Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 6 of 20 — 576 releases, newest first.
Newsletter: campaigns now send themselves
Improved
- The whole subscription pipeline was audited end to end on a live site: sign-up protections (honeypot, rate limit, spam filter, mail-bomb cap, address-disclosure parity), double opt-in with token rotation, one-click unsubscribe headers, open/click counters with signed links, and bounce pre-flight all verified working.
Fixed
- Newsletter campaigns only went out while an admin kept clicking "send next batch", or on servers with a manually configured cron job; on a typical installation a campaign larger than one batch — and every automatic new-post notification — sat in the queue forever. The queue is now processed automatically: the built-in scheduler drains it in small batches as the site gets visits, and the server cron (where present) drains it in full — with row-level locking so the two never send the same email twice, and nothing is sent while the newsletter is disabled or the plugin is deactivated.
Visual theme audit: readability and dark-mode fixes
Fixed
- Every theme was rendered in a real browser in both light and dark mode and measured for text readability; unreadable spots were corrected across nine themes — badge and button text on bright brand colors, faded date/muted text, table-of-contents boxes and post cards that stayed white in dark mode, a newsletter band whose white text vanished on its yellow gradient, and an oversized content image that forced horizontal scrolling.
- When you pick a light brand color in the customizer, badge/button text on that color now switches to dark automatically (and link-style brand text is deepened just enough to stay readable) instead of staying white and disappearing.
- The travel theme's default menu no longer links to pages that don't exist on the site; "Destinations/Tips" entries appear only when a matching category exists and point straight to it.
- The shared sidebar widgets (tags, categories, recent posts) now stay readable in dark mode on every theme, even when a theme doesn't define its own dark palette for them.
Theme audit: broken-image safety net + graceful demo-media fallback
Added
- A new deep theme audit exercises all 13 themes across eight page types each — checking rendering, single H1, canonical tags, encoding, leaked shortcodes, layout-section contracts and every referenced asset. All 517 checks pass on both an English and a Turkish site.
Improved
- The travel theme's showcase images (front-page slider, about page, archive banners) now appear only when the files actually exist on the installation; sites without the demo media pack get a clean dark banner instead of broken image icons.
Fixed
- Content written on a development machine could carry "localhost" image addresses into the live site, showing readers broken images (one live post was affected and has been repaired). Rendering now silently rewrites such development addresses to the site's real address — only inside image and link attributes, so articles that mention localhost in their text or code samples are untouched.
- The finance theme linked an apple-touch icon file that doesn't ship with the theme, producing a broken request on every page; the icon already comes from the site's central favicon pipeline, so the stray link was removed.
Site Versions screen + lasting analytics history + cleanup
Added
- License server: a new "Site Versions" screen lists every licensed installation that checks in with the update server — its domain, last reported version, PHP version and last-seen time — and flags at a glance which sites are up to date, which are running behind, and which have gone silent for two weeks. Check-ins are recorded only for valid licenses actively bound to the reporting domain.
Improved
- Analytics: the daily trend chart now also reads the permanent daily summaries, so date ranges older than the raw-data retention window (90 days by default) show real history instead of an empty chart. The summaries had been collected all along but were never displayed.
- The demo site now applies updates automatically every day and its nightly reset preserves that setting, so the public demo always showcases the current release.
Fixed
- Eight plugins registered an admin-menu hook that the panel never fires; the dead registrations were removed (menu entries continue to come from the panel's own list, nothing visible changes).
- The internal schema check misread SQL comments and nested data blocks, hiding real columns and reporting phantom ones; with the parser fixed and three schema reference files brought up to date, the known-issues backlog dropped from twelve to zero.
General audit: silent log flood stopped + plugin registration repair
Improved
- Four plugin distribution tools were missing two installations from their target lists, so future fixes for those plugins would silently skip them; the lists were completed (the same gap was fixed for the SEO panel earlier).
Fixed
- The admin dashboard queried social and push-notification tables even on installations where those plugins were never activated; the page rendered fine, but every single dashboard visit silently appended errors to the database log (one installation had accumulated 47,000 lines). The dashboard now checks the schema first and simply shows zeros, and it also adapts to older social-queue schemas instead of failing.
- The Google Console plugin's activation script used a wrong column name when registering itself, so it logged an error on every update and could fail to register on a fresh site; the column name was corrected.
- Two internal quality checks had fallen out of date after recent changes (quiz answer response and content-filter wiring) and reported false alarms; they now verify the actual behaviour instead of exact source text, and five already-resolved records were cleaned out of the schema check's known-issues list.
Both languages everywhere: 10 themes + admin panel fully TR/EN
Added
- A live bilingual audit tool now logs into the panel and crawls the critical admin screens and public pages of every site in BOTH languages, catching raw dictionary keys, Turkish text in English mode and English text in Turkish mode — 140 fleet checks and 45 deep checks all pass.
Fixed
- Around 1,100 hard-coded interface strings across ten themes (travel, pets, finance, minimalist, recipes, crypto, tech, entertainment, health, starter) now follow the site language: comment forms, newsletter boxes, search, 404 pages, pagination, reading time, share labels and screen-reader labels all render in Turkish on Turkish sites and English on English sites.
- The admin panel now honours the admin language setting consistently: the login screen tagline, every date (month names were printed in Turkish even in the English admin), the media upload box and the license screen no longer mix languages.
- Thirteen dictionary entries that displayed their internal key instead of text (e.g. the date filters on the Posts screen) and nine English dictionary entries that contained broken Turkish text (e.g. the login subtitle) were repaired in both languages.
- A site language saved as a regional code like "en-US" was silently falling back to Turkish; regional codes are now normalised, so an English site no longer renders a Turkish interface.
- Two sites were running theme copies months behind the product (missing every rollout since the layout engine); all fleet theme copies are now byte-identical with the product and a new sync tool keeps them that way.
SEO: AI visibility audit (llms.txt + AI crawler policy)
Added
- SEO Health Check gained an "AI Visibility" group: it now verifies that llms.txt and llms-full.txt (the site summaries ChatGPT, Claude and Perplexity read) are actually being served, summarises your AI crawler policy (how many of the 13 known AI bots are allowed), and confirms the live robots.txt really reflects that policy — so a stray static robots.txt file can no longer silently override your choice.
Fixed
- Advanced SEO propagation lists were completed: the plugin's activation file joined the fleet sync list and two installations missing from the dedicated sync tool's target list were added, so future panel fixes reach every site instead of silently skipping some.
Audience (CRM): export a segment, faster counters, tighter access
Added
- Each saved segment now has its own "Export CSV" button, so you can download exactly the contacts a segment covers in one click — not just the whole list.
Improved
- The audience summary counters (total plus one per source) are now computed in a single database pass instead of five separate scans, so the Audience screen stays fast on large contact lists.
Fixed
- The admin-only access check on the Audience screen is now unconditional, closing a theoretical gap where the contact list (personal e-mail addresses) could have been reachable by a lower-privileged user if the code were loaded differently.
Social: non-blocking Instagram/Threads publishing + Pinterest image fix
Fixed
- The per-post Pinterest image field in the editor now saves. It was posting to an address that had no route, so the value was silently dropped — the pin image you set was never stored.
- Publishing a photo, story or carousel to Instagram — and a post to Threads — no longer holds a worker busy waiting for the platform to finish processing. Ready posts go out immediately; ones still processing are picked up on the next pass, the same way Reels already worked. Before, a single post could tie up a worker for up to half a minute.
- When a social post succeeds, its remote post id and publish time are now recorded on the queue entry itself (not only in the log), so the published-at time and a link back to the post are available.
Recipe card: servings scaler, card image fix, sturdier rich results
Added
- Recipe cards now have a servings adjuster: readers tap − / + to change the number of servings and the ingredient amounts scale automatically. Whole numbers, decimals and fractions (½, 1½, 1/2) are all handled and shown back as neat fractions; anything that isn't a plain amount ("a pinch", "2–3") is left untouched.
Fixed
- A recipe with only a cover image (no separate step photo) now shows that image on the card. Before, the card's image was computed but never displayed unless a separate process photo was set, so many cards appeared with no picture.
- The recipe's star-rating rich result is now emitted only when the rating is a real number within range and has at least one vote — a stray or out-of-range value could previously invalidate the whole recipe rich result in Google.
- A recipe with an unreadable publish/update date no longer stamps the structured data with a 1970 date; the field is simply left out instead.
- Prep/cook/total times written with a day component (for long-rested recipes) are now counted correctly instead of reading as zero.
Quizzes: fairer scoring, answer explanations, cleaner personality results
Fixed
- A question with more than one correct answer is now scored fairly: picking any of the correct answers counts as right. Before, only one of them was accepted and a reader choosing an equally-correct answer was marked wrong.
- The "Show explanation" option now actually works — when it's on, each question's explanation appears in the results review after finishing. It had no effect before.
- The "Auto-scroll" option now works too: moving to the next question gently scrolls the quiz back into view, which helps on phones. It was also previously inactive.
- Personality quizzes no longer show a "3/10 correct" score or right/wrong marks — those don't apply to result-based quizzes, so now only the result card is shown.
Plugin review, round four: social, forms, CRM, analytics
Improved
- Social & Video: YouTube uploads use a tighter per-chunk timeout so a single slow chunk can no longer tie up a worker; the upload simply resumes where it left off.
- Analytics: the tracking beacon no longer re-checks the database structure on every single page view — it only sets things up if something is actually missing.
- Audience (CRM): segment sizes are now counted directly in the database instead of loading every matching contact into memory, so the Segments screen stays fast on large lists.
- A/B tests: a winner is now declared only once every variant has reached the full sample size, matching what the screen tells you to wait for.
- Forms: spam submissions can no longer grow without bound — only the most recent are kept per form.
Fixed
- Social: the connected app's client secret is now stored encrypted, matching how access tokens are already protected.
- Video Studio: the 90-second limit is now enforced on the server too, so an over-long video can't slip through and be rejected by Instagram — you're asked to shorten the script and re-render instead.
- Contact form: on older installs, clicking "Spam" on a message could silently lose it; the message list now repairs the underlying field first so the message is safely kept.
- Forms: dropdown / radio / checkbox answers are now validated on the server against the defined options, so a made-up value can't be slipped past the form.
Plugin review, round three: push notifications, downloads, AdSense checker
Improved
- AdSense readiness checker: the scan no longer loads every post into memory at once, so it runs reliably on sites with thousands of posts.
Fixed
- Push notifications: the list of trusted push services is now matched strictly, so a look-alike address (a domain merely ending in a trusted name) can no longer register and receive your notifications, and only secure addresses are accepted.
- Push notifications: publishing a post no longer waits for every subscriber to be notified before the save completes — the save finishes at once and notifications are sent right after, within a time budget so a large subscriber list can never stall or crash the publish.
- Downloads: a download link with a set limit can no longer be pushed past its limit by firing several downloads at the exact same moment.
- Editorial calendar & recipes: the admin permission check on these screens is now unconditional, closing a theoretical gap where it could have weakened if the code were loaded differently.
Plugin review, round two: quizzes, Google, recipes, Cloudflare
Improved
- Google: the plugin no longer re-checks its database structure on every admin page load — it does so only once per version.
- Cloudflare: clearing the cache after you publish or edit a post no longer holds up the save while Cloudflare responds — the save finishes immediately and the purge runs right after.
Fixed
- Quizzes: a page containing an embedded quiz could fail to load because the view counter had nowhere to record to. The counter now has its place, is added automatically to older sites, and can never take a page down again.
- Quizzes: a published quiz now has its own shareable page, so the "View" link in the admin opens the quiz instead of a "not found" error.
- Quizzes: the WordPress importer now refuses image and page addresses that point back into the server's own network, and verifies the remote site's certificate.
- Google: the "automatically notify Google when new content is published" checkbox now genuinely turns the feature on — before, it looked enabled but every submission was quietly refused.
- Google: the manual "submit for indexing" action now only accepts addresses on your own site.
- Recipes: a recipe with no usable image no longer publishes structured data that Google would reject — the recipe rich-result is emitted only when it will actually validate.
- Cloudflare: applying the recommended security rules can no longer wipe your own custom firewall rules if reading the current rules momentarily fails — the change is aborted instead.
Plugin review, round one: safer AI images, newsletter and notifications
Improved
- Web notifications: subscriber records are handled more efficiently, without needless database work on every visit.
Fixed
- AI images: a picture returned by the image provider is now downloaded only from a safe public address; an address that points back into the server's own private network is refused.
- AI images: when generation fails, the error message no longer risks showing your API key — the key is now hidden.
- AI images: if the daily image limit can't be read for a moment, the system now stops generating rather than continuing without a limit, so you are never billed past your cap by accident.
- Newsletter: an email template you edited by hand is no longer overwritten by an update — only templates you never touched are refreshed.
- Newsletter: the weekly digest is now sent only once even if two runs happen to start at the same moment.
- Newsletter: the sign-up form no longer reveals whether an address is already on the list — the reply is the same either way.
- Web notifications: the subscribe endpoint is now protected against being flooded with fake entries.
- Stories: reaction counts now change only from a genuine visitor tap, and a reaction sent from another site is ignored.
Video Studio: 90-second cap so videos stay Reels-eligible
Improved
- Studio videos are now capped at 90 seconds. Instagram only places videos of 90 seconds or less in the Reels tab; a longer one would post as an ordinary video instead. The narration is already about a minute, so this only affects manually lengthened scripts — and when it does, both the picture and the sound are trimmed at the same point, so the file really stays within the limit. The script step notes the limit as you type.
Video Studio: sturdier YouTube and Instagram publishing
Fixed
- A Reels or Shorts upload that got stuck while the platform was still processing it could keep polling for up to a day. Such a job now gives up after a reasonable window and is marked failed, so one stuck upload no longer ties up the publishing queue or the daily quota.
- A video scheduled for a future time is no longer mistakenly timed out because of the wait before its scheduled moment — the timeout window now starts from the scheduled time, not from when the job was created.
- The full multi-step publishing flow for both platforms — Instagram's create / wait / publish sequence and YouTube's resumable upload that continues after an interruption — was verified end to end, including recovery when a connection drops or a session expires.
License security hardening
Fixed
- The admin license screen now shows only a masked version of the license key instead of the full value.
- License activation and deactivation now require an admin login on every install, including freshly installed sites that do not yet have an active license.
- Demo-license validation now relies on the site's configured address rather than a value taken from the request, so activation stays tied to the real domain.
- Premium features, plugins and themes now follow the installed edition: a paid package (already purchased to download) keeps everything unlocked even if its token lapses, while the free package is correctly limited.
- The update-download endpoint now rate-limits per address and only responds to expected origins.
New: Video Studio — turn posts into narrated Shorts and Reels
Added
- Video Studio (in the Social plugin): pick a post and the studio writes a ~60-second narration script in your site's language, reads it aloud with a natural AI voice (30 voices, Turkish included — uses your existing Gemini key's free tier, so it costs nothing), and renders a 1080×1920 vertical video with your post's images, animated captions and your site's name — right in your browser. No server video software is needed, so it works on ordinary shared hosting; rendering requires Chrome or Edge.
- One-click publishing to YouTube Shorts and Instagram Reels through the existing social queue, with retries and rate limiting handled for you. Instagram connects with your own Meta app in development mode — publishing to your own account needs no app review. For YouTube, connect your own Google Cloud app; note Google locks videos from unverified API projects to private, so until you complete Google's verification the studio's "Download + open YouTube Studio" button is the recommended path — it saves the video, copies the title and description to your clipboard and opens YouTube Studio, making manual upload a 30-second task.
- Every text the studio produces — narration, YouTube title and description, Instagram caption, hashtags — is fully editable before anything is voiced, rendered or published. A "draft job" can be opened automatically whenever you publish a post, so fresh posts wait for you in the studio.
Comments and the contact form: lost messages found their way back
Fixed
- On the Personal theme the contact form posted to an address that did not exist: every message a visitor sent ended in a 404 and was never stored anywhere. The address now reaches the protected handler, and when JavaScript is off the visitor is brought back to the page with a clear "received" or "failed" notice instead of a raw code screen.
- On the Entertainment theme comments were broken twice over: approved comments were never shown (the list pulled in a file that did not exist), and a signed-in reader's comment was always rejected asking for a name the form never collects. The list renders again and the handler now fills in the reader's name and email from their account.
- On eight of fourteen sites the spam capture log still had an old table layout, so every catch failed silently: blocked bots left no trace, the admin screen showed zero blocks, and the "repeat offender" signal never fired. The table now completes its own missing columns on first use.
- Thirteen themes' comment forms used a spam-trap field literally named "website" (one theme even added "phone"). Browsers recognise those names and auto-fill them — and a real reader whose browser did so had their comment silently thrown away. The trap fields now use a neutral name browsers ignore.
- Every comment and contact submission was counted twice against the flood limits, so the caps the admin configured were effectively halved.
- All three settings on the contact form panel were dead: the recipient address was saved but notifications kept going to the general address, the custom success message was never shown, and the auto-reply was never sent at all. All three now do what the screen says — auto-replies also carry a once-per-hour-per-address brake.
- The site-wide comments feed now includes only comments from published, public posts. It is also reachable now: the feed advertised its own address but the address had no route and bounced to the home page.
- The comment moderation screen and the panel reply endpoint now require full moderation permission, not just any signed-in account.
- A reply written from the panel did not update the post's comment counter, and the person being replied to never got the "someone replied to you" email even when that notification was switched on.
- Comment notification emails were always in Turkish, even on English sites; they now follow the site language. The contact form's success and error notices also had no colour in themes without their own styling.
A/B tests: the numbers are now real visitors' numbers
Fixed
- A/B test results counted search engines and automated crawlers as if they were readers: every crawl added impressions, and a crawler following the conversion link added conversions. A test could crown the wrong winner on traffic no human ever saw. Crawlers still see the page content as before, but they no longer touch the statistics.
- On a site installed in a subfolder, a conversion goal written as a plain path ("/contact") redirected the visitor to the server's root instead of the site's own page — usually a 404. Plain paths now resolve against the site's own address.
- Behind services like Cloudflare, every visitor appeared to arrive from the same address, so which variant a visitor saw depended almost entirely on their browser make — most people got the same variant and the split was badly lopsided. The variant assignment now uses the visitor's real address when a trusted proxy provides it; sites not behind a proxy are unaffected.
- Turning a plugin off left its placement codes ("[ab id=3]", "[form id=5]"…) sitting in the middle of published posts as raw text for every reader. Leftover placement codes from an inactive plugin are now removed from the page.
- Plugin placement codes also leaked as raw text into the RSS, Atom and JSON feeds, because feeds deliberately skip the plugin rendering step. Feeds now clean them out at the source.
Analytics: the settings on the screen now actually do something
Improved
- Every page of every site ran three table-creation statements and nine setting inserts before rendering, on every single request. That check now happens once and remembers the answer; the admin screens still repair themselves on demand.
Fixed
- The analytics master switch did nothing. Turning tracking off left the counting script on every page and the receiving endpoint still wrote every visit to the database, even though the screen said no data would be collected. The endpoint that receives visits now reads the settings before it stores anything, so off means off. The excluded-IP and excluded-path lists were dead in the same way and now work too.
- The free edition collected visitor data with no way to see it and no way to stop it: the analytics screens are not part of that package, but the counting script and the receiving endpoint were. Neither runs now unless the analytics module is installed.
- Any other website could post fake visits to the receiving endpoint from a visitor's browser and skew the reports. Requests that identify themselves as coming from somewhere else are now refused.
- Every comparison figure was biased upward. "7 days" actually measured eight calendar days and compared them against a seven-day span, so the up-and-down badges on the cards flattered the current period on every range. Both windows are now the same length.
- The same page was counted several times over: an address with "?page=2" or a campaign tag on the end became its own row in the most-viewed list. Addresses are now reduced to the page itself, for existing history as well as new visits, and web-encoded characters in Turkish addresses are decoded so they read normally and match the right article.
- Daily totals were being lost for good. The receiving endpoint and the housekeeping task both rotate the daily privacy key, and whichever got there first made the other skip that day's summary — one site had summaries for only 42 of its 83 days. Summarising no longer depends on the key, and missing days are recomputed from the raw records that are still within the retention window.
- Analytics silently collected nothing on installations where the first database file the endpoint found was not the one in use — it gave up instead of trying the next one. It now uses the first connection that actually works.
- The bounce rate loaded every visit session of the selected period into memory to count them; on ninety days of a busy site that is tens of thousands of rows for a single percentage. The database does the counting now.
- A malformed address in the browser bar ("?range[]=x") crashed the analytics screen with a server error.
- Saving the analytics settings and then refreshing the page submitted the form again.
Advanced SEO panel: tools that had quietly disappeared are back
Improved
- Long tool tables no longer scroll inside their own frame. The panel measures the tool it is showing and grows to fit, so the slug repair and content SEO lists — hundreds of rows — scroll with the page instead of trapping a second scrollbar inside it.
Fixed
- The heading hierarchy screen could not be opened from anywhere in the panel. It lists every published article whose headings start at the wrong level and fixes them in one click — on a test site it had findings for two hundred articles — but when the SEO tools were gathered into a single panel, this one screen was left off the menu, and the panel hides each tool's own tabs. It is now a module of its own, under Content.
- On installations where the Advanced SEO plugin is switched off, eight tools became unreachable: the SEO overview, heading fixer, content optimiser, internal linking, featured images, slug repair, orphan content and the year updater. They were removed from the main menu when the panel took over as their single entry point, so switching the panel off left the files installed and invisible. Five sites were in exactly that state. The menu now falls back to an "SEO Tools" entry whenever the panel is unavailable.
- The panel listed every tool it knows about, whether or not that screen exists in the installation at hand. A missing screen produced an empty white frame with no explanation, because a page that is not found says nothing inside a frame. The panel now lists only the tools it can actually open.
- Fixes to the panel screen itself never reached existing sites: the update tool carried the plugin's code but not the page that draws it. It is now on the list.
Critical: the installer failed on its final step
Fixed
- New installations failed at the last step of the wizard. The installer carries its own copy of a small helper for reading PHP size limits, and the core gained a function with the same name on 7 August — so the moment the wizard loaded the core to finish setting up, PHP refused the duplicate and the install stopped with a server error. The installer's copy now has its own name, which also keeps its behaviour independent of the core's version. Anyone who downloaded the package between 7 and 18 August should download it again.
- The end-to-end install test that would have caught this now runs against the packaged installer, and its error detection no longer trips over the words "server error" appearing inside a script comment — a false alarm that masked whether the page was actually broken.
Article pages stop being dead ends, and the ad-readiness panel now sees template repetition
Added
- Shared sidebar modules — categories, topics and recent posts — that any theme can use without carrying its own copy. A theme that ships its own version keeps it; the shared one only fills the gap.
- Three new checks in the ad-readiness panel, covering what it could not see before: how much of the site shares one title pattern or one section skeleton, how many posts run without a single image in the body, and whether a large batch of posts was published on one day. These are the traits that make a site read as machine-produced regardless of how well each article is written.
Fixed
- One theme had its tag list switched off in code. The line dated back to when tag pages returned “gone”, and it was never revisited after those pages started serving again — so a site whose every post carried tags published not a single tag link. The list is back.
- Three themes never printed tags at all, although most of their posts were tagged. An article that ends without a single onward link is a dead end for the reader and for a crawler alike.
- The personal theme shipped its category, tag and recent-post modules switched off, so the sidebar of an article carried three links in total. The same article rendered by the theme that did get ad approval carries thirty-nine. The modules are on by default now.
- The travel theme's article rail held only a table of contents, share buttons and a back-to-top button; the theme's own richer sidebar was never included on article pages. Category, tag and recent-post navigation now sits in the rail.
Image dimensions everywhere, and archives now list their posts in structured data
Added
- Category, tag and author archives now publish the list of posts they show as structured data. The page already declared itself a collection, but never said what was in it; the list is built from the same query the theme uses, so it cannot drift from what a visitor sees.
Fixed
- Resized image variants never received width and height. The lookup stripped the size suffix from the filename but removed the file extension along with it, so the name it searched for could never match a stored one — a comparison that could not succeed by construction. Every related-post card and listing thumbnail was therefore published without dimensions, and those are the most numerous images on a page: each one shifted the layout while it loaded. Sizes now come from the file itself, so the variant reports its own true dimensions.
- Author avatars and site logos were skipped entirely. They are not stored in the media library, so no size was ever known for them, and an avatar can appear half a dozen times on a single article. They are measured now — layout treatment for them stays unchanged, only the dimensions are added.
- The featured image went into the structured data without dimensions on sites whose images predate the media library, even though the in-content images had them. That is the one image search engines look at first.
- The single post page now declares its author and section to social networks as well. Publication and modification times were already sent; the author was only in the structured data, so shared links carried no author attribution.
API settings: quotas now apply to content generation, and usage statistics finally count it
Added
- The API tab now opens with the automation entry points it is named after: a link to the REST API keys used by n8n, Zapier or your own script, and one to the ready-made n8n workflows. Both had moved to other screens with no way back from here.
- Each AI setting now states what it governs — which calls a quota covers, that the token limit applies to analysis rather than article length, and what the cache window actually caches.
Fixed
- The daily and per-account AI quotas were only applied to SEO analysis. Article generation — the path that actually spends most of the tokens — ignored them completely, so a site set to 200 calls a day could make thousands, and on a paid provider that lands straight on the owner's bill. Both quotas now cover every AI call, and the screen shows how much is left.
- The usage statistics counted the same narrow path, so most sites saw zeros no matter how much they generated. Every generation call is now recorded with its provider, model, token count and duration.
- The temperature slider did not reach article generation either: that code carried a fixed value and the setting only affected analysis. The configured value now applies everywhere it is accepted.
- The API key test endpoints now require an administrator account, matching the screen that calls them.
- The model field accepted an empty value and stored it, which left every later request pointing at no model at all — generation failed with nothing on screen to explain why. Empty and malformed values now fall back to the saved model.
- The default provider field accepted any text. An unrecognised value made the site report "no AI key connected" while the key sat there saved.
- Choosing a provider hid the other providers' key fields, and they could not be reached again without reloading — even though keys are stored per provider and several can be filled in. Nothing is hidden now; the default provider is marked instead.
- With a provider other than Gemini selected, the panel claimed the integration was off and asked for a Gemini key although generation was working. The status now follows the provider actually in use.
User management: lockout protection, account status and a single password rule
Added
- Accounts can now be deactivated instead of deleted. The account status was stored and enforced everywhere — an inactive account cannot sign in and is hidden from author pages — but there was no way to set it from the panel, so the only way to stop someone from signing in was to delete their account along with everything attached to it.
- Locked accounts can be released from the user's edit screen. After five failed sign-in attempts an account locks for fifteen minutes, and the counter only cleared on a successful sign-in — so someone who could not remember their password stayed locked out with no way for an administrator to help. The current lock state and the failed-attempt counter are now shown, with a control to clear both.
- The user list now marks inactive, banned and locked accounts, so "why can't I sign in?" has a visible answer.
Fixed
- The last administrator could lock themselves out of their own site. Changing your own role to subscriber, deactivating your own account or deleting the only administrator was accepted without a word — and afterwards nobody could reach user management again, with no way back except editing the database by hand. All three paths are now refused while no other active administrator remains.
- The role field accepted any value that was posted. A value outside the four known roles silently emptied the role — leaving an account that could sign in but had no permissions at all — and on databases in strict mode it broke the save outright. Role and status are now checked against their allowed values.
- Usernames were stored exactly as typed, including spaces and slashes, even though the username is also the author page address. A username can no longer be set to an e-mail address either: the sign-in screen accepts both a username and an e-mail, so the two would collide.
- Changing a username left the old author page as a dead address; it now redirects to the new one, the same way category addresses already did.
- The user screen enforced no password rule at all — "123" was accepted. Both the user screen and My Profile now apply one shared rule: at least eight characters with a letter and a digit, and obvious passwords are refused.
- Changing a password now also ends that account's "remember me" session on both screens, so older browser cookies stop working immediately.
- With a role filter active, the "All" tab showed the filtered number rather than the total, and paging through search results silently dropped the search.
- Deleting a user left their avatar file behind on disk.
Spam Protection screen rebuilt, and its settings now save reliably
Fixed
- The Spam Protection screen was built with a layout system the admin panel does not use, so none of its structure applied: the four summary figures stacked into four full-width bands down the page, the settings sat in a single narrow column, and the icons never appeared. The screen is rebuilt with the panel's own components and now reads as one page: summary cards across the top, settings in the main column, quick actions and blocked addresses alongside.
- A status line at the top now states plainly whether protection is on. Every threshold on the page is meaningless while the master switch is off, and nothing on the old screen said so.
- Turning protection off was never saved: the screen decided the switch's state from the presence of the field rather than its value, so the setting stayed on no matter what was chosen.
- Turning the master switch off also erased the thresholds underneath it — link limit, submit time, flood caps all fell back to factory numbers, because disabled fields are not submitted by the browser and the screen treated a missing field as a request to reset. A missing field now keeps the saved value.
- Out-of-range values were stored as typed; they are now kept within the limits the screen advertises.
- The minimum submit time was an admin setting the guard did not read: the screen could say five seconds while the server decided at three. The configured value is now the one that applies.
- Spam catches were being written to a table that some installs never had. The repair routine existed but was never called from anywhere, so on those sites every caught bot vanished without trace and the screen reported nothing. The table is now created on demand and the write is retried.
- Several English labels on this screen showed placeholder text generated from their internal names; they have been written properly. Two Turkish descriptions described the wrong thing.
Spam protection: one shared surface for every public form
Added
- Public forms now share a single anti-spam surface. Comments, the contact form, the newsletter box and the form builder each had their own hand-built protection, and they had drifted apart. One component now renders the hidden protection fields and one function runs the shared checks, so a new form is protected by construction rather than by remembering to repeat the work.
Improved
- Bot catches are now recorded. Honeypot hits, instant submissions and flood blocks were silently discarded on the comment channel, so there was no way to tell working protection from absent protection; they are logged now.
Fixed
- The timing check that catches instant bot submissions was inactive on five themes and the newsletter box, because the field it reads was never rendered there; one theme's comment form had no honeypot at all. Every public form now carries all three protection fields.
- The newsletter box never sent its hidden fields at all: the script assembled its own payload from just the e-mail address, so the honeypot on that form could never trip. The whole form is submitted now.
- Messages flagged as spam by the contact form were stored with an invalid status, because the column had never been extended with a spam value. They appeared in no folder — including the ones caught by mistake, which is exactly what the spam folder exists to prevent. The column is repaired automatically and previously mis-stored messages are recovered.
- One theme's comment form posted to an address that does not exist, so signed-in readers' comments went nowhere.
- Comment length limits counted bytes rather than characters, so Turkish text was measured incorrectly — a long comment could be refused while a single-letter name passed. Both channels now measure the same way.
- Names and subjects accepted line breaks, which single-line fields should never carry; the value is now cleaned on the way in.
Go live today
Setup, content management, SEO and image optimization — all in one platform. Get started in 30 minutes.
View Pricing- Setup and live in 30 minutes
- 14 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO — Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)