Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 5 of 20 — 576 releases, newest first.
Deep audit hardening across membership, webhooks, editor & multilingual
Fixed
- Content gating is now consistent everywhere: /llms-full.txt, instant search and the About/Contact/FAQ/legal/homepage page routes all apply the same members/paid/private visibility gate as the rest of the site.
- Outgoing webhook signatures are now verifiable: the HMAC was being computed with the encrypted secret instead of the plaintext (a column length also truncated it), so every signature failed on the receiver — fixed end to end.
- A webhook signing secret can no longer be used as an admin API key.
- Newsletter segment sending can no longer silently fall back to the entire subscriber list when the CRM is unavailable or errors — it sends to nobody rather than everybody.
- Reply notifications no longer fire for unapproved/spam comments, so moderation-pending replies can't spray the whole thread by email.
- The paywall teaser is now safely capped even on very short posts, and the reaction bar can now be un-clicked and switched correctly with counts always coming from the server.
- Editor hardening: the snippet library and the bookmark fetcher are now restricted to content roles (not read-only subscribers); the bookmark fetcher pins the validated IP (DNS-rebinding), enforces a hard size cap, and resolves relative images correctly; product/bookmark/gallery/embed card links reject javascript:/data: URLs; the gallery block is now clickable and the four new blocks have their edit/delete toolbar.
- Magic-link sign-in/registration is now rate-limited (anti email-bombing), tokens are single-use under concurrency, and the new-member webhook fires only after the email is verified.
- Ghost/Substack import no longer triggers per-post newsletter/push/social/ping storms, survives BOM and malformed CSV rows, only raises the memory limit, maps Ghost visibility, and skips empty lexical-only posts.
- Multilingual: the language filter no longer breaks reactions, comments, pages, comment feeds or legacy-URL rescue on translated posts — it now applies only to genuine listing surfaces (archives, sitemap, feeds, search) while every translated post stays reachable at its own URL.
Multilingual content v1 + Ghost/Substack migration
Improved
- Multilingual content v1: give any post a language and link it to its translated counterpart from the editor's new Translation box. Linked pairs automatically emit hreflang alternate tags (plus x-default) so search engines serve the right language; archives, sitemap and feeds keep showing only the site language while translated posts live at their own URLs.
- A practical translation workflow ships with it: Duplicate the post, switch the copy's language, link it back by ID — done. No plugin, no separate site.
- Migrate from Ghost: upload the JSON export from Ghost admin and posts, pages, drafts, tags, publish dates and feature images come across — safe to re-run, existing slugs are skipped.
- Migrate from Substack: upload the export ZIP as-is and newsletter posts import with their full body and subtitle; "paid-only" posts automatically arrive with Premium (paid) visibility, matching the membership system one-to-one.
Integrations & engagement: webhooks, segments, reactions
Improved
- Outgoing webhooks are now real: pick events (post published/updated/deleted, new comment, new member), add an HTTPS URL, and jekcms sends signed JSON (HMAC signature header) the moment they happen — Zapier/n8n/Make ready, with a one-click test button.
- Newsletter campaigns can target CRM segments: choose a saved audience filter when sending and only matching active subscribers receive it — the "coming soon" broadcast gap is closed.
- Comment conversations now notify the whole thread: everyone above a new reply is emailed once (deduped), and every notification carries a one-click, tamper-proof opt-out link.
- Emoji reactions arrived on every theme: a theme-independent reaction bar appears under posts with live counts served from the API — fully compatible with the full-page cache; themes with their own reaction UI are automatically skipped.
Fixed
- A leftover placeholder in the cron was silently marking the social-media queue as completed without doing any work — removed; the social plugin's queue is no longer swallowed.
Editor: monetization cards, gallery, social embeds and snippets
Improved
- A Product/Affiliate card joined the editor: image, price, description and a call-to-action button whose link automatically carries rel="sponsored nofollow" — Google-compliant affiliate monetization in two clicks.
- Bookmark cards turn any URL into a rich preview: paste a link, hit Fetch, and the title, description, image and site name are pulled server-side (with strict SSRF protection) into an editable card.
- Gallery grids (2-4 columns) and social embeds arrived: Twitter/X, Instagram, TikTok and Vimeo links become real embeds on the page — the editor stores a neutral placeholder and the site hydrates it, so provider scripts load once and only where used.
- Snippets make repeated content one click: select anything in the editor, save it under a name, and insert it into any future post from the snippet library.
Premium (paid) membership tier
Improved
- Posts can now be marked "Paid members only": anonymous readers get a premium teaser with a join call, signed-in free members see an Upgrade card with your price and payment link, and premium members read everything.
- Selling is friction-free by design: paste any payment link (iyzico or Stripe payment page) plus an optional bank-transfer note in Settings, and when a payment arrives, one click on the Users screen upgrades the member — no gateway integration to configure.
- The member account page shows premium status and the upgrade offer; staff accounts always see full content, and paid posts stay in sitemaps and feeds as leak-proof teasers with correct paywall structured data.
Memberships: members-only content and passwordless sign-in
Improved
- Ghost-style memberships arrived: mark any post "Members only" and anonymous readers see a clean teaser with a join call-to-action while signed-in members read the full piece — on every theme, with zero theme changes.
- Readers join and sign in without passwords: a one-time magic link lands in their inbox (30-minute, single-use), a minimal account page lets them manage their name and newsletter subscription, and joining doubles as newsletter double opt-in.
- Members-only posts stay fully SEO-correct: they remain in sitemaps and feeds as teasers, never leak the gated body anywhere, and carry Google's official paywalled-content structured data so gating is not mistaken for cloaking.
- One-click post duplication (content, categories, tags and metadata copied into a fresh draft) joined the post list actions.
- Your content is never locked in: a new Export panel downloads everything as WordPress WXR, Ghost JSON or jekcms JSON — categories, tags and SEO fields included.
Full-page cache: millisecond pages for visitors
Improved
- A textbook full-page cache now serves the homepage, single posts, category, tag, author and date archives to anonymous visitors straight from disk — measured locally, pages dropped from 60-200ms to 4-9ms.
- Cached copies are invalidated exactly when content changes: saving a post, moderating a comment, editing categories/tags/menus/users, changing settings or the theme all clear the right copies immediately; a small share of requests still runs the full engine so scheduled tasks keep ticking.
- Comment and contact forms became cache-safe: the security token is no longer baked into the page — it is fetched the moment a visitor actually starts filling a form, so anonymous browsing stays completely cookie-free.
Fixed
- Every single visit was silently receiving a session cookie because the user loader started a session even when there was nothing to load — this broke the lazy-session design site-wide and made pages personally-addressed for no reason.
- Two themes' view counters opened a session per article view; they now use the cookie-free central counter, and A/B-test pages, dark-mode/language-cookie visitors and search results are correctly excluded from the cache.
Deep performance pass: queries, caching and page weight
Improved
- Repeated database work was eliminated across the board: prepared statements are reused, per-image lookups are memoized, sidebar aggregations are cached, empty results now cache correctly, and hot columns gained indexes.
- Theme pages got lighter: template-specific stylesheets load only on their own template, mobile-only CSS no longer blocks desktop rendering, fonts load from the page head instead of a chained CSS import, and analytics/ad hosts get an early connection.
- Saving a post now runs its category/tag/meta writes in a single transaction, and archive pages batch-load categories instead of querying once per card.
Fixed
- Six plugins were silently re-running their entire installation schema on every single page view due to a settings-key collision — the single biggest hidden cost on every site; pages now run dramatically fewer queries and zero writes.
- The featured-image helper returned the full-size original instead of the 1600px variant, so every theme preloaded multi-megabyte camera files as the hero image; the preload also now matches exactly what the browser will render.
- Browsers were told to keep HTML pages for a full hour with no way to refresh them — edits stayed invisible to returning visitors; pages are now edge-cached and browser-validated, and category/tag edits and new posts invalidate the right caches immediately.
- Sitemaps and feeds are written atomically with a generation lock — parallel crawler hits could previously read half-written XML or trigger simultaneous full regenerations.
Categories, archives and search: deep SEO pass
Improved
- Categories gained their own SEO title and SEO description fields in the admin panel, and parent categories now count and list their child categories' posts everywhere — archive pages, indexing rules and the sitemap agree.
- Site search now ranks results by relevance instead of date on every theme, search page titles are capped against keyword-injection spam, and paginated search links finally carry the query along.
- Date archives (old /archive/2026 style addresses) now get a descriptive page title, paginated archive pages carry a page number in their description, and every theme reports its real page size in structured data.
- The site description used by feeds and previews became editable in Settings — until now every installation shipped the same boilerplate sentence — and the homepage title can carry the site tagline.
Fixed
- Address-case variants of category, tag and author pages now redirect to the single canonical address instead of serving duplicate self-canonical copies, and deleted tags leave a proper "gone" record so search engines drop them quickly.
- Two themes silently lost every category description from search snippets over a variable-name mismatch, one theme pinned paginated archives' canonical to page one, and tag pages on two themes either listed the whole site or rendered without a title.
- Tag feeds became real: following a tag's feed used to silently hand subscribers the site-wide stream; category and tag feeds also stopped claiming to be the main feed, and feed images now declare their true format.
- Homepages that paginate now return an honest not-found beyond the last page and give page two and onward their own title and canonical; the theme demo search-blocking robots rule that hid the blog search's noindex from Google was lifted.
Single posts and author pages: deep SEO pass
Improved
- Author pages now carry a full social-profile card: stable identity across paginated pages, a real profile picture in link previews, richer profile structured data, and each author's own posts listed correctly on every theme.
- Article structured data now reports the approved comment count, and social share cards gained an image description, a reading-time line and the post's topic tags.
- Every theme's post page now shows the publish date in a machine-readable form, and the "Updated" stamp only appears when the content genuinely changed.
Fixed
- Bylines no longer invent a writer: when a post has no real author profile the name is shown as plain text instead of linking to an author page that never existed.
- The table of contents on the news theme now works on markdown-written posts, previous/next links on the starter theme point at the real post address, and the pets theme no longer emits a half-finished second copy of article metadata that contradicted the main one.
- Author boxes that were silently invisible now render: one theme queried profile fields under their old names, another never received the author's biography from the page at all.
SEO verification pass: second-round hardening
Fixed
- Database sessions now share the site's timezone, so a freshly published post appears in sitemaps immediately on every host instead of hours later on servers whose database clock runs in UTC.
- Sitemap index announcements now use exactly the same filters as the sitemap files themselves — no more announced-but-empty news/video maps, and trashed marketing posts finally disappear from the public blog, feed and sitemap.
- Old WordPress-style category/post addresses now hop straight to the real post, and every remaining "redirect to somewhere that 404s" chain (authors, categories, attachments, feeds, year archives) returns an honest not-found instead.
- The maintenance page now sends proper no-cache headers, uses the active theme's template, and error pages exist for every status the error route accepts.
- The theme demo gallery moved to a stable address (/demos) — its old address was shadowed on the server and had been unreachable from the navigation.
- Upload-folder protection files are written Apache-2.4-safe everywhere; on hosts without the legacy compatibility module they used to turn whole media folders into server errors. A permanent release-gate check now guards this class.
Deep SEO audit: crawling, presentation and media layer
Improved
- Crawlers can now fetch core stylesheet/script assets and search pages, so pages are rendered and evaluated with their real design and noindex hints are actually readable.
- Sitemaps got stricter: entry dates no longer drift on every visit, image entries always point at working files, scheduled/future content never appears early, and news/video sitemaps respect per-post indexing choices.
- Titles across all themes now follow the configured separator, add a page number on paginated archives, and no longer repeat the site name twice; archive descriptions can come from the tag or author's own text.
- Structured data is more consistent: language, titles and image formats now match across the page's tags, FAQ/HowTo blocks can no longer be emitted twice, and the publisher logo is a raster image with its true dimensions.
- Modern-format (AVIF/WebP) image sources are only offered when the file really exists — on hosts without those formats the browser now always gets a working image instead of a blank box.
- More images carry explicit dimensions and descriptive alt text, the correct hero image gets load priority on every theme, and automatic internal links open in the same tab as expected.
Fixed
- Addresses that do not exist now return a real "not found" status everywhere instead of silently redirecting to the homepage, so search consoles report them correctly and they drop out of indexes.
- Error responses are never cached as healthy pages anymore, and error/410 pages are proper, readable pages with charset, language and a link home.
- Duplicate-address cleanups: uppercase blog links, retired tag aliases, alternate sitemap/robots/feed addresses and www+http visits each collapse to a single canonical address in one redirect hop.
- Date archives are validated (invalid years return "not found") and marked not-to-be-indexed, closing a duplicate-content surface.
Verification pass: admin panel fixes
Security
- Saved AI keys in the multi-key list are no longer written into admin page HTML; rows show a masked “saved” state and each key only changes when you type a new value — leaving a row untouched keeps the stored key.
Fixed
- Some admin confirmation and validation messages (for example the new password-policy warning when adding a user) were saved but never shown on screen; the panel now displays messages from both internal channels.
- On installations whose database was missing two optional pieces, the settings page could cut off mid-render and adding a user could fail with a server error; the missing pieces are now provisioned and both flows were verified end-to-end.
Security hardening: broad audit across the product and site
Security
- Uploaded files are kept strictly non-executable everywhere: the upload-folder protection is now stronger and self-maintaining, and the blocked-extension list covers disguised double-extension names.
- Content upload endpoints now require an explicit upload permission tied to the account's role.
- Editor/API secrets (AI provider keys, SMTP password, webhook secrets) are no longer written into admin page HTML; fields show a “saved” state and only change when you type a new value.
- Order pages are tightened: cancelling an order requires the owner and a confirmed action, and guest checkout is scoped to the buyer’s own account.
- Anti-abuse limits are now enforced server-side on the contact form, verification-email resend, comment likes, newsletter signup and article voting.
- Payment confirmation now verifies the paid amount and currency against the order before completing it.
- The one-click Google connection now only works from a licensed customer domain, and several login/authorization edge cases were closed.
- Error responses no longer include internal technical details, and internal maintenance/report files are kept out of public deployments.
Compatibility: deep sweep for PHP 8.0 servers and lean setups
Fixed
- On servers running PHP 8.0 (the minimum supported version), several areas used a function that only exists in newer PHP: the site footer, the Personal theme and — most critically — the auto-update engine could crash. These now work on every supported PHP version.
- Publishing a post no longer depends on optional server pieces: the search-engine ping, encoding repair tools and the RSS import endpoint all degrade gracefully when a server component is missing, instead of stopping the whole operation.
- The installer now tells the truth about requirements: the cURL component (needed by updates, licensing and integrations) is checked as required rather than merely recommended, so problems surface at install time instead of weeks later.
- The pre-release safety check was deepened: it now also blocks any new code that would require a newer PHP than the product promises, alongside the existing optional-component guard.
Resilience: missing server components can no longer crash any operation
Fixed
- Following yesterday's upload fix, the entire product was swept for the same class of failure — features assuming an optional PHP server component is present. On lean hosting setups this could crash: WebP image reading during WordPress import, migration and Pinterest image generation; AVIF/WebP saving in thumbnail regeneration and the media optimizer; image processing entirely on servers without the GD component (the upload now keeps the original file instead of failing); and update, backup and package operations if the zip component is disabled. Every path now checks first and degrades gracefully with a clear message instead of a server error.
- This protection is now permanent: an automated check runs before every release and blocks any new code that uses an optional server component without a safety check.
Critical: image uploads were completely broken on some servers
Fixed
- On hosting where PHP's optional "fileinfo" extension is disabled, every image upload failed with a "mime_content_type" error — the editor's image dialog, the Pinterest image and the media library were all affected. The file type is now detected through a chain of safe fallbacks (including reading the image header directly), so uploads work on every hosting configuration. If your uploads were failing, update and try again — no other action needed.
Google Console: weekly email digest + rising/declining queries + opportunity list + cache fix
Added
- Weekly performance digest by e-mail: every week the plugin compares the last 7 days of Search Console, Analytics and AdSense with the previous week and sends a compact summary (with ▲▼ trends and the week's top queries) in the site language. Enable it in Settings; runs on the server cron, retries gracefully and never double-sends.
- Rising / declining queries: the Search Console tab now compares the selected period with the previous one and lists the queries that gained and lost the most clicks — including queries that disappeared entirely.
- Opportunity queries: keywords that show often in Google (ranking 4-20) but get few clicks — the fastest wins for title/description improvements, sorted by impressions.
- Pages losing traffic: content-refresh candidates ranked by click loss versus the previous period.
Fixed
- The API response cache effectively never worked on servers where PHP and MySQL run in different time zones: expiry times were written with the PHP clock but checked against the MySQL clock, so every cached entry was born already expired (by the zone offset) and every panel visit hit Google's APIs live — this is why the panel could feel slow or unstable. Expiry is now computed on the database clock.
Contact Form: reply from the panel + bulk actions + CSV export + phone field
Added
- Reply from the inbox: write your reply under the message and send it by e-mail without leaving the panel — the visitor receives it with their original message quoted, and the message is marked "replied" with the reply stored on the record. (The "replied" status existed but nothing ever set it; the old Reply button just opened your mail app.)
- Bulk actions: select multiple messages and mark read / spam / archive / delete in one go, plus one-click CSV export of the inbox (Excel-ready, with spreadsheet-formula injection neutralized).
- Optional phone field: enable it in settings and the form shows a phone input (validated loosely for international formats); the number appears under the sender in the panel and in the notification e-mail. Themes that pass their own field list are unaffected.
- Auto-reply personalization: the {name} tag in the auto-reply subject and body is replaced with the sender's name.
- Field-level error display on the form: validation errors now appear under the exact field and the first one is focused — the styling for this existed but was never used; visitors only saw a generic "check the form".
Fixed
- Spam-flagged messages were stored without any cap — a bot flood could grow the table indefinitely (the "no message is ever lost" design kept everything). The newest 300 spam records are now kept and older ones pruned, matching the Form Builder's protection.
Form Builder: conditional logic + multi-step forms + smarter validation
Added
- Conditional logic: any field can be shown only when another field meets a condition (equals / does not equal / is empty / is not empty / contains). Hidden fields are skipped by validation and never stored — the server re-evaluates every condition itself, so hand-crafted requests can't smuggle values in.
- Multi-step forms: drop a "page break" between fields and the form turns into steps with a progress indicator and back/next buttons; each step validates before advancing, and with JavaScript off everything gracefully falls back to a single long form.
- Per-field error display: validation errors now appear under the exact field (with the wizard jumping back to the right step and focusing it) instead of a single generic message.
- Multi-checkbox groups: a checkbox field with options now renders one checkbox per option, with "at least one required" enforced in the browser and on the server. Previously the options were validated but never rendered — the form always showed a single box.
- Duplicate form action in the list, and "redirect after submit" now actually redirects in the no-page-reload (AJAX) flow too.
Fixed
- A field saved without a width value (via the API or programmatically) crashed the save with an "Undefined array key" error; the admin form always sent a width, which masked it.
- The confirmation redirect URL is now validated when saving — non-http(s) addresses are rejected instead of being passed to the browser.
Web Push: campaign composer + click statistics + welcome notification + background secret-decryption fix
Added
- Campaign composer: write and send any notification (title, message, target URL, large image) to all subscribers from the admin panel — until now the panel could only send a fixed test message.
- Broadcast history with click tracking: every send (new post, campaign, test) is logged with delivered/failed counts, clicks and CTR. Clicks are counted by a lightweight beacon from the notification itself — no third-party service, no personal data.
- Welcome notification: optionally greet each new subscriber with a one-time, customizable notification the moment they subscribe — they immediately see that notifications work.
- Configurable opt-in button: position (bottom left/right), custom label, show delay, and a dismiss (✕) that snoozes the prompt for a configurable number of days. Previously the button was fixed, undismissable and shown forever.
- Rich notifications: new-post pushes now carry the post's featured image as a large picture on supported platforms; campaigns can attach one too.
- Subscriber analytics on the panel: growth in the last 7/30 days and a browser breakdown.
Fixed
- Background jobs (cron, deferred sending after the page is delivered) could silently fail to decrypt stored secrets: if any output had already been produced when the security layer initialised, session setup threw and decryption returned empty — for Web Push this meant the whole broadcast was silently skipped with an unusable VAPID key. Session configuration now degrades gracefully after output has started, so encrypted secrets remain readable in every background context.
Quiz: premium engine (timer, instant feedback, question bank, weighted personality) + fixes
Added
- Time limit per quiz: a countdown runs while playing and the quiz auto-submits with the answers picked so far when time runs out.
- Instant feedback mode: as soon as the reader picks an answer, right/wrong (and the explanation, if enabled) is shown before moving on. Correct answers still never appear in the page source — each check is answered by the server, and the endpoint only responds for quizzes that opted in.
- Question bank: shuffle question order and/or serve a fixed number of questions from the pool on every run — each play gets a different quiz. Scoring uses the served count, not the pool size.
- Weighted personality engine: every answer can carry points and the result card is chosen by the point total — the standard model of premium personality quizzes. Trivia scoring is unchanged.
- Result sharing: copy link, X, WhatsApp and Facebook buttons on the result screen, with the score or personality result in the share text.
- Duplicate quiz action in the admin list, drag-to-reorder questions in the editor, and a working media picker for quiz, question and answer images (the old "Browse" button always fell back to "enter the URL manually").
- The standalone quiz page now emits Quiz schema (JSON-LD) — deliberately without questions or answers, so correct answers stay out of the page source.
Fixed
- On themes that pre-parse content (e.g. to build a table of contents), the embedded quiz lost its stylesheet and script — questions never rendered. The assets now travel with every embed, and the view counter no longer double-counts on those themes.
- When editing an existing quiz, the field labels showed raw template code ("${QI18N.qText}") instead of text.
- The admin quiz screens mixed Turkish and English ("No quiz plays yet yok.", untranslated settings and buttons); the share image URL of the standalone quiz page was relative, so social preview cards came out empty.
Recipe Cards: visual recipe editor in the post editor + premium card features
Added
- The post editor gained a full Recipe panel: structured ingredient rows (quantity, unit, name, note) with group headings ("For the sauce"), drag-to-reorder steps with optional step photos, minute-based time fields with automatic total, servings, difficulty, course/cuisine suggestions, nutrition facts and an FAQ builder. Until now this rich recipe data could only be produced by the AI content pipeline — writing a recipe by hand meant raw ISO-8601 duration codes in the SEO schema panel.
- Bulk paste: paste a plain ingredient list ("200 g flour") or numbered steps and the panel splits quantity, unit and name into rows automatically.
- Recipe video support: paste a YouTube, Vimeo or mp4 link — the card embeds the player and YouTube videos are added to the Recipe schema as a VideoObject (eligible for video rich results).
- Cook mode on the recipe card: one tap keeps the phone screen awake while cooking (on supported browsers; the button hides itself elsewhere).
- "Copy list" button on the card copies the ingredient list — including scaled quantities when the reader changed the serving count.
- Printing now prints only the recipe card, not the whole page; a Notes/tips box and step photos are shown on the card as well.
- The [recipe] shortcode places the card wherever you want inside the content — and works on every theme, not just the recipes theme.
Fixed
- On a recipe post without a usable image, the plugin correctly skipped the Recipe schema node but silently dropped the FAQ schema with it — FAQ rich results were lost on exactly the posts that needed them. The FAQ schema is now emitted independently.
- Recipe difficulty was displayed in raw English data tokens ("easy") on Turkish sites; known values are now shown in the site language.
- Step photos were included in the schema but never shown to readers on the card; they now appear under their step.
Stories audit: "Latest Posts" statistics + navigation fix
Improved
- The whole plugin was re-verified live: poll vote integrity, per-visitor replay windows, reaction-switch accounting, slide ownership checks and the sanity of the new virtual-story validation (unknown posts rejected, polls not accepted on the automatic story).
Fixed
- Views, link clicks and emoji reactions on the automatic "Latest Posts" story were silently discarded by the server — visitors saw the reaction animation but nothing was ever counted, and the statistics page had no trace of the story most sites use the most. These events are now recorded (with the same replay protection as manual stories), reactions show up in the ambient emoji stream, and the statistics page gained a dedicated "Latest Posts" card breaking performance down per post.
- With "auto-advance to next story" turned off, swiping or tapping to the next story closed the viewer entirely instead of advancing. That setting now only controls what happens when a story finishes on its own — manual navigation always moves to the next story.
Web Push audit: no subscriber misses a notification + dead-subscription cleanup
Improved
- When the browser rotates a push subscription, the service worker now re-subscribes automatically instead of silently going quiet. Sending got faster on large lists (the signed authorization is computed once per push service instead of per subscriber) and the delivery connection is explicitly TLS-verified with redirects refused. The whole plugin was re-verified live against a mock push service: crypto self-test, dead-endpoint pruning, budget cursor, tick lock and intake validation all confirmed.
Fixed
- On sites with many push subscribers, publishing a post only notified as many browsers as fit into the sending time window — the rest simply never received that notification. Sending now remembers exactly where it stopped and continues in the background (server cron and page-triggered fallback, with a lock so no browser is ever notified twice) until every subscriber has been reached.
- Subscriptions that kept failing without properly expiring (persistent errors, unreachable endpoints) were retried forever on every publish, eating the sending window. After 8 consecutive failures a subscription is now cleaned up automatically.
- A subscription registered with a valid push service but corrupt encryption keys was accepted and then failed on every send; keys are now validated byte-for-byte at registration.
AI Images audit: pin domain fixed + scaling and provider improvements
Improved
- The visual-concept helper now uses the same hardened network settings as image generation (strict TLS, no redirects, response size cap), and the generation log cleans up entries older than 180 days by itself. The whole plugin was re-verified live: concurrency lock, daily cap, image validation, oversized-response cut-off and redirect refusal all confirmed working.
Fixed
- The "Pinterest / Recipes pin" style rendered a fixed website address into the bottom strip of every generated pin — regardless of which site generated it. The pin now carries the site's own domain automatically.
- The "posts with missing images" list loaded the full content of every published post into memory to count images; on a site with thousands of posts that could exhaust memory. Counting now happens inside the database and the screen stays fast at any size.
- With OpenRouter selected as provider, the settings screen still warned "no Gemini API key" and style-preview generation insisted on a Gemini key. Both now follow the selected provider.
jekcms.com audit: contact form repaired + language redirect fixed
Improved
- The marketing site was audited top to bottom: 38 pages in both languages (render integrity, silent log noise, titles, canonical and hreflang tags, single H1), all 88 internal links, sitemap/robots/feeds/docs search, payment checkout links and both forms — everything else came back healthy. The "Try the admin panel live" band on the themes page now sits below the theme list, and a new automated suite guards the form pipeline against regressions.
Fixed
- The jekcms.com contact form rejected every single submission with a "security token mismatch" error: the page stored its security token in one session while the receiving endpoint checked a different one, so the two could never match. The form now fetches a fresh token at the moment of submission — messages actually arrive and open a support ticket. The footer newsletter form carried a lighter version of the same risk and now uses the same always-fresh-token pattern.
- Opening a jekcms.com page with the ?lang=tr shortcut on a direct .php address redirected to a dead URL (for example /blog.php?lang=tr landed on a 404). The Turkish redirect target is now normalized to the clean address, and subdirectory installs no longer produce doubled paths.
General audit: post reactions/ratings completed + silent error floods ended
Improved
- The whole automated test battery was run end to end — 65+ suites, 2,000+ checks, all green — covering plugins, themes, mail, licensing, installers, customer portal and admin access controls.
Fixed
- The Entertainment theme's reaction buttons (🔥 ❤️ 😮) and star ratings were half-built: the interface was drawn and clicks were sent to the server, but the receiving endpoint never existed and the database tables were never created — counts always showed zero, reverted on reload, and every page view silently wrote errors to the log. The feature is now real end to end: one reaction and one rating per visitor (updatable), public-published posts only, rate-limited, and the tables create themselves on first use.
- The settings-change timeline (who changed which setting, with undo) had never worked: its query joined a table name that doesn't exist in the product, so the history always came back empty and every dashboard load added another silent error to the log. The audit found 1,600+ recorded changes that are now actually visible.
- Small persistent warnings cleaned up across jekcms.com: the admin invoice list read a wrong column name for due dates (overdue highlighting never fired), 404 pages warned about a missing canonical URL, the blog listing warned on every load, and two 2.65-era changelog entries had no title and rendered a warning on the public changelog page.
Customer accounts: clear verification flow + session security
Improved
- One password policy across the whole customer portal (register, reset, profile, sign-up modal): at least 8 characters with a letter and a digit, and obvious passwords are rejected — "12345678" is no longer a valid password for an account that holds licenses and purchase history. Both blog-site user management and the customer portal were audited end to end on a live environment: brute-force lockouts, role whitelists, IDOR scoping on orders/tickets/invoices/licenses, OAuth account-linking protections and 2FA flows all verified working.
Fixed
- An unverified customer account was silently bounced back to the sign-in page in an endless loop with no explanation — right after registering, after signing in with the correct password, and after changing the email address on file. Every entry point now explains what happened and links to "resend verification email"; registration no longer opens a session that gets dropped one request later, and changing your email signs you out cleanly with a clear note instead of appearing to crash.
- Profile password changes and admin-side password resets now bump the session version, so every other signed-in device is signed out immediately — only the device that changed the password stays in.
Editor SEO assistant: score verified live + 4 new checks
Added
- The post editor's SEO assistant gained four new checks, shown only when the issue actually exists: a stale year in the title (e.g. "2024 guide" in 2026), heading sections with no content under them, generic link text like "click here", and long articles (1000+ words) with fewer than two images.
Improved
- The SEO score engine was verified end to end in a real browser: a blank draft scores exactly 0, Turkish dotted-İ keyword matching and inflected-word density counting work, over-density and readability warnings fire correctly, and on every scenario the dial score matches the sum of the per-category points exactly. The computed score is also confirmed to be saved with the post and shown in the post list.
Go live today
Setup, content management, SEO and image optimization — all in one platform. Get started in 30 minutes.
View Pricing- Setup and live in 30 minutes
- 14 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO — Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)