What's new

Fixed: several ways you could still get signed out early

• Reloading the dashboard, or coming back to a tab you'd left open, could sign you out even though your session was still good — a gap in how the page restored your sign-in state. Sessions now stay signed in for the full 30 days across reloads, the same way commenting sign-in already worked.
• A brief hiccup on our end — a slow moment, a restart during an update — no longer ends your session. Your browser used to treat any failure to renew a session as "you're signed out", so a few seconds of trouble signed you out for good. It now holds onto your session and simply tries again.
• Keeping the same site open in two tabs no longer signs you out. Both tabs renewing a session at the same moment looked like a stolen sign-in, which ended every session you had — dashboard, phone, and every site you comment on. Tabs now hand off to each other, and in the rare case we do end a session to keep your account safe, it ends that one sign-in instead of all of them.

Commenting now stays signed in

• Sign in once and you'll stay signed in on that site until you actually sign out — no more getting logged out mid-conversation and having to sign back in just to post a reply.
• Works the same way across every sign-in option: magic link, Google, X, and Facebook.
• Signing out now properly ends that session on our servers, not just in your browser.

Large imports finish, and imported comments actually show up

• Importing a big archive no longer stops partway. A large export used to be cut off by a request timeout after a few minutes, quietly leaving most of your threads behind with nothing to tell you it had happened. Imports now run in the background and report live progress — you can close the page and come back.
• If an import is interrupted, it says so, and re-uploading the same file picks up where it left off instead of creating a second copy of everything.
• Imported comments now appear on WordPress sites. An export identifies each thread by its page address while the WordPress plugin identifies it by post, so imported discussions could land on a thread the widget never looked at. Both sides now resolve to the same thread, in either order — import first or install first.
• Re-importing the same file no longer duplicates comments, and comment text imported from WordPress renders as text instead of showing raw markup.

Import your comments

A moderation queue that keeps up with big sites

• The pending queue no longer drags every comment body on the site across the wire to build a single page. Sites with thousands of comments stopped timing out, and "Load more" pages all the way to the end instead of stranding you mid-queue.
• "Open comment" in the moderation queue now deep-links to the exact comment on your page instead of dropping you at the top of the bare page URL.
• Threads self-heal their page URL. If the very first visitor loaded the widget on a homepage or a redirect, the thread used to keep that URL forever and every comment link pointed at the wrong page — later views now correct it to the real article URL.
• For sites that already collected stale URLs, a new maintenance pass repairs them from your sitemap rather than waiting for a visitor to trigger the fix.

Your comments are now readable by search engines and AI answer engines

• Every thread now publishes schema.org `DiscussionForumPosting` structured data, with each comment nested as a `Comment` — so the discussion under your article is machine-readable, not just the article.
• It ships two ways: the widget injects the JSON-LD on the page for standard crawlers, and a server-rendered endpoint returns the full approved-comment tree for publishers who want to include it server-side, where non-JS AI crawlers can see it.
• Approved comments only. Pending, rejected, and spam comments are never exposed in structured data.

Buttons you can actually see

• Secondary buttons across the dashboard and site now meet the WCAG 1.4.11 non-text contrast bar — their borders are visible on light backgrounds instead of nearly vanishing.

Checkout fixed, and watched continuously

• Fixed a bug that made every attempt to start a paid plan fail. Upgrading works again.
• A synthetic monitor now runs the real checkout flow against production on a schedule, so a broken upgrade path alerts us instead of quietly blocking sign-ups.
• Production now refuses to boot on a Stripe sandbox key, which removes a whole class of billing misconfiguration.

Passkey sign-in fixed

• Passkey (WebAuthn) enrollment failed verification for everyone; registering a passkey now works, and the case that broke it is covered by a spec-vector regression test.

A public roadmap you can vote on

• The roadmap is public: vote-ranked items in status lanes, so you can see what is planned and push what matters to you up the list.
• The feedback form now asks what kind of feedback you are sending (bug, feature request, or something else) and asks before anything you write is shown publicly.
• New DMCA policy and counter-notification process, plus a plain-language privacy notice covering roadmap votes and feedback.

Public roadmapPrivacy Policy

Theme builder, spoiler polish, and free reply notifications

• New theme builder: paste your page URL, tune the widget colors against a live preview, and copy the finished snippet. Reachable from the homepage, docs, widget gallery, and your site settings.
• Spoilers got a frosted-blur treatment instead of the old striped block, and emoji reactions now pop on hover and click.
• Spoiler support is a per-site toggle in the dashboard — turn it off for sites where masked text is noise.
• Composer polish: Material icons, tactile button states, and on mobile the Post button stays on the toolbar row instead of wrapping.
• The notification dropdown no longer gets clipped on mobile.
• Pricing is clearer about what free means: reply email notifications are included on Hobby, there are no ads and no tracking on any plan, and removing the EchoThread footer link is the paid upgrade.

Theme builderPricing

Widget gallery and adaptive theming

• A public widget gallery shows the widget in each of its themes, so you can pick a look before installing.
• Adaptive theming: a custom accent color is now honored on custom backgrounds instead of being overridden by the preset palette.
• Fixed Google sign-in in browsers with strict cross-origin popup isolation, where the popup could hang after a successful sign-in.
• GitHub was removed from the dashboard sign-in options — owner accounts use Google or a magic link. (Commenter sign-in options are unaffected and configured per site.)

Widget gallery

Commenters can sign in with X or Facebook

• X (Twitter) and Facebook join Google and GitHub as commenter sign-in options in the widget.
• You choose which providers your readers see: a Sign-in methods control in the dashboard toggles each one, with at least one always enabled so no site can lock its readers out.
• Neither provider reliably returns an email, so a returning reader is matched to a stable identity without one — the same person stays the same commenter.

Tax handled at checkout

• Checkout now calculates tax from your billing location automatically.
• Business buyers can enter a VAT or tax ID during checkout and get a compliant invoice.
• The billing address you enter is kept on file, so renewals and the billing portal stay tax-correct.

The widget speaks your readers' language

• The widget UI is localized (English, Korean, Italian) and picks a language per visitor from the browser. Set `data-lang` to pin one language; anything unrecognized falls back to English. Comment content itself is never translated.
• Moderation is no longer biased against non-English comments: a high spam score alone routes a comment to review instead of hiding it, and auto-hiding now requires a corroborating content signal such as a link or promo pattern. This started with a friendly Korean comment being auto-hidden as spam.
• Approving a comment the filter flagged now teaches the spam classifier it was wrong.
• Docs, README, and the in-product install snippet all document the language options.

Localization docs

WordPress plugin live, Terms of Service, and a fixed sign-in popup

• The WordPress plugin is published in the WordPress.org directory as "ThreadBridge Comments for EchoThread" — install it from your WordPress admin, paste your shortname, and pick where comments render.
• A full Terms of Service page, and gaps closed in the Privacy Policy.
• Fixed commenter sign-in on embedded sites: the sign-in popup now returns your session to the page you were reading instead of stalling after a successful sign-in. The origin it returns to is signed and validated against your site, so the fix does not open a redirect hole.
• Subscription webhooks now tolerate newer Stripe API versions, so plan changes keep syncing rather than silently drifting.
• A public product-capabilities endpoint states what EchoThread does — what is free, what is paid, what data is handled — in a form other tools and AI agents can read directly.

Terms of ServicePrivacy Policy

Setup a non-developer can finish

• No-code install guides for Squarespace, Wix, and Ghost, plus a platform picker in the dashboard that deep-links you to the guide for your platform.
• Install detection: the dashboard now says "Widget detected on yourdomain.com" with a first-seen time, instead of leaving you to reload and hope.
• "Send setup to your developer": generate a secure expiring link (or email it) that opens a no-account page with the snippet, where to paste it, and the key. Your key is never put in the email body.
• Your registered domain is now enforced as an allow-list on embed endpoints, so an API key copied out of your page source does not work from someone else's site.
• One page is one thread again: `/post` vs `/post/`, `http` vs `https`, `www` vs apex, and `?utm=…` links no longer split a single page into separate threads. Existing threads are matched on both the old and new keys, so nothing is orphaned.
• The install flow is localized and hardened for screen readers, and states in plain language what data is handled, with a link to the DPA.

Install guides

EchoThread 1.0 — out of beta

• EchoThread is now generally available. The beta label is gone: hosted comments with a first-party ML spam filter, no-account commenting, threaded replies, reactions, and a full moderation dashboard are all production-ready.
• The Hobby tier is a permanent free plan for your first site — 10,000 page views and 1,000 comments per month, no credit card, not a trial.
• Lifetime-free guarantee for early adopters: anyone who joined before launch keeps the Hobby tier free for life on every site they had at launch, even if Hobby limits change later. No rug-pulls.
• Paid plans (Starter $5/mo, Pro $19/mo, Business $79/mo) are available when you outgrow Hobby, billed through Stripe with soft usage limits and warning emails before anything is enforced.

Spoiler tags + clearer formatting in the comment composer

• Spoilers: type `||your spoiler||` in any comment — readers see a masked block they can click (or focus and press Enter or Space) to reveal, Escape to re-mask. Keyboard-focusable with `aria-label` state announcements; aligned with WCAG 2.1 AA.
• Composer toolbar reordered to make formatting obvious: Bold · Italic · Spoiler · divider · Emoji · Image. Each format button shows its keyboard shortcut and the matching markdown in the tooltip.
• New empty-state hint inside the composer (`Format: **bold** · _italic_ · ||spoiler||`) that disappears once you start typing — zero noise, full discoverability.
• Existing **bold** and _italic_ syntax keeps working unchanged; this ships only as additions and a visual refresh of the toolbar.

Accessibility, keyboard speed, and zero-CLS loading

• Embed widget now ships visible focus rings on buttons, inputs, and the compose editor, ARIA labels on the compose toolbar, image-remove, and lightbox-close buttons, a focus-trapped image lightbox, and broad prefers-reduced-motion coverage across animated affordances — moving the widget closer to WCAG 2.1 AA.
• Moderation queue: keyboard shortcut hints (A approve, R reject, D delete, I open profile) now appear on the focused row, so power-user moves are discoverable without leaving the page.
• Moderation queue: recent searches stay one click away (session-scoped), bulk actions report live progress, and a fresh-load timestamp tells you exactly how stale the view is.
• Comment list now loads with skeleton placeholders instead of a spinner — eliminates the layout shift readers used to see on slow networks.
• "Be the first to comment" empty state on fresh threads invites readers in instead of showing a silent gap.
• Faster notification cleanup: "Mark all read" and "Clear all" run with bounded concurrency server-side instead of one sequential update per item.

SEO internal links across docs and blog

• Added "Further reading" links from /docs into related blog posts.
• New per-post SEO update script for bulk-tuning blog meta titles and descriptions.
• Tightened blog post fallback titles to match the H1 (no more drift between rendered H1 and meta).

AI spam-prevention spotlight on the homepage

• New "Spam doesn't stand a chance" section showing a live moderation queue mockup.
• Surfaced inline scoring and the Siftfy classifier brand in the moderation mockup.

Siftfy ML spam classifier replaces heuristic filter

• New comments are scored by a trained ML classifier instead of keyword heuristics when spam filtering is enabled.
• Borderline scores route to the moderation queue; high-confidence spam is filtered out of the public thread.
• Spam filtering can be toggled per site from the Site Settings panel.

Admin recent-activity panel

• Dashboard home now shows a unified recent-activity feed across all sites you own.
• Notification bell with unread count.

Bulk moderation actions in the queue

• Multi-select comments in the moderation queue and approve / reject / mark-spam in one click.
• Keyboard shortcuts (a / r / s / d) for power moderators.

Blog launched

• /blog goes live with launch announcement, competitor breakdown, and a "drop-in comments anywhere" guide.
• Blog runs on a separate S3+CloudFront pipeline so it can ship independently of the dashboard.