Changelog
Release Notes
Every feature, every improvement, every fix since v1.0.0.
Page 9 of 20 — 576 releases, newest first.
Update Your Site Even When It Cannot Reach the Update Server
Added
- You can now upload an update package straight into the panel. Until now, if a site could not reach the update server — because the host blocks outbound connections, for example — there was no way to update it from the panel at all; the only route left was editing files over FTP, which is not something a site owner should have to do. The option appears exactly where the problem shows up: when a check fails, the failure notice now carries the upload box, a link to your downloads page and the size this server accepts.
- An uploaded package goes through the same safety chain as a normal update: the archive is verified as a genuine jekcms package before anything is touched, your license and update settings are preserved, a full backup is taken first, and the result is written to the update history so you can roll it back from the History tab.
Improved
- The installation wizard now says what the outbound-connection check actually affects. It was labelled as being about downloading remote images, so a missing connection looked like a detail about media — while it is in fact what updates depend on. The check now names updates explicitly, tells you to have the curl extension enabled, and mentions that packages can be applied by hand if it cannot be.
Automatic Updates Are Now On by Default
Improved
- Automatic updates now arrive without being switched on first. The preference used to start in the off position, so a site only ever updated if its owner happened to find the setting — which meant most installations quietly stayed on old versions and never received fixes, security ones included. New and untouched installations now keep themselves current on their own.
- Nothing is expected from your hosting. Updates run off ordinary visitor traffic, so there is no cron job to set up and no server access needed. Each update still goes through the same chain as before: a signed manifest, a checksum, an automatic backup and a rollback you can use if anything looks wrong.
- Your own choice always wins. If you have already set the preference — including turning it off — that setting is left exactly as it is; the new default only applies where nobody has chosen yet. You can change it any time under Updates, and centrally managed installations are unaffected.
Uploading a Logo No Longer Breaks the Settings Page
Improved
- Every file field in Settings — logo, dark logo, footer logo, favicon, touch icon and the social sharing image — now states the largest size this server accepts, and a file over that limit is stopped before it is sent instead of failing halfway.
Fixed
- Uploading a logo could end on a bare "Server Error" page, losing everything else you had just filled in. The upload ran without any protection, so a single failure while processing the image took the whole settings page down with it. The upload is now contained: if it fails, the page stays, the rest of your settings still save, and a message names the field and the reason.
- A failed logo upload used to be silent. The old value was quietly kept and the page reported success, so you could press save repeatedly and never learn that the image had not been accepted. Failures are now reported.
- Image handling no longer assumes the server can write every modern format. On hosting where PHP is built without WebP support, an upload could stop with a fatal error instead of simply falling back — the fallback is now in place.
Update Check Now Works on Hosts That Block URL File Access
Fixed
- "Update check failed — cannot reach the update server" appeared on hosting where everything else worked. The update check was the one place still fetching over PHP's URL file wrapper, which many shared hosts disable for security; every other outbound call in jekcms already used cURL. The check now uses cURL when it is available and only falls back to the old method otherwise, so it works on those hosts.
- The failure no longer hides its cause. The screen now shows what actually happened — the connection error, the HTTP status, or that neither transport is available — together with what to do about it, such as asking the host to enable cURL. Previously the only message was that the server could not be reached, which was impossible to act on.
- A rejected license used to be reported as "up to date". If the update server refused the key, the response was quietly treated as "nothing new", so a site could sit on an old version believing it was current. That case is now reported, and it says to check the key and the registered domain.
- A momentary network glitch no longer locks the screen out of update checks for half a day. The failed result was cached for the full check interval; it is now kept only briefly, so trying again actually retries.
Image Upload Now Tells You the Size Limit Before You Hit It
Improved
- On hosting where the real limit sits in front of PHP — a proxy or web server rule that PHP cannot see — the site owner can now declare the true ceiling with a single setting, and both the on-screen limit and the pre-upload check honour it.
Fixed
- Adding an image inside the editor could fail with nothing but "Connection error", most often with photos straight from a phone. The real cause was size: past a certain point the server stops accepting the request body, and the browser reports that as a network failure. The upload field now shows the largest size this server actually accepts, an oversized image is stopped before it is ever sent, and if the server still refuses one the message says so plainly and tells you to resize the image.
- The upload endpoint now always answers in a format the editor can read. Previously a server-side failure — an out-of-memory during image conversion, for example — produced an error page instead of a proper response, which the editor could only report as a connection problem. Fatal errors and size rejections are now reported as real, readable messages.
- When an upload exceeds the server's total request limit, PHP discards the whole request including the security token, so the upload used to be reported as a security error. The size is now checked first, so the message names the actual reason.
The "Empty Content" AI Error Now Recovers By Itself
Fixed
- Some AI actions failed with "Gemini returned empty content (MAX_TOKENS)". Newer models think before they answer and that reasoning is paid for out of the same budget as the text, so a budget sized for a non-thinking model can run out before a single word is written. The model now gets a floor large enough to reason and still write, whatever the individual feature asked for. If it somehow still happens, the request is automatically retried once with a much larger budget instead of being reported as an error.
- Testing the API key in Settings could fail even though the key and model were perfectly fine. The test asked for a handful of tokens — enough for the word "OK", but not enough for a thinking model to finish reasoning first — so the test reported a failure that content generation never had. The test now asks for a realistic budget.
- When a model rejects the request to switch reasoning off, the retry no longer reuses the smaller budget that was chosen on the assumption that reasoning was disabled — which was itself a way to arrive at an empty response.
Long AI Generations No Longer Time Out: No More 504s, No More Missing Articles
Fixed
- Generating a draft on the AI Draft screen often failed with a "504 Gateway Time-out", seemingly at random. The cause was a hard limit on the hosting side: a web server cuts a request off if no data reaches the browser for about 55 seconds, and a real article takes considerably longer than that to write — measured between 42 and 104 seconds, so a large share of generations were over the line. The work was actually finishing on the server; only the connection had already been closed. The connection is now kept alive while the model writes, so the result arrives however long it takes. Shortening the wait would have been the wrong fix — it would have killed generations that were about to succeed.
- Asking the Content Wizard for five articles could leave you with three. Each article is generated in its own request, but when one needed a second attempt the retry ran inside that same request and pushed it past the server's cut-off point. The browser then saw a broken response and counted a perfectly good article as an error. Those requests now survive, and the retry timings were rebuilt around how long generation actually takes instead of an assumed limit.
- The AI Draft screen no longer freezes on a blank page while it works. Generation runs in the background and the button shows a live counter, so you can see it is still working instead of guessing whether the page has hung.
- Some AI features returned "empty content" and stopped. Newer Gemini models think before they answer, and that reasoning is paid for out of the same output budget as the text — but the budget still defaulted to a value from before those models existed, and the highest value the settings page allowed could be consumed by the reasoning alone, leaving nothing for the article. Thinking models now get a budget large enough to reason and still write, and the ceiling in Settings has been raised accordingly.
AI Images Plugin Hardened: OpenRouter Fixed, Response Limits, No More Duplicate Runs
Security
- Image responses had no size limit. A broken or hostile endpoint could return an arbitrarily large body and exhaust the server's memory before anything checked it. Responses are now capped at 24 MB and an oversized transfer is cut off immediately.
- Generated bytes are now validated in memory before anything is written to disk, and the file extension comes from the real content rather than the type the provider claimed. Previously the data was written first and inspected afterwards, so non-image content briefly existed on disk under an image name.
- Error messages from the image service are scrubbed of secrets before they reach the admin screen or the log: API keys, OpenRouter keys and stored ciphertext are now masked.
- TLS verification, redirect following and connection limits are set explicitly on every image request instead of relying on server defaults, and redirects are refused so a response cannot be pulled from an unexpected host.
Improved
- A temporary "high demand" response from the image service is retried briefly instead of being reported as a failed image, matching how text generation already behaves.
Fixed
- Choosing OpenRouter as the image provider could never work. The settings screen stores that API key encrypted, but the generator read it back without decrypting, so the encrypted value itself was sent as the key — every request failed, and the stored ciphertext was handed to a third party in the process. The key is now decrypted on read, and an unresolvable value is never sent at all.
- Publishing the same post twice in quick succession — a double click, a manual publish racing the scheduler, an automation retry — ran image generation twice and produced duplicate images while spending the API quota twice. A short-lived lock now lets only one run work on a post at a time, and a stale lock is taken over automatically so a crashed run cannot block the post forever.
- An aborted download could be treated as a real response. When a transfer failed midway the partial body was returned alongside the error, and the caller only checked for outright failure — so truncated data reached the image parser. A transfer error now always means no response.
Security Fix in Imported Links, and Image Fields Understood From Every AI
Security
- Markdown link conversion in imported content is now strictly validated: only http, https, mailto, tel and same-site addresses are allowed, both the address and the label are escaped, and attempts to disguise the scheme are ignored. The converted output also passes through the content filter a second time as a backstop. Legitimate links, YouTube and Vimeo embeds, tables and code blocks are unaffected.
- Content sent straight to the API could publish a literal `[IMAGE: …]` marker. Those markers only mean something inside the publishing queue, where they are replaced with real images; on the direct API path nothing resolved them and they appeared on the page. They are now stripped on that path.
Improved
- Image fields are now understood no matter which AI wrote the JSON. Every assistant names things differently — `imagePrompt` or `image_prompt` or just `prompt` or `description`; `cover`, `hero` or `featured`; `afterH2`, `after` or `section` — and anything unrecognised was silently dropped, leaving articles with no prompts. The importer now reads all of these, accepts an images object keyed by slot as well as a plain list, and even a bare list of prompt strings, which it aligns to the image markers in the article. Verified against ten different shapes: every one yields the same clean result.
- The instructions that ask an AI for image prompts now demand a prompt that works unchanged in any generator — Midjourney, DALL-E, Stable Diffusion, Nano Banana, Firefly. Tool-specific syntax such as `--ar` or `::weights` is explicitly banned because it breaks every other tool, and the prompt must name subject, setting, lighting, framing and mood in 25-60 words.
The Image Prompts the Wizard Writes Are Now Actually Shown
Fixed
- The Content Wizard writes a ready image-generation prompt for every cover, in-content and Pinterest image — and there was no way to read any of them. The queue had a window built for exactly this, but the button that opens it had been removed as "redundant" while the window itself stayed, so the prompts were unreachable from anywhere in the admin. The button is back on every item that has an image plan, with a badge showing how many prompts it holds.
- The wizard's final step now lists every prompt it just produced, grouped per article, each with the exact filename to save the generated image under. There are copy buttons per prompt, a copy-all button, and a download-as-text button for taking the whole set into another tool. The wizard had been promising this since step 3 ("the final step explains exactly what to do") without delivering it.
- The queue preview window showed the article and, once images were matched, the images — but never the prompts. It now lists them under the content with a mark showing which ones already have an image and which are still waiting.
Content From Any AI Now Renders Properly, and the AI SEO Panel Tells You What To Fix
Improved
- The AI panel in the post editor's SEO tab was a flat list of observations. It now opens with a score bar and a plain verdict ("fix before publishing", "ready to publish"), followed by a ranked "do these first" list, then ready-to-use text you can put straight into the post: two title options, a meta description, a rewritten opening paragraph and the headings the article is missing. Title and meta apply to their fields with one click; the rest copies.
- Each finding now quotes the sentence it is about, verbatim from your post, and carries an impact and effort label so you can tell a five-minute fix from a rewrite. Quotes are checked against the actual text before display — a paraphrased or invented one is dropped rather than shown. Findings are ordered problems-first, highest impact first.
- A cut-off AI response used to fail with "returned non-JSON despite schema", which said nothing about the cause. It now names the real problem — the response ran out of token budget — and the SEO analysis budget was raised so it stops happening.
Fixed
- Content written by one AI and pasted or imported into jekcms could reach the site with raw `###` markers and text running together in one unbroken block. Every model writes differently — some produce Markdown, some HTML, most a mix of both — and mixed content was passed through untouched: the HTML parts rendered, everything between them did not. The converter now keeps the HTML exactly as it is and converts the Markdown islands sitting between it, so headings, lists, tables, quotes and paragraphs come out right no matter which assistant wrote them. Verified against pure Markdown, pure HTML, deliberately mixed and unmarked plain prose.
- Inline markers left inside HTML paragraphs — `**bold**`, `[text](link)`, backtick code — were printed literally on the page. They are now converted wherever they appear in text, while anything inside a code block is left untouched.
- Content sent through the public API or an automation was never converted at all: only the publishing queue did that. A Markdown body posted from n8n or a script published with its markers intact. The API now runs the same conversion.
- AI Draft produced thin articles — roughly 350 words when 1000-1500 was selected. Length is now requested the way models actually follow, as a paragraph budget per section, and the same quality and formatting rules the Content Wizard uses apply here too. Measured after the change: 1185-1733 words, each draft carrying a table, both list types, bolded terms and a callout, with no oversized paragraphs.
- AI Draft showed an API error on the first attempt and worked on the second. A single failed call now retries quietly with spacing between tries, and an error is only shown when generation genuinely could not complete. Transient "high demand" responses from the provider are also retried instead of being surfaced raw.
Hotfix: API Settings Page Stopped Halfway, and the Key Row Now Shows What It Is Doing
Improved
- The Gemini key rows were cramped: the enable checkbox, Test and × were pushed against the right edge with the key field stretched across the rest. Each row is now a bounded card with its controls grouped together and room to breathe, and it stacks cleanly on narrow screens.
Fixed
- Settings → API stopped rendering halfway through in 2.65.51: everything from the AI model selector down — the model list itself, the quota fields, the privacy options and the Save button — was missing, and the model dropdown appeared empty. A helper introduced with the new model list did not exist under that name, so PHP aborted the page at that exact point. Introduced in 2.65.51 and fixed here; no data was affected, only the page output.
- Removing a Gemini API key with × gave no visible feedback when it was the only key left. The saved key is shown as a masked placeholder rather than a value, so clearing it changed nothing you could see — it looked like the button did nothing. The row is now dimmed and struck through, the field reads "key will be deleted", the explanation appears full width instead of squeezed into the label column, and an Undo button restores the key if you clicked by mistake. The same explanation, and Undo, now also appear when one of several keys is removed.
Newer AI Models, and Generated Articles That Actually Look Like Articles
Improved
- The AI now runs on Google's current generation of models instead of the 2.5 family. The default for writing is Gemini 3.6 Flash, chosen on measured reliability rather than version number: asked for a full 1200-1800 word Turkish article, the old default returned usable output in two runs out of three, the new one in three out of three. That single change is what fixes the complaint that selecting five articles produced only four — a five-article run now completes five for five. Image generation moves to Nano Banana 2, and the model list in Settings has been rebuilt from models verified to answer, so a retired name can no longer sit in the menu.
- Articles generated by the Content Wizard were arriving as unbroken walls of text: no tables, no lists, no sub-headings, nothing emphasized. The site has always rendered all of that — the instructions simply never asked for it. They now require short paragraphs, sub-headings, at least one comparison table, bulleted and numbered lists, bolded key terms, a practical callout and a closing takeaway list. Measured across generated articles: paragraphs over 80 words dropped from routine to zero, and every article now carries a table, roughly a dozen list items and around ten highlighted terms.
- Generated articles were also coming in short — around 900 words when 1200-1800 was requested. Length is now requested in a form models follow accurately, as a paragraph budget per section rather than a total word count, which brings articles back inside the range you asked for.
- The model you pick in Settings now actually drives content generation. Until now that choice only affected SEO analysis; the writing path ignored it and always used a fixed model, so changing it appeared to do nothing.
Fixed
- The one-sentence visual brief that guides every AI image was being cut off after about two words. Its token budget left no room once the model's internal reasoning took its share, so a brief meant to describe a full scene arrived as a fragment — and every generated image was drawn from that fragment. Briefs now come through complete, around thirty-five words, which is the difference between a described scene and a guess.
- A model that Google retires no longer takes the site's AI features down with it. Gemini 2.5 Pro was offered in the Settings menu and now answers 404; any site left on it had every AI feature failing with no visible cause. Retired names are migrated on update, and if a configured model turns out to be unavailable — retired, or not included in your API key's tier — the request falls back to a working model instead of failing.
- Newer models reject the request we send to disable internal reasoning, and reply only with "invalid argument" without naming the field. Left alone, upgrading the model would have silently killed SEO analysis, content generation and image briefs at once. Each path now recognizes the refusal, retries without that setting and remembers the result per model.
Automation Overhaul: Queue Publishing Unblocked, Bearer Auth Fixed, Imported Content Sanitized
Security
- Content arriving through an automation channel is now sanitized before it can be published: imports, the Content Wizard and the public API strip script-capable markup on the way in, while keeping everything an article legitimately uses — headings, lists, tables, images, links, code blocks and video embeds from known providers. Content you write yourself in the editor is unchanged.
Fixed
- Articles produced by the Content Wizard could not be published at all: the quality gate inspected the raw queued text and rejected every item for containing an unresolved image marker — even though publishing removes those markers moments later, so nothing could ever leak. In testing, six of six generated articles were blocked; with the gate now judging the text that will actually be published, six of six publish cleanly and no marker reaches the site. This affected every wizard and JSON import that had not matched images by hand.
- API requests authenticated with "Authorization: Bearer
" were rejected with 401 even when the key was valid, because most Apache/CGI setups do not hand that header to PHP — while the admin's own API Keys screen recommends exactly this method and it is the default in n8n. The key is now read from every source the server may expose, and the site config passes the header through. X-API-Key keeps working unchanged. - A malformed JSON body sent to the API produced a bare "Internal error" 500. Bad JSON now returns 400 with the parser's reason, and a create request missing title or content returns 400 naming the fields — so an automation shows you what to fix instead of a dead end.
- JSON import crashed with a 500 when a field arrived as an array or object instead of text (a hand-edited file, a mis-mapped automation), and when the articles wrapper was an object rather than a list. Both shapes are now accepted or skipped cleanly, with the reason reported per article.
Content Generation Is Around Four Times Faster, and Stop Now Works Instantly
Fixed
- Generation in the Content Wizard could sit for a long time and then end with a network error. Two causes, both fixed: Gemini 2.5 models spend invisible reasoning tokens from the same output budget as the text, which made every article slower and occasionally truncated it; reasoning is now switched off for content generation, exactly as the SEO analyzer already did. And a single request now stays inside a strict time budget — the automatic retry only runs when there is time left for it, so a request can no longer outlive the server's limit and leave the browser with a dropped connection. In testing, one article went from about 25-60 seconds to 8-12 seconds.
- The Stop button did nothing until the article in progress finished, which could take a minute. It now cancels the running request immediately, shows "Stopping…", and the interrupted item is no longer listed as an error.
- During generation the screen showed no sign of activity. Each article now displays a live counter ("generating #2 · 14 s"), so a long run never looks frozen, and a genuine connection failure now says so in plain language instead of just "network error".
Cleaner Installer Packages: Build-Machine Runtime Files Are Excluded
Fixed
- The installer packages could include runtime files produced on the machine that built them — session files under storage/ and images under uploads/. A fresh install therefore started with unrelated media in its library, and session files had no business travelling with a package at all. Packaging now ships the folders (so permissions and protection rules stay intact) without their runtime contents, and skips stray temporary files in the project root. Your installed sites are unaffected; this only changes what a new download contains.
Wizard Articles Get Their Images Automatically: One-Click AI Images Integration
Added
- The Content Wizard and the AI Images plugin now work as one system. The image plan the wizard writes for each article (the cover prompt and every in-content image prompt) is handed to the plugin at publish time, so the generated images match what the wizard planned for that specific article instead of a generic concept. In the wizard's final step, the Images card now enables the plugin with a single click — no detour through the Plugins page — and explains that an image-capable API key is required.
Fixed
- With the AI Images plugin set to generate at publish, the quality gate no longer blocks queue items whose planned images haven't been manually matched — the plugin is about to produce those images, so the "unresolved image marker" warning doesn't apply. When the plugin is off, the gate still protects the manual workflow exactly as before.
Content Wizard Generation Is Now Reliable: Structured JSON Mode and a Bigger Output Budget
Fixed
- Starting generation in the Content Wizard could fail with "Could not extract valid JSON from the AI response". Server diagnostics showed the model's answer was being cut off mid-article: on Gemini 2.5, invisible reasoning tokens share the same output budget as the text, so long articles hit the ceiling and arrived truncated. Generation now requests the provider's structured JSON mode (the reply is guaranteed to be syntactically valid JSON, with no markdown fences), the output budget was doubled, and if a response still can't be parsed the wizard automatically retries once before reporting an error. The AI Draft screen uses the same JSON mode and a larger budget too.
On/Off Switches Render Correctly in Every Settings Row
Fixed
- On/off toggle switches placed inside standard form rows could collapse: the track disappeared and the On/Off labels overlapped each other (visible for example on the "How this content was made" switch at the bottom of Settings → API). A general form style was overriding the switch layout; the component now always keeps its shape, everywhere in the admin. The affected row also got clearer spacing between its title and description.
AI Draft Now Recognizes Your Saved Gemini Keys, and Generation Rotates Between Them
Improved
- Content generation now honors your multiple Gemini keys: if a key hits its quota, is unauthorized, or has been revoked, jekcms automatically retries with the next key in your list — the same rotation the SEO analyzer already had. Previously only the first key was ever used for drafts and wizard articles.
Fixed
- On fresh installs, saving a Gemini API key in Settings → API and then opening the AI Draft screen still showed an "API key required" warning with the Generate button disabled — the settings form stores Gemini keys in the multi-key list, but the AI Draft screen (and the Content Studio status card) only looked at the old single-key field. Both now read the same key store the settings page writes to, so a key you saved is a key that works.
- Generating a draft could be cut off mid-request on servers with a strict PHP time limit; the AI Draft screen now allows the same generous time window the Content Wizard already used.
AI Draft Generation Works Again, and All Five AI Providers Are Now Fully Supported
Added
- Claude (Anthropic) and Cohere are now fully working AI providers for content generation. All five providers offered in Settings → API — Gemini, Groq, Cohere, OpenAI and Claude — generate drafts and wizard articles through the same client, each with a sensible default model.
Improved
- The Content Wizard's article-generation endpoint now enforces the same license check as the wizard screen itself, and logs a diagnostic sample to the server log when an AI response cannot be parsed — making "could not extract JSON" reports actually debuggable.
Fixed
- The AI Draft screen's Generate button had been failing with a server error on every click since v2.28.0 — an internal file was loaded after the code that needed it. Generating a draft from a topic now works end-to-end again: the article is produced, previewed, and saved as a draft through the quality gate.
- The Test button next to the Groq, OpenAI, Cohere and Claude API key fields used to reply "provider not wired" even for perfectly valid keys. It now performs a real test call against the selected provider — the same code path content generation uses, so a passing test means generation will work too.
- With Cohere or Claude selected as the provider, the AI Draft screen claimed no API key was configured even when one was saved. Provider key lookup now covers all five providers.
- Content pasted with a broken character encoding could make the AI request go out with an empty body, producing a baffling provider error. Invalid bytes are now cleaned before the request is built.
- When AI features are disabled because of the site's license status, the editor now says exactly that and points to the license page — previously it claimed AI was "not configured", sending users to reconfigure settings that were fine.
- AI task-specific settings (such as the SEO analyzer's larger response budget) were being overridden by the global defaults, which could truncate long analyses. Task settings now take precedence, and bulk SEO analysis now writes its suggestions in the site's content language rather than the admin panel language.
SEO Preview in the Post Editor Now Always Shows Real Data
Fixed
- The search-result preview at the top of the SEO Settings box could render completely empty — just the URL, no title or description — whenever the SEO title and description fields were blank but an SEO record already existed for the post (for example after setting only a focus keyword). Your published page never had this problem: the site falls back to the post title and excerpt, but the preview didn't mirror that. The preview now uses the exact same fallback chain as the live site — SEO title → post title, SEO description → excerpt → content text — so it always shows what Google will actually see.
- The preview also updates live now: typing in the post title, excerpt or slug immediately refreshes the preview (previously it only reacted to the SEO fields themselves), long titles and descriptions are truncated at Google's display limits, and the URL line follows your slug as you edit it.
Archive Pages Now Emit Breadcrumbs and a Proper Listing Type
Improved
- Category, tag and author archive pages now include BreadcrumbList structured data (Home › Category), so Google can show a breadcrumb trail under these pages in search results — previously only single posts had one. The archive pages are also now typed as CollectionPage instead of a generic WebPage, which more accurately tells search engines they are listing pages. Single posts and the homepage are unchanged.
Heading Fixer Capitalizes Turkish Words Correctly
Fixed
- The Heading Fixer tool (Advanced SEO → Content) title-cases your headings, but it capitalized the first letter with a routine that follows English rules: a Turkish lower-case "i" became a dotless "I" instead of the correct dotted "İ". So on Turkish sites a heading like "içerik yönetimi" was turned into "Içerik Yönetimi" instead of "İçerik Yönetimi", and every word starting with i (izmir, internet, iş…) was mis-capitalized. Capitalization now follows the site's content language: Turkish sites get the correct İ/ı casing, English sites are unchanged (i → I). "ışık" → "Işık", "içerik" → "İçerik".
A Failed Security Check No Longer Looks Like a Server Crash
Fixed
- When an admin action failed its CSRF security check — most commonly a benign case: you left a tab open long enough for the token to rotate — the server replied with HTTP status 419. That code is not part of the official HTTP standard, so Apache rewrote it to 500 on the way out, and the browser showed a scary "500 server error" for what was really just an expired token. The request is now rejected with the standard 403 Forbidden, which Apache passes through unchanged, so the admin gets the correct "please reload and try again" response and server logs stop showing phantom 500s. This affects every admin form and AJAX action, not only the SEO tools.
Correct Social-Share Image Dimensions and Turkish Word Counts
Fixed
- The og:image:width / og:image:height tags were hardcoded to 1200×630 for every share image. Sites that use portrait featured images (common on recipe, pets and Pinterest-focused blogs) were telling Facebook, LinkedIn and Twitter the image was landscape, so the social-card preview came out cropped or letterboxed. The tags now report the image's real dimensions (read from the file), and are omitted entirely when the size can't be determined — a wrong size is worse than none.
- Word counts and "X min read" estimates were computed with a routine that only understands the English A–Z alphabet, so Turkish letters (ü, ı, ğ, ş, ç, ö) were treated as word breaks — "güzel" counted as two words. This inflated the reading-time badge, the JSON-LD wordCount and the schema "time required" value by roughly 40% on Turkish sites. All of these now count whole Unicode words, matching the SEO analyzer, so the numbers are correct across the article, its structured data and every theme.
Traffic Setup Score Reads 0% Until You Connect a Channel
Fixed
- After the previous fix, a brand-new site still showed 17% instead of 0%. The AI-crawler policy was being counted as a completed setup step, and since it defaults to "allow all," every fresh site got that one step for free. But that setting is about letting bots read your site (inbound), not about distributing your content (outbound), so it never belonged in the distribution setup score. It has been removed from the calculation — a site with nothing connected now reads 0%, and the score rises only as you actually connect social, Pinterest, IndexNow, WebSub or the newsletter. The AI policy is still shown in the card, just not counted.
SEO and Setup Scores Start at 0 on a Fresh Site
Fixed
- The dashboard's Traffic Control ("Distribution setup score") showed 48% on a brand-new site with nothing configured. It was built as "100 minus penalties," and because the penalties never summed to 100 the score floored around 48 no matter what. It is now a true completion score — done setup steps ÷ applicable steps — so an unconfigured site reads 0% and rises as you connect social, Pinterest, IndexNow, WebSub and the newsletter. Queue/bounce errors are no longer mixed into the score; they stay in the issues list.
- The single-post SEO analyzer showed 29/100 before you typed anything. Two categories scored full marks on a blank post: readability (an empty draft trivially has "no long paragraphs or sentences") and schema (a blank draft defaults to "auto"). Both are now only graded once there is real content, and a post with nothing entered reads 0. The posts list and the server-side recalculation were aligned the same way, so a blank post is 0 everywhere instead of 29 in the editor and 5 in the list.
- The AI analysis endpoint returned a 500 error for a non-POST request; it now returns a clean 405 Method Not Allowed.
A Professional Media Library: Drag to Select, Edit Alt Text Without Leaving the Page
Added
- WebP and AVIF quality are now configurable from settings, with safe universal defaults (WebP 82, AVIF 60). As before, uploaded JPEG/PNG files are converted to a modern format and the original is not kept, keeping your uploads folder lean.
Improved
- The Media library now works like a modern media manager. Drag a rectangle across the grid to select several images at once, or Ctrl/Cmd-click to add and remove items individually. A floating action bar appears with the count and one-click Delete, so bulk actions no longer need the dropdown.
- Each image has a pencil button that opens a slide-in panel where you can edit the title, alt text and caption without leaving the page — with a live character counter and guidance to keep alt text under ~125 characters. Images still missing alt text are marked with an "Alt missing" badge, and the badge clears the moment you add one.
- The library header now shows WebP and AVIF support at a glance, plus how many items are still missing alt text or a caption, so accessibility and SEO gaps are easy to spot.
Your FAQ Now Shows on the Page, and Autosave Is Calmer
Fixed
- The FAQ questions and answers you enter under Structured Data were only sent to search engines as hidden schema — they never appeared on the page for readers. They now render as a clean expand/collapse "Frequently Asked Questions" section at the end of the article, on every theme. (This also matches Google's own requirement that FAQ content be visible on the page.)
- Autosave ran every 30 seconds, which was more often than needed and could collide with the editor switching a new post into draft-edit mode. It now runs every 2 minutes.
Go live today
Setup, content management, SEO and image optimization — all in one platform. Get started in 30 minutes.
View Pricing- Setup and live in 30 minutes
- 14 ready-made themes
- AVIF/WebP image optimization
- Automatic SEO — Sitemap, Schema.org
- Cookieless built-in analytics (ZeroTrack)