Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 7 of 20 — 576 releases, newest first.
Tags no longer lead nowhere, and images declare their size
Fixed
- Tag links led to a bare “410 Gone” screen. Themes show tags in several places — under the article, in the sidebar cloud, on archive and search pages — but tag pages were only served when tag archives were switched on, which they are not by default. Every tagged article therefore carried several dead internal links, and a reader who clicked one landed on an unstyled error page. Tag pages are now always served with the site's own design; the setting decides only whether search engines may index them. With it off they are shown to readers but marked noindex and left out of the sitemap, exactly as before.
- Images inside articles were rendered without their dimensions, so the page reflowed as they loaded — the layout shift that Core Web Vitals measures. Both the article's main image and images inside the text now declare their size, taken from the media library, across every theme. In-text images also load lazily while the leading image stays eager, which is what browsers need for the largest element to appear quickly.
Legal pages: updated details now apply, duplicate date and mangled e-mail fixed
Fixed
- Correcting your contact e-mail, address or business name and generating the legal pages again left the pages unchanged, still showing the details from installation. The generator kept any page that was long enough, to avoid overwriting text you had written yourself — but that also protected the untouched pages that shipped with the install. The generator now recognises a page you have never edited and refreshes it with your new details, while a page you edited by hand is still kept, and now says so and points to the overwrite option.
- Legal pages showed the last-updated line twice, with two different dates: the generator wrote one into the page text while the theme printed its own. The line now comes from the theme only, and pages that were never edited have the leftover line removed automatically when the Pages screen is opened and during maintenance.
- The last-updated date always showed today, on every theme, even for a page that had not changed in months — a misleading claim on a legal page. It now reflects when the page was actually last saved.
- Turkish spelling correction in the generated text ran across the whole page, including e-mail addresses and links, so an address such as iletisim@example.com could be rewritten into an invalid one. Addresses and links are now left untouched while the surrounding text is still corrected.
Media: half-rendered screen on an empty library, and file types
Fixed
- The media library stopped rendering half-way down the page whenever the library was empty — which is exactly the state of a brand-new site. The file counters are produced with SQL sums, and a sum over zero rows is empty rather than zero; feeding that empty value into the counter text raised an error that ended the response early, so the page arrived without its grid, upload button or closing markup. The counters are now normalised to zero, and the translation layer no longer lets an empty value end a page.
- Every uploaded file was recorded as an image, whatever it was: PDFs, documents, spreadsheets, archives and text files all carried the image type in the library records. The type is now derived from the file itself, and existing records are corrected once during routine maintenance.
- The Video tab listed the entire library instead of videos, because that tab had no filter of its own. Video and audio now filter correctly, the Documents tab no longer mixes media files in, and the item count matches what the tab actually shows.
Built-in pages: stable dates instead of a false freshness signal
Fixed
- Pages served from a theme template rather than a stored record announced the current moment as their publish and modification date, so the structured data changed on every single request — two requests three seconds apart reported two different timestamps. Search engines were told the page had just been edited every time they fetched it. These pages now carry a stable date taken from the template that produces their text, so the date only moves when the text actually changes.
- The same pages were listed in the sitemap with today's date every day, the same "permanently fresh" signal the homepage and category listings were corrected for earlier. Their sitemap entry now uses the same stable date.
Pages: duplicate legal URLs, sitemap gaps and SEO visibility
Security
- The Pages hub now requires the page-editing capability. It previously checked only that someone was signed in, which gave accounts holding lesser roles more reach over published legal text than intended.
Improved
- The legal page status table now shows how each page actually appears to search engines: its canonical address, whether it is indexable, whether it is in the sitemap, and its meta description length — with a plain-language note when something needs attention.
Fixed
- Legal pages served from the theme template — the default state of a fresh site — answered on both their Turkish and English addresses with identical content, and each address declared itself canonical. Measured: /privacy and /gizlilik returned the same page byte for byte as two indexable URLs. Every alias now collapses onto one address per document, chosen by the site language, exactly as it already did once a page existed in the CMS.
- Those same pages were missing from the sitemap: live, indexable, but never submitted, because the sitemap only listed pages stored in the database. Privacy, terms, cookie policy, disclaimer, about and contact are now listed whenever they are served, and a page stored in the CMS replaces the built-in entry instead of being listed twice.
- Legal, about and contact pages served from a theme template carried the site-wide meta description — the same sentence as the homepage — because the route never handed the page's identity to the theme. Each now carries its own description; verified across every theme.
- The legal page editor screen answered with a server error on every install: it queried a table that belongs to the jekcms.com marketing site and does not exist in the CMS. The address now redirects to the page it was meant to open.
- Generated legal pages calculated reading time with a counter that splits Turkish words, inflating the estimate by roughly 40%.
Menus: second menu could not be created, plus icon support
Added
- Menu items can carry an icon (emoji), set next to the title in the menu editor and shown in every theme's navigation.
- Menu items whose parent was removed used to vanish from the navigation; they are now shown at the top level instead of being silently dropped.
Security
- Menu links are now restricted to safe schemes: a `javascript:` or `data:` link saved into a menu is stored and rendered as an inert "#".
Fixed
- Creating a second menu failed with a server error. Menus carry a unique slug, but the create/update code never wrote one: the first new menu was stored with an empty slug and every menu after it collided with it. Menus now get a unique slug derived from their name, and existing rows with an empty slug are repaired automatically. Renaming a menu keeps its slug, so nothing that points at it breaks.
- The Tech theme ignored the menu module completely — its header always printed the first five categories, so nothing configured under Menus ever appeared. It now publishes the assigned menu and falls back to categories only when no menu exists.
- A menu assigned to the "Main" location was invisible on every theme, because themes read the "Header" location. "Main" is now treated as an alias of the header location, so existing menus start working without being touched, and the location list only offers what themes actually render.
- When two menus shared one location, which of them appeared was left to chance. The site now consistently shows the older one, and the Menus screen warns that the others stay hidden.
SERP site name: save defect fixed, end-to-end identity checks
Added
- SERP Identity Check now verifies the whole live chain Google reads for the site name — homepage reachability and indexability, the title, og:site_name, the WebSite schema name/url/alternateName, the canonical, the favicon, and whether the www variant consolidates onto one host — so a broken link in the chain shows up without waiting for a re-crawl.
- Settings → General now flags a site name that is empty, generic, or a literal copy of the domain right next to the field, since Google falls back to showing the domain in those cases, plus a direct link to the identity check.
Improved
- The identity check no longer reports internal state rows (plugin schema markers, heal flags, cached audit payloads) as autoload defects — they are excluded by design, so the check can now actually report a clean install and a real defect stands out.
Fixed
- A setting could fail to save entirely when its stored row lived under a different group label: the settings table keeps `key` globally unique, but the shared save helper looked the row up by group plus key, found nothing, and then tried to insert — hitting a duplicate-key error. The value silently never applied, which for the site name meant search results kept showing the domain. The save path now resolves by key (as the read path already did) and moves the row to the requested group.
- Breadcrumbs on Turkish sites announced the root as "Home" even though the site declared itself Turkish. Google shows breadcrumbs in search results, so the trail now uses the site's own language ("Ana Sayfa").
SEO audit: pagination signals and robots consistency
Improved
- rel=prev/next pagination links are now emitted centrally for every theme — including the four themes whose headers never passed pagination context.
- Page 2+ of the home/blog feed now carries the page number in its title instead of duplicating page 1's title.
Fixed
- Out-of-range pagination URLs (?page=N beyond the last page) returned an empty archive with HTTP 200 and a self-referencing canonical — an infinite, indexable space of thin duplicate pages. Every paginated list (home feeds, category/tag archives, author pages, every theme) now returns a real 404.
- The personal theme stamped paginated archive pages with an extra "noindex, follow" robots tag next to the core's "index, follow" — conflicting directives, and search engines pick the restrictive one, silently dropping page 2+ from the index. Paginated archive pages are all indexable again with a single robots tag.
- A per-post robots value saved as plain "index, follow" wiped the core defaults' max-image-preview:large directive, costing those posts large-thumbnail eligibility in Google Discover. Indexable robots values without max-* directives now get the default set appended.
- URLs of non-paginated pages (a single post, a fixed homepage) with a stray ?page=999 served identical content that declared itself canonical — the canonical now keeps ?page only on genuinely paginated templates and consolidates everything else onto the clean URL.
AdSense readiness: aligned with current approval criteria
Added
- New audit check: the privacy policy is now scanned for Google's "Required content" disclosures — cookie use, the third-party (Google) advertising-cookie statement and the personalized-ads opt-out link. If you rewrote the generated legal pages and dropped these sections, the audit catches it.
- New audit group: ad-click encouragement phrases ("click the ads", "reklamlara tıklayın") are now scanned in titles, slugs and bodies — the clearest program-policy violation there is.
- New sidebar card: applicant requirements (18+ age rule, the 6-month site-ownership rule that applies in some countries, HTML source access).
Improved
- The consent-banner check now explains the certified-CMP rule accurately: since January 2024, serving ads to EEA/UK/Switzerland visitors requires a Google-certified CMP (IAB TCF) — the built-in banner covers the GDPR baseline but does not replace it; enabling Google's own consent message under AdSense → Privacy & messaging after approval satisfies the rule. The application-day checklist gained the same step.
- The policy-scan pass message now states its honest scope: Google's prohibited-content list is broader (hate speech, misleading health/election claims, deceptive practices) than what pattern scanning can detect.
Fixed
- Policy patterns containing the Turkish dotless "ı" (e.g. "şifre kırma", "sızma testi") were silently missed in ALL-CAPS titles because uppercase "I" lowercases to "i", not "ı". The scanner now folds both the text and the patterns to a shared canonical form, so case no longer hides a match.
Settings audit: SVG hardening in the branding preview
Security
- The generated-logo and favicon SVG fields are now sanitized before they are stored and before they are rendered in the branding preview. These are hidden form fields, so a tampered value could previously carry an event handler (e.g. onload) or script into the admin branding screen; the old check only rejected literal <script> tags and the preview printed the markup raw. Legitimate generated logos are unaffected.
License & update audit: free-tier update channel repaired
Security
- Update availability queries without a license key are now treated as the lowest tier and only see the core release, matching the existing rule for unknown keys.
- The license heartbeat endpoint no longer includes internal error details in its 500 responses outside debug mode.
- The tripwire reporting endpoint now has an IP rate limit, closing an unbounded-log disk-fill vector.
- Expired one-time download tokens are now swept opportunistically instead of accumulating forever.
Fixed
- Free-tier installations could not install core updates: the server correctly serves the free package, but the signed update manifest only listed the full package's checksum, so the client's tamper check rejected the legitimate free download as a mismatch. The manifest now carries a signed entry for the free package too, and the client accepts either signed checksum — the tamper protection itself is unchanged.
- The update manifest no longer embeds full internal catalog rows (IDs, file paths, changelog text); it now carries exactly the fields clients verify, which also makes the signed payload much smaller.
Redirect manager overhaul: 404 suggestion engine revived, URL matching fixed
Improved
- Pasting a full URL of your own site as the redirect source now works — the domain is stripped and the path is stored canonically; foreign-domain sources are rejected with a clear message.
- Static-asset 404s (missing images, fonts, bot .env scans) are excluded from the suggestion log so real page URLs aren't buried in noise.
- The redirects table is now self-healing on older installations where it never existed — adding a redirect no longer fails with a generic error, and automatic 301s on slug changes work there too.
Fixed
- The "Orphan 404s" suggestion engine never received any data: the 404 logger existed but nothing ever called it, so the tab read from a table nothing wrote to. 404s (including theme-rendered ones) are now logged centrally, so the one-click "create 301" suggestions finally appear.
- Redirects with Turkish or other non-ASCII characters in the slug never fired: the browser sends the URL percent-encoded while the redirect was stored decoded, and the two were compared as raw strings. Requests are now normalized exactly like the router normalizes them (decoding, trailing slash, subfolder base path), so /eski-yazı style redirects work.
- Redirects were completely dead on subfolder installations (e.g. example.com/blog): the incoming path carried the folder prefix while the rule was stored without it, and relative targets redirected to the domain root instead of the subfolder.
- Saving a redirect whose target equals its source is now rejected — previously it created an infinite redirect loop in the browser.
- Form resubmission on refresh is gone: actions now follow the POST→redirect→GET pattern, so pressing F5 after toggling a redirect no longer silently toggles it back.
- The "Hits (30 days)" stat actually showed the lifetime hit total of recently-hit rules; it is now split into an honest "Total hits" and "rules hit in the last 30 days".
SEO tab: archive indexing controls and Pinterest verification
Added
- Archive Indexing panel in Settings → SEO: the thin-content engine that decides whether author and category archives are indexable was always running, but its knobs were hidden. You can now turn author-archive indexing on/off and tune the minimum-post thresholds for author and category archives — meta robots and the sitemap follow the same values, so Google never gets conflicting signals.
- Pinterest site verification field: the meta tag output has supported Pinterest verification all along, but the form only offered Google, Bing and Yandex. The fourth field is now there.
Fixed
- The “AI bot access” shortcut in the SEO checklist pointed at an anchor that didn't exist on the page, so the click landed at the top instead of the AI bot panel. The anchor now exists and the link scrolls to the right place.
- Archive threshold values are clamped to a sane 1–50 range on save; previously a 0 or negative value silently fell back to a different number than the one shown in the form.
Security hardening: 2FA replay protection, backup codes, secret handling
Added
- Backup recovery codes: enabling 2FA now generates ten single-use codes shown once. If you lose your authenticator device you can still sign in — no more lockout requiring server access. Codes can be regenerated with a current code.
- Mandatory 2FA policy: a new toggle can require every administrator to use two-factor authentication; admins without it are guided to set it up at login and can't disable it while the policy is on.
- The File Integrity Monitor now shows a distinct “monitoring inactive” state when no manifest has been created yet, instead of falsely reporting “clean”.
Security
- Two-factor codes can no longer be reused: each 6-digit code is now single-use within its time window (a captured code can't be replayed on another session).
- The reCAPTCHA secret key is now encrypted at rest and is no longer written back into the settings form's HTML.
- Two-factor secrets are now stored encrypted (same protection as mail/API secrets).
- reCAPTCHA on the admin login now fails closed: if Google's verification service is unreachable, login is blocked (comment/contact forms still fail open so real visitors aren't blocked; this is configurable).
- Re-keying an already-enabled 2FA now requires the current code.
Mail overhaul: honest delivery status, diagnostic errors, deliverability tools
Added
- Every core e-mail (sent or failed) is now logged, and the Mail tab shows a “Recent Sends” panel with per-message errors — failures are finally visible instead of dying silently.
- One-click Deliverability (DNS) check on the Mail tab: verifies the sender domain's MX, SPF and DMARC records — the three most common reasons mail lands in spam.
- A clear warning appears when the sender address and the SMTP account are on different domains (the classic setup that providers treat as spoofing).
Fixed
- The core SMTP client never checked the server's replies — a rejected recipient (550) or rejected message (554) was still reported as “sent”, so failed contact-form, comment and download-delivery e-mails vanished without a trace. Every SMTP step is now verified and failures carry the server's exact response.
- The “Send test” button used a different mail engine than real notifications — a passing test could hide a broken production path. The test now exercises the same engine your notifications use (and no longer depends on the newsletter plugin being present).
- The admin's PHP mail() / SMTP method choice was ignored by core notifications; it is now honored everywhere, and authless SMTP relays (no username) work.
- Scheduled-task e-mails were sent raw with an empty From header due to a settings-lookup bug; they now go through the same configured engine.
- E-mails now include Date and Message-ID headers, a plain-text alternative part and base64 body encoding (all common spam-score factors), attachments finally work over SMTP, and connections have proper timeouts.
Ad manager overhaul: every slot now works, new revenue placements, premium controls
Added
- New “End of Article” slot — the ideal spot for an AdSense Multiplex unit, monetizing readers who finish a post. Works in every theme automatically.
- Four previously dead slots now work in every theme with zero theme edits: mobile bottom anchor (with a dismiss button), mobile top banner, sidebar top and sticky sidebar — the core injects them universally.
- Revenue Settings panel: in-content ad interval (every N paragraphs, following the 300–500 word rule) with a per-page cap, lazy loading for below-fold ads (protects Core Web Vitals), a GDPR consent gate that holds custom ad codes until the visitor accepts cookies, and an editor for extra ads.txt lines (non-Google networks/resellers).
- The Banner Manager's [banner id=N] shortcode finally renders on the site — it previously appeared as plain text because no frontend handler existed.
- Slots in the admin are now ordered and badged by earning power (in-article and above-the-fold first), and slots the active theme can't print are labeled clearly.
Fixed
- In-article ads no longer appear in 3-paragraph posts (a counting quirk made the threshold more aggressive than documented) and never land right before the article-end ads (no stacking).
- The Pets theme printed the in-article ad at the very end of the post, stacked on top of the bottom ad — it now flows between paragraphs like every other theme.
- Ad styles were emitted up to three times per page; now exactly once.
- List ads (in-feed) filled their gaps: Travel archives, search results in five themes and homepages in seven themes now show the between-posts slot.
- Post descriptions in structured data no longer leak raw shortcodes like [banner id=3].
- Deleting a banner now uses a POST request (the CSRF token no longer travels in the URL).
- Side discovery: the spam settings save path called a function that did not exist anywhere — saving spam settings or the auto-blacklist would have crashed. Defined properly.
Maintenance cleanup is now actually scheduled
Fixed
- A re-audit found that the daily maintenance cleanup (expired cache, rate counters, stale feed/sitemap files, old sessions, log trimming) lived only in a legacy cron script that nothing ever invoked — so in practice none of it ran. It is now wired into the real scheduler body that both server cron and the visitor-triggered fallback execute, with its own 24-hour interval guard. Verified end-to-end: planted stale files were swept, fresh files and still-valid caches were left untouched.
Disk hygiene: every cache now cleans up after itself
Fixed
- Rate-limit counter files (one tiny file per visitor IP) could pile up indefinitely on hosts where daily maintenance never runs — a real concern on shared hosting with inode quotas. The limiter now sweeps stale counters opportunistically on a small fraction of requests (the same pattern PHP uses for session cleanup), and the daily maintenance covers both counter formats instead of one.
- The daily cleanup used to delete rate counters after just one hour, silently resetting live 24-hour limits; it now waits until a counter can no longer be active.
- Requesting a comments feed for a non-existent post ID now returns 404 without writing a cache file.
- Feeds requested with a custom ?limit are now generated fresh instead of each size writing its own cache file (up to 100 files per feed).
- Stale feed and sitemap cache files left behind by key changes were never deleted; the daily maintenance now sweeps them.
- Expired session files could linger for months on quiet sites (PHP's own cleanup is probabilistic); maintenance now removes sessions past their 30-day lifetime deterministically.
Comments in four more themes + newsletter popup fixed to once a day
Added
- The Lifestyle, Minimalist and Tech themes now have a full comment section (list with replies, moderation-aware form, spam protection) designed in each theme's own visual language; the Starter theme's dormant comment code was wired up and completed. All four respect the global comments setting and the per-post comment status.
Fixed
- The newsletter signup popup could reappear on every page: the Finance theme only remembered the popup after the visitor clicked the close button, and the plugin popup reset at midnight. Both now remember the moment the popup is shown and stay quiet for a full 24 hours; subscribers never see it again.
- The Finance popup's subscribe form pointed to a root-absolute address that broke on subdirectory installs.
System-wide audit: privacy, SEO and reliability fixes
Security
- Private posts stayed truly private everywhere: posts imported from WordPress as “private” could previously be opened at their direct URL and could appear in theme lists, related-posts blocks, search results, the llms.txt export, weekly digest emails, auto-shared social posts and the Stories bar. Every one of those paths now respects the post's visibility.
- The Atom feed no longer publishes author e-mail addresses — they were an open invitation to spam harvesters and had no SEO value.
- Locking out repeated failed logins now also works when signing in with a username instead of an e-mail address.
- AVIF uploads are now validated as real images (previously they skipped both the image check and the content scan).
Improved
- Duplicate structured data removed: author pages in the Health theme and recipe pages no longer emit the same schema twice with conflicting IDs.
- Content boxes across six themes were restyled from the left-accent-bar look to cleaner top-accent panels.
- Recipes theme post pages now get the shared content typography (image alignment, figures, captions).
- Support API endpoints now require a domain that is actually activated on the license before showing or changing tickets, with per-IP rate limits.
- Four confirmed-dead legacy files were removed after a three-week production probe; the update tooling now automatically covers every plugin's admin pages.
Fixed
- The RSS feed cache now keys on the requested size, so a “?limit” value on one request no longer affects the feed other readers receive.
- Feeds now use the actual publish date for ordering and timestamps, so scheduled posts appear correctly (matching the sitemap's logic).
- Sitemap family: the news sitemap's index entry now uses the same publish-date window as its content; the video sitemap now really lists posts with YouTube embeds (it was announced but empty); noindex pages are no longer announced; the homepage's last-modified date reflects real content changes instead of “today”; image entries carry the post title instead of the slug.
- Comment forms in the Recipes and Travel themes posted to a non-existent address — comments could never be submitted. They now reach the comment handler, and six themes additionally hide the form when comments are closed for that post.
- The Trends theme now runs post content through the full content pipeline — shortcodes (forms, downloads, quizzes…), FAQ/how-to boxes and the final safety filter all work there now.
- Tables of contents across seven themes no longer skip or mislink headings that already have an ID.
- The “posts per page” reading setting is now honoured by archive and search pages in eight more themes.
- Database migrations now actually record their progress, run in numeric order and log failures (previously every migration silently re-ran on each update).
- Sending a newsletter from two overlapping runs could deliver the same campaign twice to a subscriber — queue rows are now claimed atomically and the cron entry point takes a lock.
- Deactivating a plugin now really turns off its public endpoints (forms, quiz submissions, download links, A/B redirects…).
- Date archives (/archive/2026) rendered as 404 even in themes that support them.
- Percent-encoded URLs (e.g. slugs with Turkish characters typed encoded) no longer 404.
More resilient automatic updates
Improved
- Automatic updates are now sturdier: before installing anything, the update package's digital signature is verified against several canonical forms and the exact bytes served — so a future change in how the update server formats its release list can never silently stop updates from reaching your site. The current, working verification is always tried first, so nothing changes for you day to day; this only adds safety nets.
Fix: image & logo uploads failing on some servers
Fixed
- On servers where PHP's Fileinfo extension is turned off, every image and logo upload failed with “Class finfo not found”. Upload validation now detects the file type through several fallbacks (including reading the image header directly), so uploads work regardless of that extension.
The format menu now scrolls neatly instead of overflowing the screen
Fixed
- With all the new blocks, the format menu could run off the bottom of the screen; it now fits the viewport with a tidy internal scroll and closes when you scroll the page, so it never appears detached from its button.
Cleaner block design, styled callouts on the page, plus keyboard keys and drop caps
Added
- Two more inline text tools other editors have: a Keyboard key style (renders a real key cap, e.g. Ctrl + S) and a Drop cap (an oversized decorative first letter to open an article).
- The Info / Warning / Error / Tip highlight boxes are now properly styled on the published page — before they only looked right inside the editor.
Improved
- Cleaner, less templated block design: the colored left bar was removed from the Key takeaways box (and the editorial summary box), replaced by a clean titled panel; the pull quote is now a centered, magazine-style quotation. The look is more editorial and less generic.
Beautiful content blocks, collapsible FAQ, and two new text styles
Added
- Two strong new text styles for richer articles: a Lead paragraph (a larger, standout intro) and a Pull quote (a decorative, oversized quotation) — both in the format menu.
- The FAQ block is now collapsible on the page: each question expands and collapses like an accordion, so one FAQ block gives you a full set of expandable questions in one place.
Improved
- All content blocks were visually redesigned on both the editor and the live page: buttons get depth and hover, How-to steps show numbered badges, Pros & Cons use clear check/cross marks with colored headers, Key takeaways carry an icon and accent bar, and star ratings are larger — a noticeably more finished, professional look.
Editor blocks: audited and hardened for every theme
Fixed
- FAQ questions no longer appear inside a theme’s table-of-contents: the question is now a styled heading that stays out of the on-page contents list while still powering the FAQ rich result.
- Verified every new block (FAQ, Pros & Cons, Key takeaways, How-to) renders correctly through the article pipeline on all themes, with the FAQ and How-to search markup produced automatically and safely (user text is always escaped).
A pro-grade editor: SEO content blocks, fixed Button & Accordion
Added
- Four new content blocks for richer, search-friendly articles: an FAQ (question & answer) block that automatically adds Google FAQ rich-result markup, a Pros & Cons box, a Key takeaways box, and How-to steps that automatically add How-to rich-result markup — each inserted and edited through a professional panel.
- Video now has its own toolbar button, right next to the image button — clearer than hiding it in a menu.
Fixed
- The Button block now inserts a clean, compact button instead of a broken empty area, and can be re-edited by double-clicking it.
- The Accordion block is now fully editable: type the title directly and write the hidden content underneath (previously it appeared as an unusable strip).
- The format menu items now line up consistently — every entry is an icon plus a label in a logical order, instead of scattered styles.
Pro Forms, an Audience suite, a richer editor, and faster videos
Added
- Form Builder is now a real visual builder: a two-pane editor with a LIVE PREVIEW that updates as you type, 16 field types (text, e-mail, dropdown, checkbox, date, time, star rating, consent/GDPR, section heading, info text, hidden…), per-field width so fields can sit side by side, and drag-and-drop reordering by a handle. Plus an auto-reply e-mail to the sender that fills in their own answers, redirect-after-submit, keyword spam filter, an entry limit, and a full submissions manager (read/spam, per-entry detail, CSV export).
- Audience & Marketing — the CRM grew into a marketing hub: contacts from every source unified by e-mail, plus saved Segments (audience filters with live counts) that will become broadcast targets for e-mail and web push.
- The post editor gained rich content blocks — Button/CTA, Accordion (collapsible FAQ), Star Rating, and YouTube video — inserted through professional modals (not browser prompts). Tables now open a visual size picker (pick rows × columns) and show a floating toolbar right on the table to add/remove rows and columns without dialogs.
Improved
- Every plugin admin screen was rebuilt to the jekcms admin design — proper cards, pill buttons, stat panels, inline how-it-works notes and rich empty states, with a left inner-sidebar where a plugin has multiple sections.
- Web Push adds a “Send test to this browser” button so you can subscribe and test notifications right from the admin.
Fixed
- Adding a YouTube video no longer slows the page: embeds load a lightweight poster and pull in the real player only on click (privacy-friendly youtube-nocookie).
- Hardened CSV exports (Audience, SEO, Analytics, form entries) against spreadsheet formula injection.
Critical: plugin admin pages could crash with a 500
Fixed
- Fixed a 500 error that could break plugin admin pages. The admin header's update check caught its exception into a variable named $e — the same name pages use for their HTML-escaping helper — so whenever that check failed (e.g. a slow update server or a stale database), the page's next output call crashed with “Object of type … is not callable”. The header and sidebar now use private catch variables, so a failed background check never takes the page down.
- Plugin admin descriptions and sidebar names for the newest modules (Forms, Downloads, Web Push, Editorial Calendar, Audience/CRM, A/B Tests) now show in Turkish on Turkish installs instead of falling back to English.
CSV exports hardened against formula injection
Security
- CSV exports are now hardened against spreadsheet formula injection: every untrusted cell in the Audience (CRM), SEO and Analytics exports is neutralized so it opens as plain text in Excel or Google Sheets.
Improved
- The admin sidebar now shows the newest modules (Forms, Downloads, Web Push, Editorial Calendar, Audience/CRM, A/B Tests) with proper localized names and their own icons, instead of an English name and a generic icon.
Go live today
Setup, content management, SEO and image optimization — all in one platform. Get started in 30 minutes.
View Pricing- Setup and live in 30 minutes
- 14 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO — Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)