Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 9 of 24 - 710 releases, newest first.
Post SEO analyzer: accuracy fixes and new checks
Improved
- Two new writing checks in the SEO analyzer: a transition-word check (are your sentences connected for flow?) and a long-section check (a stretch of 300+ words with no subheading is now suggested for a subheading) - both work in Turkish and English.
Fixed
- The live SEO score now judges the title by its full rendered length (your title plus the " | Site Name" the theme adds), so a title that looked fine but gets cut off in Google is now flagged - and the SERP preview's length number matches what is actually shown.
- Internal vs external link counting is corrected: a protocol-relative link to another site ("//example.com/…") is no longer miscounted as an internal link.
Migration/import and support module hardening
Improved
- The WordPress migrator plugin (for exporting a WordPress site) now writes its export into a private, per-run randomized folder and deletes the intermediate data files right after packaging, so an export can't be pulled from a predictable URL on servers where directory rules aren't enforced.
Fixed
- Imported content from every WordPress path (CSV, package and REST) now passes through the same content-cleaning step the editor uses, so a hand-edited export or a compromised source site can no longer smuggle active markup into your published posts.
- The REST and wizard migration tools are now administrator-only (they create posts and users and fetch remote content), and the wizard's per-post import step now requires a valid security token - matching the rest of the admin panel.
- Imported posts with an unknown status now land as drafts (in the review queue) instead of going straight live.
- Support ticket attachments can be downloaded again - the download link pointed at a page that did not exist, so staff could attach files but never open them; downloads are now served admin-only through a path-checked handler.
- Support ticket status and priority updates are validated against the allowed set, and the average-resolution-time metric now uses the real resolved/closed timestamps.
SEO plugins audit: social, distribution, Google, recipe
Improved
- Hardening across the SEO surface: social share links now use the canonical URL (so shared and syndicated links never point at a redirect), recipe structured-data text fields are stripped to plain text as Google expects, the browser-push subscribe endpoint is restricted to real push services (SSRF hardening) with a proper per-IP rate limit, and shipped recipe/quiz scripts and push fallback text no longer leak Turkish onto English sites.
Fixed
- Auto-publishing to social networks no longer broadcasts private, members-only, paid or password-protected posts - only fully public posts are shared, and a gated post's social description can never fall back to its full body (which also protected the Dev.to/Hashnode full-body syndication).
- The Google panel's GA4 / Tag Manager / AdSense settings actually take effect now - they were wired to a hook the themes never call, so enabling analytics in that panel injected nothing. They now flow through the site's single, consent-aware analytics injector, so there is one tag set (no double-counting) and cookie-consent is respected.
- The IndexNow "ping on publish" switch is now a real switch - instant indexing could not actually be turned off before, and the panel's "last submit" status was always blank; it now reflects real submissions.
Quiz plugin: premium polish and reliability
Improved
- Result sharing is steadier: X, WhatsApp and Facebook buttons always appear (previously the whole share row vanished on some browsers), a native share sheet is offered on mobile, and copy-link stays where the clipboard is available.
- Keyboard support: press 1–9 to pick an answer and Enter to advance - faster and more accessible play.
- The public play endpoints are now rate-limited against flooding, the instant-feedback endpoint too, and answer keys are returned only for the questions actually answered (no leaking a whole question bank).
- Completion IP addresses in the stats screen are now masked for privacy, and the standalone quiz page no longer shows its title twice.
Fixed
- Embedded quizzes could render with no styling and never start on themes that build a table of contents (they parse the post twice) - the quiz's stylesheet and script are now emitted on every embed, so quizzes always work wherever [quiz] is placed.
- The question/answer image picker stored an absolute URL that the front-end then prefixed again, producing broken images; picked images are now stored correctly and existing broken paths are healed automatically.
- Deleting a quiz now removes its questions, answers, result bands and play records instead of leaving them orphaned, and editing a quiz no longer accumulates dead answer rows; a one-time cleanup clears any leftovers on upgrade.
- Typing a slug that already belongs to another quiz no longer errors and loses your edit - it is made unique automatically.
- Personality quizzes ignore the question-bank subset setting so every result band stays reachable and two identical answer sets always give the same result.
Theme customizer: numeric dropdowns now save correctly
Fixed
- In the theme customizer, dropdown fields whose choices are numbers (for example the Recipes and Travel themes' "Grid columns" 2/3/4 selector) silently reverted to the default whenever you picked a different value - the saved value now sticks. every theme' customizer fields were verified end to end (513 fields across colors, fonts, ranges, toggles, selects, code and image inputs) and theme switching, preview and one-click rollback were confirmed to keep a single clean settings row.
Newer-plugin audit: audience, editorial, edge & forms
Improved
- The editorial kanban board now supports real drag & drop between stages (the card's owner, date and note are preserved), overdue due-dates are highlighted, and editors - not just administrators - can use the board; plugin shortcuts in the admin sidebar are shown only to roles that can open them.
- CRM quality-of-life: a per-contact delete button (for erasure requests), segments show how many members are actually e-mailable, the contact list says when it is truncated, and the activity timeline no longer mixes in other people's form submissions for addresses containing wildcard characters.
- A/B tests: editing, activating or deleting an experiment now clears the page cache immediately (a just-activated test could look dead for the cache lifetime), the winner trophy waits for a sufficient sample, and equal conversion rates are compared exactly.
- Digital downloads and form autoresponders now throttle outgoing e-mail per recipient/site-wide, form values have a sane length cap, and the Cloudflare panel explains that HTML is only edge-cached if you add a Cache Rule.
Fixed
- Audience (CRM): unsubscribed and bounced newsletter contacts are no longer pulled into the audience or its CSV export, the export now carries a newsletter-consent column and streams any list size, contacts deleted at their source are removed on the next refresh, and the audience is refreshed automatically right before a segment broadcast so late subscribers are included.
- Editorial calendar: scheduled posts now actually appear on the calendar on their scheduled day (they were invisible before), a post set to pending elsewhere shows in the Review column, moving a card can no longer race a simultaneous publish, and permanently deleting a post cleans up its planning card.
- Web push: the plugin's settings no longer share storage keys with other plugins (toggling ZeroTrack could silently switch push off and vice versa - existing settings migrate automatically and VAPID keys are preserved so subscribers stay valid), the click counter only accepts clicks for real recent broadcasts with sane limits, and clearly-rejected fake subscriptions are pruned faster.
- Cloudflare: turning "I'm Under Attack" on now reports an error if the API call failed instead of a false success, edge cache purges no longer block post/settings saves (they are queued and sent once per request, also removing duplicate purge calls), scheduled posts published by a real system cron now purge the edge too, and a failed reconnect no longer leaves the panel in a half-connected demo state.
- Analytics real-IP: on sites directly behind Cloudflare, visitor IPs are now resolved from the edge header (validated against Cloudflare's official ranges), so unique-visitor counts, IP exclusions and the flood limiter work correctly instead of collapsing onto a handful of edge IPs.
- Form Builder: renaming a field's label no longer silently detaches historical submissions from their CSV/archive column (machine names are now persisted), field names can't collide with the hidden system fields, and forms embedded on cached pages no longer double-submit with a failed first attempt.
API authorization & content hardening
Fixed
- The automation/REST API now enforces the same role permissions everywhere: creating or deleting posts through the webhook endpoints, and managing categories, tags or comment moderation, now require the proper role - previously any valid API token could do these regardless of the account's role.
- Automation endpoints can no longer edit or delete another author's post, reassign a post's author, or save unsanitized HTML through the bulk publish/import paths (which could inject scripts) - ownership, byline and content cleaning now apply on those paths too.
- The bulk AI analysis job (which sends every post to the AI provider) now requires an administrator, and the per-post AI analysis is rate-limited, so a lower-privileged account can't burn through the site's AI key or quota.
- Search result pages on three themes now count matches the same way the list is built, so the pagination total is accurate and no empty "phantom" pages are produced.
- The marketing newsletter sign-up rate limit is now server-side (it could previously be reset by clearing cookies), the blog RSS feed pins its URLs to the real domain, and a saved post with an unparseable status value defaults safely instead of erroring.
Concurrency, scale & integrity deep-audit
Fixed
- A scheduled post is now published exactly once even if two schedulers happen to run at the same moment, so it can no longer fire duplicate auto-shares, duplicate newsletter sends or duplicate push notifications.
- Deleting a category through the API now refuses when posts are still attached (matching the admin panel), instead of silently stripping those posts of their category.
- Newsletter open and click counts are now counted atomically, so inbox pre-fetching (Gmail/Apple Mail) can no longer inflate the numbers with duplicate counts.
- Comment threads with thousands of replies now build in milliseconds instead of seconds - the threading was rebuilt to scale linearly.
- Dates that can't be parsed (e.g. a malformed or empty value from an old import) now render as blank instead of "1 January 1970", and a post scheduled with an unparseable date is held as scheduled instead of quietly going live immediately.
- Hardening & cleanup: the analytics beacon now ignores spoofed forwarded-IP headers and is flood-limited; the A/B conversion link only counts same-site clicks; saving a site-wide OG image now requires an admin; permanently deleting a post cleans up its view/reaction/rating rows; and login-link tokens plus old newsletter queue rows are now pruned so they don't grow forever.
Search, ads, quiz & security sweep
Fixed
- Instant search now actually uses the fast full-text index instead of silently falling back to a slow full-table scan on every keystroke, and the endpoint is rate-limited so it can't be hammered.
- Device-targeted ads are no longer frozen across devices by the page cache: the cache now keeps a separate copy per device class, so mobile visitors get mobile ads and desktop visitors get desktop ads instead of whichever device loaded the page first.
- Members/paid posts no longer leak their in-body images and embedded videos through the image and video sitemaps - only genuinely public posts contribute body media there (the cover image still appears, as before).
- Two-factor setup now refuses to enable if the secret can't be stored encrypted, instead of quietly saving it in plain text.
- Deleting a media file that's still used in posts now warns you it was in use (so broken image links aren't a silent surprise), and the download store limits how often the same email address can be sent a link (stops link-spam to someone else's inbox).
- Contact/lead forms: the form-builder honeypot no longer uses a field name that browsers autofill, which was silently dropping some genuine submissions; the quiz block now prints its stylesheet/script once per page even with multiple quizzes.
Editor, cache & membership audit
Fixed
- Autosave no longer touches a published post's live body: while you edit a post that's already online, the background save keeps your draft in the revisions list instead of pushing half-finished edits to the live page - nothing goes public until you press Update. New pages also keep their type instead of turning into blog posts.
- Members/paid recipe posts now keep the ingredient list, steps and structured recipe data behind the paywall - the card, the FAQ and the page's recipe schema are shown only to signed-in members, matching how the article body is gated.
- The page cache now refreshes correctly when you trash or restore a post or add a redirect, so removed content and new redirects take effect immediately instead of lingering for the cache lifetime. Cookie-free visitors also always get the site's default language, ending a case where the first visitor's language could stick for others.
- Editor hardening: the button block now rejects javascript:/data: links like the other blocks, content saved by non-admin authors is cleaned server-side, the SEO panel escapes check text, and restoring a revision keeps your hand-picked URL instead of regenerating it from the title.
- Importing images from another site is bounded and hardened further - a per-image size ceiling, certificate verification, and a pinned resolved address stop an oversized or tampered image from stalling the import.
- Storefront: the checkout success page now shows the license key only in a short window right after payment (it's always in your email and portal too), and the update-check endpoint is rate-limited and no longer reflects arbitrary origins.
Full-session audit hardening
Fixed
- For members/paid posts, the page meta description, social share tags and RSS fallback now stay inside the free teaser, so the summary shown to search engines and shared links never draws on gated text.
- Importing images from Ghost/Substack is now SSRF-hardened: image URLs from the uploaded file are checked to be public addresses (internal/cloud-metadata hosts are refused), redirects aren't followed, and oversized images are skipped so one bad file can't stall the import.
- Outgoing webhooks are bounded so an unreachable endpoint can't slow down publishing; deliveries that don't fit the window are logged as deferred and can be re-sent, and a webhook is refused rather than created if its secret can't be stored securely.
- Editor links now reject javascript:/data: URLs like the other card blocks, the snippet endpoint always returns clean JSON, reaction counts are shown only for public posts, and fast double-clicks on a reaction no longer error.
Webhook delivery log & one-click re-send
Improved
- Each outgoing webhook now shows its recent deliveries right under it - the event, the response status (success or the exact HTTP error), and when it happened. If one failed because your endpoint was momentarily down, a single "Re-send" button replays that exact payload with a fresh signature. The log keeps the last 100 deliveries per webhook and never stores your signing secret.
Ghost/Substack import now brings your images too
Improved
- When you import from Ghost or Substack, the images in your posts (and each post's cover) are now pulled into your own media library and converted to AVIF/WebP, and the post is rewritten to point at the local copies. Your migrated content keeps working even after the old site goes offline - no more hotlinked images that break later. It's a single checkbox on the import screen (on by default), matching the WordPress importer.
Multilingual archives & API stability
Fixed
- On multilingual sites, category, tag and author pages, related lists and widgets now show only your site-language posts again; translated posts stay reachable at their own address and are still discovered through their hreflang links.
- The REST API and magic-link sign-in now work reliably on every install, including brand-new ones, and importing from Ghost/Substack cleans up correctly even if the file has an error.
Deep audit hardening across membership, webhooks, editor & multilingual
Fixed
- Content gating is now consistent everywhere: /llms-full.txt, instant search and the About/Contact/FAQ/legal/homepage page routes all apply the same members/paid/private visibility gate as the rest of the site.
- Outgoing webhook signatures are now verifiable: the HMAC was being computed with the encrypted secret instead of the plaintext (a column length also truncated it), so every signature failed on the receiver - fixed end to end.
- A webhook signing secret can no longer be used as an admin API key.
- Newsletter segment sending can no longer silently fall back to the entire subscriber list when the CRM is unavailable or errors - it sends to nobody rather than everybody.
- Reply notifications no longer fire for unapproved/spam comments, so moderation-pending replies can't spray the whole thread by email.
- The paywall teaser is now safely capped even on very short posts, and the reaction bar can now be un-clicked and switched correctly with counts always coming from the server.
- Editor hardening: the snippet library and the bookmark fetcher are now restricted to content roles (not read-only subscribers); the bookmark fetcher pins the validated IP (DNS-rebinding), enforces a hard size cap, and resolves relative images correctly; product/bookmark/gallery/embed card links reject javascript:/data: URLs; the gallery block is now clickable and the four new blocks have their edit/delete toolbar.
- Magic-link sign-in/registration is now rate-limited (anti email-bombing), tokens are single-use under concurrency, and the new-member webhook fires only after the email is verified.
- Ghost/Substack import no longer triggers per-post newsletter/push/social/ping storms, survives BOM and malformed CSV rows, only raises the memory limit, maps Ghost visibility, and skips empty lexical-only posts.
- Multilingual: the language filter no longer breaks reactions, comments, pages, comment feeds or legacy-URL rescue on translated posts - it now applies only to genuine listing surfaces (archives, sitemap, feeds, search) while every translated post stays reachable at its own URL.
Multilingual content v1 + Ghost/Substack migration
Improved
- Multilingual content v1: give any post a language and link it to its translated counterpart from the editor's new Translation box. Linked pairs automatically emit hreflang alternate tags (plus x-default) so search engines serve the right language; archives, sitemap and feeds keep showing only the site language while translated posts live at their own URLs.
- A practical translation workflow ships with it: Duplicate the post, switch the copy's language, link it back by ID - done. No plugin, no separate site.
- Migrate from Ghost: upload the JSON export from Ghost admin and posts, pages, drafts, tags, publish dates and feature images come across - safe to re-run, existing slugs are skipped.
- Migrate from Substack: upload the export ZIP as-is and newsletter posts import with their full body and subtitle; "paid-only" posts automatically arrive with Premium (paid) visibility, matching the membership system one-to-one.
Integrations & engagement: webhooks, segments, reactions
Improved
- Outgoing webhooks are now real: pick events (post published/updated/deleted, new comment, new member), add an HTTPS URL, and jekcms sends signed JSON (HMAC signature header) the moment they happen - Zapier/n8n/Make ready, with a one-click test button.
- Newsletter campaigns can target CRM segments: choose a saved audience filter when sending and only matching active subscribers receive it - the "coming soon" broadcast gap is closed.
- Comment conversations now notify the whole thread: everyone above a new reply is emailed once (deduped), and every notification carries a one-click, tamper-proof opt-out link.
- Emoji reactions arrived on every theme: a theme-independent reaction bar appears under posts with live counts served from the API - fully compatible with the full-page cache; themes with their own reaction UI are automatically skipped.
Fixed
- A leftover placeholder in the cron was silently marking the social-media queue as completed without doing any work - removed; the social plugin's queue is no longer swallowed.
Editor: monetization cards, gallery, social embeds and snippets
Improved
- A Product/Affiliate card joined the editor: image, price, description and a call-to-action button whose link automatically carries rel="sponsored nofollow" - Google-compliant affiliate monetization in two clicks.
- Bookmark cards turn any URL into a rich preview: paste a link, hit Fetch, and the title, description, image and site name are pulled server-side (with strict SSRF protection) into an editable card.
- Gallery grids (2-4 columns) and social embeds arrived: Twitter/X, Instagram, TikTok and Vimeo links become real embeds on the page - the editor stores a neutral placeholder and the site hydrates it, so provider scripts load once and only where used.
- Snippets make repeated content one click: select anything in the editor, save it under a name, and insert it into any future post from the snippet library.
Premium (paid) membership tier
Improved
- Posts can now be marked "Paid members only": anonymous readers get a premium teaser with a join call, signed-in free members see an Upgrade card with your price and payment link, and premium members read everything.
- Selling is friction-free by design: paste any payment link (iyzico or Stripe payment page) plus an optional bank-transfer note in Settings, and when a payment arrives, one click on the Users screen upgrades the member - no gateway integration to configure.
- The member account page shows premium status and the upgrade offer; staff accounts always see full content, and paid posts stay in sitemaps and feeds as leak-proof teasers with correct paywall structured data.
Memberships: members-only content and passwordless sign-in
Improved
- Ghost-style memberships arrived: mark any post "Members only" and anonymous readers see a clean teaser with a join call-to-action while signed-in members read the full piece - on every theme, with zero theme changes.
- Readers join and sign in without passwords: a one-time magic link lands in their inbox (30-minute, single-use), a minimal account page lets them manage their name and newsletter subscription, and joining doubles as newsletter double opt-in.
- Members-only posts stay fully SEO-correct: they remain in sitemaps and feeds as teasers, never leak the gated body anywhere, and carry Google's official paywalled-content structured data so gating is not mistaken for cloaking.
- One-click post duplication (content, categories, tags and metadata copied into a fresh draft) joined the post list actions.
- Your content is never locked in: a new Export panel downloads everything as WordPress WXR, Ghost JSON or jekcms JSON - categories, tags and SEO fields included.
Full-page cache: millisecond pages for visitors
Improved
- A textbook full-page cache now serves the homepage, single posts, category, tag, author and date archives to anonymous visitors straight from disk - measured locally, pages dropped from 60-200ms to 4-9ms.
- Cached copies are invalidated exactly when content changes: saving a post, moderating a comment, editing categories/tags/menus/users, changing settings or the theme all clear the right copies immediately; a small share of requests still runs the full engine so scheduled tasks keep ticking.
- Comment and contact forms became cache-safe: the security token is no longer baked into the page - it is fetched the moment a visitor actually starts filling a form, so anonymous browsing stays completely cookie-free.
Fixed
- Every single visit was silently receiving a session cookie because the user loader started a session even when there was nothing to load - this broke the lazy-session design site-wide and made pages personally-addressed for no reason.
- Two themes' view counters opened a session per article view; they now use the cookie-free central counter, and A/B-test pages, dark-mode/language-cookie visitors and search results are correctly excluded from the cache.
Deep performance pass: queries, caching and page weight
Improved
- Repeated database work was eliminated across the board: prepared statements are reused, per-image lookups are memoized, sidebar aggregations are cached, empty results now cache correctly, and hot columns gained indexes.
- Theme pages got lighter: template-specific stylesheets load only on their own template, mobile-only CSS no longer blocks desktop rendering, fonts load from the page head instead of a chained CSS import, and analytics/ad hosts get an early connection.
- Saving a post now runs its category/tag/meta writes in a single transaction, and archive pages batch-load categories instead of querying once per card.
Fixed
- Six plugins were silently re-running their entire installation schema on every single page view due to a settings-key collision - the single biggest hidden cost on every site; pages now run dramatically fewer queries and zero writes.
- The featured-image helper returned the full-size original instead of the 1600px variant, so every theme preloaded multi-megabyte camera files as the hero image; the preload also now matches exactly what the browser will render.
- Browsers were told to keep HTML pages for a full hour with no way to refresh them - edits stayed invisible to returning visitors; pages are now edge-cached and browser-validated, and category/tag edits and new posts invalidate the right caches immediately.
- Sitemaps and feeds are written atomically with a generation lock - parallel crawler hits could previously read half-written XML or trigger simultaneous full regenerations.
Categories, archives and search: deep SEO pass
Improved
- Categories gained their own SEO title and SEO description fields in the admin panel, and parent categories now count and list their child categories' posts everywhere - archive pages, indexing rules and the sitemap agree.
- Site search now ranks results by relevance instead of date on every theme, search page titles are capped against keyword-injection spam, and paginated search links finally carry the query along.
- Date archives (old /archive/2026 style addresses) now get a descriptive page title, paginated archive pages carry a page number in their description, and every theme reports its real page size in structured data.
- The site description used by feeds and previews became editable in Settings - until now every installation shipped the same boilerplate sentence - and the homepage title can carry the site tagline.
Fixed
- Address-case variants of category, tag and author pages now redirect to the single canonical address instead of serving duplicate self-canonical copies, and deleted tags leave a proper "gone" record so search engines drop them quickly.
- Two themes silently lost every category description from search snippets over a variable-name mismatch, one theme pinned paginated archives' canonical to page one, and tag pages on two themes either listed the whole site or rendered without a title.
- Tag feeds became real: following a tag's feed used to silently hand subscribers the site-wide stream; category and tag feeds also stopped claiming to be the main feed, and feed images now declare their true format.
- Homepages that paginate now return an honest not-found beyond the last page and give page two and onward their own title and canonical; the theme demo search-blocking robots rule that hid the blog search's noindex from Google was lifted.
Single posts and author pages: deep SEO pass
Improved
- Author pages now carry a full social-profile card: stable identity across paginated pages, a real profile picture in link previews, richer profile structured data, and each author's own posts listed correctly on every theme.
- Article structured data now reports the approved comment count, and social share cards gained an image description, a reading-time line and the post's topic tags.
- Every theme's post page now shows the publish date in a machine-readable form, and the "Updated" stamp only appears when the content genuinely changed.
Fixed
- Bylines no longer invent a writer: when a post has no real author profile the name is shown as plain text instead of linking to an author page that never existed.
- The table of contents on the news theme now works on markdown-written posts, previous/next links on the starter theme point at the real post address, and the pets theme no longer emits a half-finished second copy of article metadata that contradicted the main one.
- Author boxes that were silently invisible now render: one theme queried profile fields under their old names, another never received the author's biography from the page at all.
SEO verification pass: second-round hardening
Fixed
- Database sessions now share the site's timezone, so a freshly published post appears in sitemaps immediately on every host instead of hours later on servers whose database clock runs in UTC.
- Sitemap index announcements now use exactly the same filters as the sitemap files themselves - no more announced-but-empty news/video maps, and trashed marketing posts finally disappear from the public blog, feed and sitemap.
- Old WordPress-style category/post addresses now hop straight to the real post, and every remaining "redirect to somewhere that 404s" chain (authors, categories, attachments, feeds, year archives) returns an honest not-found instead.
- The maintenance page now sends proper no-cache headers, uses the active theme's template, and error pages exist for every status the error route accepts.
- The theme demo gallery moved to a stable address (/demos) - its old address was shadowed on the server and had been unreachable from the navigation.
- Upload-folder protection files are written Apache-2.4-safe everywhere; on hosts without the legacy compatibility module they used to turn whole media folders into server errors. A permanent release-gate check now guards this class.
Deep SEO audit: crawling, presentation and media layer
Improved
- Crawlers can now fetch core stylesheet/script assets and search pages, so pages are rendered and evaluated with their real design and noindex hints are actually readable.
- Sitemaps got stricter: entry dates no longer drift on every visit, image entries always point at working files, scheduled/future content never appears early, and news/video sitemaps respect per-post indexing choices.
- Titles across all themes now follow the configured separator, add a page number on paginated archives, and no longer repeat the site name twice; archive descriptions can come from the tag or author's own text.
- Structured data is more consistent: language, titles and image formats now match across the page's tags, FAQ/HowTo blocks can no longer be emitted twice, and the publisher logo is a raster image with its true dimensions.
- Modern-format (AVIF/WebP) image sources are only offered when the file really exists - on hosts without those formats the browser now always gets a working image instead of a blank box.
- More images carry explicit dimensions and descriptive alt text, the correct hero image gets load priority on every theme, and automatic internal links open in the same tab as expected.
Fixed
- Addresses that do not exist now return a real "not found" status everywhere instead of silently redirecting to the homepage, so search consoles report them correctly and they drop out of indexes.
- Error responses are never cached as healthy pages anymore, and error/410 pages are proper, readable pages with charset, language and a link home.
- Duplicate-address cleanups: uppercase blog links, retired tag aliases, alternate sitemap/robots/feed addresses and www+http visits each collapse to a single canonical address in one redirect hop.
- Date archives are validated (invalid years return "not found") and marked not-to-be-indexed, closing a duplicate-content surface.
Verification pass: admin panel fixes
Security
- Saved AI keys in the multi-key list are no longer written into admin page HTML; rows show a masked “saved” state and each key only changes when you type a new value - leaving a row untouched keeps the stored key.
Fixed
- Some admin confirmation and validation messages (for example the new password-policy warning when adding a user) were saved but never shown on screen; the panel now displays messages from both internal channels.
- On installations whose database was missing two optional pieces, the settings page could cut off mid-render and adding a user could fail with a server error; the missing pieces are now provisioned and both flows were verified end-to-end.
Security hardening: broad audit across the product and site
Security
- Uploaded files are kept strictly non-executable everywhere: the upload-folder protection is now stronger and self-maintaining, and the blocked-extension list covers disguised double-extension names.
- Content upload endpoints now require an explicit upload permission tied to the account's role.
- Editor/API secrets (AI provider keys, SMTP password, webhook secrets) are no longer written into admin page HTML; fields show a “saved” state and only change when you type a new value.
- Order pages are tightened: cancelling an order requires the owner and a confirmed action, and guest checkout is scoped to the buyer’s own account.
- Anti-abuse limits are now enforced server-side on the contact form, verification-email resend, comment likes, newsletter signup and article voting.
- Payment confirmation now verifies the paid amount and currency against the order before completing it.
- The one-click Google connection now only works from a licensed customer domain, and several login/authorization edge cases were closed.
- Error responses no longer include internal technical details, and internal maintenance/report files are kept out of public deployments.
Compatibility: deep sweep for PHP 8.0 servers and lean setups
Fixed
- On servers running PHP 8.0 (the minimum supported version), several areas used a function that only exists in newer PHP: the site footer, the Personal theme and - most critically - the auto-update engine could crash. These now work on every supported PHP version.
- Publishing a post no longer depends on optional server pieces: the search-engine ping, encoding repair tools and the RSS import endpoint all degrade gracefully when a server component is missing, instead of stopping the whole operation.
- The installer now tells the truth about requirements: the cURL component (needed by updates, licensing and integrations) is checked as required rather than merely recommended, so problems surface at install time instead of weeks later.
- The pre-release safety check was deepened: it now also blocks any new code that would require a newer PHP than the product promises, alongside the existing optional-component guard.
Resilience: missing server components can no longer crash any operation
Fixed
- Following yesterday's upload fix, the entire product was swept for the same class of failure - features assuming an optional PHP server component is present. On lean hosting setups this could crash: WebP image reading during WordPress import, migration and Pinterest image generation; AVIF/WebP saving in thumbnail regeneration and the media optimizer; image processing entirely on servers without the GD component (the upload now keeps the original file instead of failing); and update, backup and package operations if the zip component is disabled. Every path now checks first and degrades gracefully with a clear message instead of a server error.
- This protection is now permanent: an automated check runs before every release and blocks any new code that uses an optional server component without a safety check.
Get your site live
The setup wizard gets a site live in about 30 minutes. See the prices and the free edition.
View Pricing- Setup and live in 30 minutes
- 15 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO - Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)