publish, and permanently deleting a post cleans up its planning card.
- Web push: the plugin's settings no longer share storage keys with other plugins (toggling ZeroTrack could silently switch push off and vice versa — existing settings migrate automatically and VAPID keys are preserved so subscribers stay valid), the click counter only accepts clicks for real recent broadcasts with sane limits, and clearly-rejected fake subscriptions are pruned faster.
- Cloudflare: turning "I'm Under Attack" on now reports an error if the API call failed instead of a false success, edge cache purges no longer block post/settings saves (they are queued and sent once per request, also removing duplicate purge calls), scheduled posts published by a real system cron now purge the edge too, and a failed reconnect no longer leaves the panel in a half-connected demo state.
- Analytics real-IP: on sites directly behind Cloudflare, visitor IPs are now resolved from the edge header (validated against Cloudflare's official ranges), so unique-visitor counts, IP exclusions and the flood limiter work correctly instead of collapsing onto a handful of edge IPs.
- Form Builder: renaming a field's label no longer silently detaches historical submissions from their CSV/archive column (machine names are now persisted), field names can't collide with the hidden system fields, and forms embedded on cached pages no longer double-submit with a failed first attempt.
API authorization & content hardening
Fixed
- The automation/REST API now enforces the same role permissions everywhere: creating or deleting posts through the webhook endpoints, and managing categories, tags or comment moderation, now require the proper role — previously any valid API token could do these regardless of the account's role.
- Automation endpoints can no longer edit or delete another author's post, reassign a post's author, or save unsanitized HTML through the bulk publish/import paths (which could inject scripts) — ownership, byline and content cleaning now apply on those paths too.
- The bulk AI analysis job (which sends every post to the AI provider) now requires an administrator, and the per-post AI analysis is rate-limited, so a lower-privileged account can't burn through the site's AI key or quota.
- Search result pages on three themes now count matches the same way the list is built, so the pagination total is accurate and no empty "phantom" pages are produced.
- The marketing newsletter sign-up rate limit is now server-side (it could previously be reset by clearing cookies), the blog RSS feed pins its URLs to the real domain, and a saved post with an unparseable status value defaults safely instead of erroring.
Concurrency, scale & integrity deep-audit
Fixed
- A scheduled post is now published exactly once even if two schedulers happen to run at the same moment, so it can no longer fire duplicate auto-shares, duplicate newsletter sends or duplicate push notifications.
- Deleting a category through the API now refuses when posts are still attached (matching the admin panel), instead of silently stripping those posts of their category.
- Newsletter open and click counts are now counted atomically, so inbox pre-fetching (Gmail/Apple Mail) can no longer inflate the numbers with duplicate counts.
- Comment threads with thousands of replies now build in milliseconds instead of seconds — the threading was rebuilt to scale linearly.
- Dates that can't be parsed (e.g. a malformed or empty value from an old import) now render as blank instead of "1 January 1970", and a post scheduled with an unparseable date is held as scheduled instead of quietly going live immediately.
- Hardening & cleanup: the analytics beacon now ignores spoofed forwarded-IP headers and is flood-limited; the A/B conversion link only counts same-site clicks; saving a site-wide OG image now requires an admin; permanently deleting a post cleans up its view/reaction/rating rows; and login-link tokens plus old newsletter queue rows are now pruned so they don't grow forever.
Search, ads, quiz & security sweep
Fixed
- Instant search now actually uses the fast full-text index instead of silently falling back to a slow full-table scan on every keystroke, and the endpoint is rate-limited so it can't be hammered.
- Device-targeted ads are no longer frozen across devices by the page cache: the cache now keeps a separate copy per device class, so mobile visitors get mobile ads and desktop visitors get desktop ads instead of whichever device loaded the page first.
- Members/paid posts no longer leak their in-body images and embedded videos through the image and video sitemaps — only genuinely public posts contribute body media there (the cover image still appears, as before).
- Two-factor setup now refuses to enable if the secret can't be stored encrypted, instead of quietly saving it in plain text.
- Deleting a media file that's still used in posts now warns you it was in use (so broken image links aren't a silent surprise), and the download store limits how often the same email address can be sent a link (stops link-spam to someone else's inbox).
- Contact/lead forms: the form-builder honeypot no longer uses a field name that browsers autofill, which was silently dropping some genuine submissions; the quiz block now prints its stylesheet/script once per page even with multiple quizzes.
Editor, cache & membership audit
Fixed
- Autosave no longer touches a published post's live body: while you edit a post that's already online, the background save keeps your draft in the revisions list instead of pushing half-finished edits to the live page — nothing goes public until you press Update. New pages also keep their type instead of turning into blog posts.
- Members/paid recipe posts now keep the ingredient list, steps and structured recipe data behind the paywall — the card, the FAQ and the page's recipe schema are shown only to signed-in members, matching how the article body is gated.
- The page cache now refreshes correctly when you trash or restore a post or add a redirect, so removed content and new redirects take effect immediately instead of lingering for the cache lifetime. Cookie-free visitors also always get the site's default language, ending a case where the first visitor's language could stick for others.
- Editor hardening: the button block now rejects javascript:/data: links like the other blocks, content saved by non-admin authors is cleaned server-side, the SEO panel escapes check text, and restoring a revision keeps your hand-picked URL instead of regenerating it from the title.
- Importing images from another site is bounded and hardened further — a per-image size ceiling, certificate verification, and a pinned resolved address stop an oversized or tampered image from stalling the import.
- Storefront: the checkout success page now shows the license key only in a short window right after payment (it's always in your email and portal too), and the update-check endpoint is rate-limited and no longer reflects arbitrary origins.
Full-session audit hardening
Fixed
- For members/paid posts, the page meta description, social share tags and RSS fallback now stay inside the free teaser, so the summary shown to search engines and shared links never draws on gated text.
- Importing images from Ghost/Substack is now SSRF-hardened: image URLs from the uploaded file are checked to be public addresses (internal/cloud-metadata hosts are refused), redirects aren't followed, and oversized images are skipped so one bad file can't stall the import.
- Outgoing webhooks are bounded so an unreachable endpoint can't slow down publishing; deliveries that don't fit the window are logged as deferred and can be re-sent, and a webhook is refused rather than created if its secret can't be stored securely.
- Editor links now reject javascript:/data: URLs like the other card blocks, the snippet endpoint always returns clean JSON, reaction counts are shown only for public posts, and fast double-clicks on a reaction no longer error.
Webhook delivery log & one-click re-send
Improved
- Each outgoing webhook now shows its recent deliveries right under it — the event, the response status (success or the exact HTTP error), and when it happened. If one failed because your endpoint was momentarily down, a single "Re-send" button replays that exact payload with a fresh signature. The log keeps the last 100 deliveries per webhook and never stores your signing secret.
Ghost/Substack import now brings your images too
Improved
- When you import from Ghost or Substack, the images in your posts (and each post's cover) are now pulled into your own media library and converted to AVIF/WebP, and the post is rewritten to point at the local copies. Your migrated content keeps working even after the old site goes offline — no more hotlinked images that break later. It's a single checkbox on the import screen (on by default), matching the WordPress importer.
Multilingual archives & API stability
Fixed
- On multilingual sites, category, tag and author pages, related lists and widgets now show only your site-language posts again; translated posts stay reachable at their own address and are still discovered through their hreflang links.
- The REST API and magic-link sign-in now work reliably on every install, including brand-new ones, and importing from Ghost/Substack cleans up correctly even if the file has an error.
Go live today
Setup, content management, SEO and image optimization — all in one platform. Get started in 30 minutes.
View Pricing- Setup and live in 30 minutes
- 14 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO — Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)