# FlowMap Changelog *By James Hills — Updated October 2026* Release notes for FlowMap, newest first. For how to install, set up and use each feature, see the FlowMap Documentation. ### 2.34.0 - 2026-10-30 - Redirect suggestions. On the Triage screen for a dead path, FlowMap now shows the three most likely target pages with a match figure and a one-click "Redirect to this". On a page's Health tab, a verified-broken link shows its best likely target. The target picker in the Route editor opens already searching the dead URL's words. Nothing redirects without your click, and the chosen page must be a live page that is in the sitemap. - Security headers for managed files. The Files screen now builds a ready-made block of `.htaccess` lines (`nosniff` and a strict content security policy) that stops browsers from running verification files. It shows a status of Present and current, Present but stale or Missing, and a Copy block button. FlowMap only reads `.htaccess` to check the status and never writes to it. Paste the block once, and again when the status says stale. - Managed html and xml files can no longer contain a `` tag. - Menu items whose article or category is unpublished, expired or deleted no longer reach the sitemap. Archived articles, which Joomla still serves, stay. - A missing image or icon now gets a tiny 404 response instead of rendering the whole site page. Joomla redirects still win, and the hit is still logged for the Errors screen. The response is marked `no-store` so an image uploaded minutes later is not hidden by a cache. This works whether or not the branded 404 page is turned on. Disabling the System - FlowMap Error Pages plugin returns Joomla to its normal behavior. - Healthy pages are now re-checked. A third of each link-checking run (never fewer than 5 pages) goes to the pages checked longest ago. A re-checked page that answers 429, 403 or a server error is treated like a timeout: it stays in the sitemap and is tried again. A 404, a 410 or a redirect still takes the page out at once. The hourly task still stays within 150 checks. - Errors screen: it now opens filtered to Internal referrer. Requests for site icons (favicon, apple-touch-icon and similar) become a new noise type, "Missing site icon", and `/console` joins the list of probe paths. A referrer that names the site's own host on a non-standard port is now counted as external. Existing rows are reclassified once. - Screen tidy-ups: the Inbox kind filter says "Broken links" instead of a raw key, Provider cards show a readable name, screen titles wrap under the toolbar, long values in Errors and Providers wrap instead of scrolling sideways, and the Routes list has a New button. - Gate plugin users: VIP cookies can now be revoked. A cookie only works while its entry still exists, so changing a VIP code or deleting its entries ends the old cookies. Cookies issued before this release stop working once, so VIPs enter the code again after the upgrade. Each re-entry counts toward the rule's "Bypass Code Max Uses", so raise that limit before upgrading on any rule that has one. - Gate plugin users: the failed-code throttle now believes the `CF-Connecting-IP` header only when the connection really comes from a published Cloudflare address range. Any other source is throttled on its own address. The per-rule ceiling rises from 5 to 60 failures per 15 minutes, so a handful of bad attempts from one source can no longer lock every VIP out. - The public directory search term is capped at 100 characters. ### 2.33.1 - 2026-10-30 - Agent markdown only serves what an anonymous visitor could read. It now refuses articles that need a login, are not yet published, have expired, or sit under an unpublished or non-public category. - Managed html, htm and xml files now refuse active content: script elements, event handler attributes, `srcdoc`, script URLs, and (for xml) DOCTYPE and entity declarations. A `` in an html file used to produce a notice and now blocks the save. More executable extensions (such as php3 to php8, pht, phps and shtml) are treated as dangerous. - Only the site's own web addresses can enter the inventory. Custom URLs and provider pages on another host, or with a scheme other than http or https, are refused during the build and can never become a redirect target. - Link checking connects only to the address it vetted, which closes a DNS rebinding gap. - Sitemap file names with hyphenated provider segments, such as `sitemap-cruise-tools.xml`, now serve correctly, and FlowMap refuses to serve anything outside the sitemap folder. - The `X-FlowMap-Markdown` response header gives the public only a short outcome code. Extra detail is shown to logged-in administrators only. - Fixed: one failing provider plugin no longer wipes every provider's settings. The Providers screen shows a warning, and Save is refused until the plugin is fixed. - Fixed: saving a provider level or menu visibility for the first time from two places at once no longer produces a server error, and a malformed form post is refused with a message. - Fixed: simultaneous sitemap requests can no longer start two full builds at once. - Fixed: articles whose category (or any parent category) is unpublished or not public are no longer collected. They used to reach the sitemap and then 404 for crawlers. The same applies to a published category under an unpublished or non-public parent. - Fixed: a build run from the command line used to delete every menu row. Command line callers now queue a build for the next sitemap request instead. - Agent markdown now runs after the Gate plugin has decided, so a gated URL can never be served as markdown. - The Inbox broken-links summary now names each sampled page and links to the full list in Pages when there are more. - New Health row, "Canonical and share tags". It fetches the home page and one live article, and warns when `rel=canonical` is missing or a large-image card has no image. ### 2.33.0 - 2026-10-16 - New Providers screen. When a plugin adds its own pages to the site, FlowMap now owns the decision about those pages in one place: whether search engines may index them, whether they appear in the XML sitemap, and whether they appear on the HTML sitemap. Each provider gets a card with one row per level of page. - Per level you can set Search Engines (index or noindex), Window (off, next N days, or all from today, for pages with a date), Minimum (a number), XML and HTML. A level with nothing saved shows its declared default, marked "default (not saved)". "Reset to default" removes your saved settings. XML is switched off automatically for a noindex level. - Any plugin that adds pages can be configured, even one that declares no levels. Its pages appear as a single "All pages" level. - HTML sitemap provider sections. A saved section lists a provider's pages before or after the menu tree, with a title, order, grouping, a cap and a "View all" link. - Menu tree visibility. Hide one menu item, or a whole branch, from the HTML sitemap only. XML sitemaps and the pages themselves are untouched. - Nothing changes until you save something. With no saved settings, the HTML sitemap, every XML file, `robots.txt` and every page head are the same as in 2.32.0. - FlowMap's own page sources (menu items, articles, categories, tags and custom pages) are not providers and do not appear on the screen. - Every save, reset, hide and show clears the HTML sitemap from the page cache. Changes need the core.admin permission, viewing needs core.manage, and resets and Hide Branch ask for confirmation. - Two new database tables are added, both empty after the upgrade. ### 2.32.0 - 2026-10-06 - A menu item that links to a single article is now treated as an article in the sitemap. Before, these pages were written to `sitemap-pages.xml`. They now go to the article sitemap files. Category, tag, multi-item and other component menu items, and the home page, stay in the pages sitemap. - Article counts in the facets (categories, tags, years), the HTML directory and the Health check now include these pages. - One-time effect: these URLs move between sitemap files once, so per-sitemap reports in Google Search Console shift. There is no database change. ### 2.31.3 - 2026-10-05 - Fixed: after an article is renamed, the page-cache purge now also clears the address the site actually serves. Before, it cleared only the old address recorded in the inventory, so the renamed page could stay cached. This covers saves made in the admin and edits made by other tools. ### 2.31.2 - 2026-10-04 - Fixed: a page's date and tag list can now be cleared. Before, once their source went away, the old values stayed in the inventory. One result was a page being dropped from the page cache about every hour for no reason, because its date appeared to change on every build. - The first build after the upgrade clears the stale values and reports them once under "What changed". After that the report is quiet. - There is no database change. ### 2.31.1 - 2026-09-27 - New Start Fresh button on the Errors screen (core.admin only). It permanently deletes every Open and Archived error row so the numbers start clean. Ignored and Resolved rows, every route and redirect, and Joomla's own redirect table are never touched. The button stays disabled until Joomla's Redirects manager has purged its old unpublished rows, because deleting FlowMap's copy first would hide those paths forever. Afterward the screen shows "History reset on" with the date. - The list of scanner and probe paths treated as noise is wider, based on a sweep of real traffic. It now catches bare `/.well-known`, `/.aws/`, `/.vscode/`, a root `config.json`, `.php7` and `.shtml` files, `cgi-bin`, `graphql`, JCH Optimize's image cache, and whole path segments such as `old`, `new`, `backup`, `admin`, `app`, `uploads` and `mail`, without catching real content slugs like `blog/new-grill-review`. Existing rows are relabelled on upgrade. ### 2.31.0 - 2026-09-27 - The Errors screen now gives an honest picture of 404s. Previously the Errors dashboard widget could report thousands of "broken internal links" that were almost all scanner noise or very old. - Every 404 row is now classified. Genuine issues are Broken link, Dead source, External and No referrer. Noise is Probe: WordPress, Probe: secrets/config, Probe: script/extension, Cache: stale bundle and Spoofed referrer. Noise is now stored and can be filtered instead of discarded. - New Error Type filter on the Errors screen, with "Issues (all)" and "Noise / probes (all)" shortcuts. It defaults to issues. There is also an Archived state, an Error Type column and a "Reopened" badge. - Fixed: hit counts for repeat 404s were frozen because Joomla stops updating them once a row exists. Every build now re-reads the live counts. - New option, "Unresolved Recency Window (days)", default 30. An open row whose last hit is older than this moves to Archived. Nothing is deleted, and the row reopens automatically if it starts happening again. Set 0 to never archive. - Noise spikes now appear in the Inbox as "Noise spike" when a probe type jumps past three times its own 14-day median and over 500 hits in a day. - The dashboard widget, the Inbox "Fix at source" item and the Errors filters now all use the same definition of broken. ### 2.30.1 - 2026-09-27 - Fixed: the Health row "Version consistency" could report a failure on a healthy install after the 2.30.0 update because the database version stamp lagged behind. This release brings them back in line. There is no other change. - Internal improvements: the build now refuses to package the component without its matching update file. ### 2.30.0 - 2026-09-18 - Another extension, such as a gallery, can now supply the share image on a page FlowMap knows about. When it does, FlowMap stands down for the image tags only (`og:url`, `og:image`, `og:image:secure_url`, the image size tags and `twitter:image`). Everything else that describes the page is still emitted as normal, including the image alt text. - `og:url` stands down together with the image on purpose. Facebook caches by that address, and mixing a variant image with the main page address can leave the main page's card showing the wrong picture. - A page where no other extension supplies an image behaves exactly as in 2.29.0. - The "Minimum Aspect Ratio (auto-picked images)" help text now says it applies only to images FlowMap picks itself, not to an image another extension supplies. ### 2.29.0 - 2026-09-13 - Agent markdown. FlowMap can now serve a markdown version of an article to automated clients. It is served only when explicitly requested: add `.md` to the article address, or use the older `format` or `output` parameter. Normal visitors and browsers are unaffected. - Article pages now include a `` tag pointing at the markdown address, so the markdown version can be discovered. - The markdown body is produced the same way the page body is, including Joomla content plugins, so shortcodes and email cloaking work. If a shortcode is still unexpanded afterwards, FlowMap serves the normal HTML page and adds an item to the Inbox rather than serving broken text. - Responses carry a real `ETag` and `Last-Modified` and support 304 Not Modified. No `Vary` header is sent. - A list of recognised automated clients is built at the end of each build and published as `/flowmap-agents.json`. It is a reference list only. It does not block or allow anyone, because crawlers do not reliably obey such rules. - If another plugin on the site already serves markdown for articles, FlowMap stands down so only one of them answers. ### 2.28.4 - 2026-08-23 - Fixed: share images chosen during the hourly build never cleared the cached page, so live pages kept the old tags. The build now clears the cached pages whose share tags or other emitted values changed. - Fixed: tag pages now show their image source in the Pages list and the page editor (instead of a red "no image" badge), and the Pages filter can find them. - The build record now shows how many cached pages were dropped, next to the count of what changed. ### 2.28.3 - 2026-08-23 - Fixed: the "View live" button on a page's Health tab showed two identical external-link icons. ### 2.28.2 - 2026-08-23 - Fixed: on a narrow window, the "What this page shares now" preview image overlapped the text beside it. The image now shrinks to fit its column, and long addresses wrap. ### 2.28.1 - 2026-08-23 - Fixed: resolving share images did not clear the cached pages carrying the old tags, so the work was invisible. Populate Share Images, Refresh social and saving the per-page editor now clear the cache for pages whose output actually changed. - Populate Share Images now reports how many changed pages were dropped from the page cache. Clearing is best effort, so a cache problem never turns a successful save into an error. ### 2.28.0 - 2026-08-23 - Share images now fall back to the first usable image in the page's own content. For an article the order is Full Article image, then Intro image, then the first image in the text. For a tag page it is the tag's full image, then its intro image, then the first image in its description. Before this, a tag page went straight to the category, section and site defaults. - New options "Minimum Width (auto-picked images)" and "Minimum Height (auto-picked images)" (default 600 by 315, Facebook's large-card size) and "Minimum Aspect Ratio (auto-picked images)" (default 1.0). They apply only to images FlowMap picks from content. An image you chose deliberately is never filtered by them. Anything rejected falls through to the Default Share Image and stays findable under the "No image" filter in Pages. - Advert images are never picked, because the scan reads the stored text rather than the rendered page. ### 2.27.2 - 2026-08-23 - Fixed: the Health row "Version consistency" said the task plugin agreed on the version when it is deliberately not compared. It now names only what it compares. ### 2.27.1 - 2026-08-23 - Fixed: the Health row "Version consistency" reported a failure on a healthy install for two reasons. The task plugin is no longer part of the comparison, since it is versioned separately. The database version stamp had also fallen behind the installed version over several releases. ### 2.27.0 - 2026-08-23 - Fixed: tag page addresses were never converted to the site's published 4SEF form, so on a 4SEF site every tag page in the sitemap returned a 404 and was held back. Tag pages now get their real addresses, and `sitemap-tags.xml` is written when "Include Tag Pages" is on. - Fixed: several tags could collapse onto one address because of how tag ids were read. Each tag now resolves to its own page. - Fixed: a tag with its own menu item was listed twice at two live addresses. A menu item that points at one tag now claims that tag, so there is one entry. A menu item that shows several tags together does not claim any of them. - Tag pages no longer need a published article to be collected. A tag landing page with a description and a menu item is a page either way. - The Health check "Tag pages vs robots.txt" now also notices a `Disallow: /component/tags/` rule. - Sites with "Include Tag Pages" off see no visible change. Tags without a menu item now use a `/component/tags/tag/...` address. If your `robots.txt` blocks those, hold them out with "Exclude URL Patterns". ### 2.26.1 - 2026-08-20 - FlowMap now declares its update stream, so new versions appear in Joomla's Update screen. The code is the same as 2.26.0. The stream is seen only once a version that carries it is installed, so the step from 2.26.0 to 2.26.1 is a manual install. - Internal improvements: release checks no longer treat the task plugin as part of the locked-together versions. ### 2.26.0 - 2026-08-18 - Internal improvements to build and cache housekeeping. ### 2.25.0 - 2026-08-17 - Internal improvements: the page-cache clearing code moved into a shared service so more parts of FlowMap can use it. No visible change. ### 2.24.0 - 2026-08-16 - New plugin, System - FlowMap Cache Purge. When you save an article, it clears the JCH Optimize page cache for that one article, so the edit reaches logged-out visitors at once. A global cache clear is no longer needed. ### 2.23.0 - 2026-08-14 - Fixed: a menu item whose component paginates could adopt one of its own page-N addresses as its main address, such as `/sitemap/page-15-50.html`. That put noindex pages in the XML sitemap and left the real page out. FlowMap now resolves the real address first and ignores paginated variants. - New flat page, `/sitemap-all.html`: every indexable URL in one plain link list, with no pagination or filters. It is for machines such as recache crawlers and link-audit jobs, not for search engines. It is served noindex and is deliberately left out of the XML sitemap index. It is written as a file on each build, so a page cache cannot serve it stale. - New option "Write flat crawl target", on by default. Turning it off removes the file on the next build. ### 2.22.2 - 2026-07-30 - Fixed: the Files screen's Paste Content card changed line endings. Browsers rewrite line breaks in form text fields, so every multi-line paste was saved with different line endings than you sent. Pasted content now travels as a file part and arrives byte for byte. - The old form transport is refused outright, and nothing is written on a refusal. - Internal improvements: a new test suite for these uploads. ### 2.22.1 - 2026-07-29 - Fixed: uninstalling the package now removes all FlowMap database tables. Four were left behind before. ### 2.22.0 - 2026-07-25 - Internal improvements: housekeeping in the migration code. This is the first release recorded in this changelog, and earlier history is not listed here. Details Written by: James Hills Last Updated: 30 October 2026 Hits: 5 ### Latest News Updates: ### Download Our "Content Marketing For Travel Advisors" Ebook! #### Stop Reading Spec Sheets. Start Thinking About Infrastructure Independence [Stop Reading Spec Sheets. Start Thinking About Infrastructure Independence](https://flowmediamarketing.com/blog/stop-reading-spec-sheets-start-thinking-about-infrastructure-independence.html) #### Who Programs Your Agent's Taste? Why Brand Marketing Matters More in an Agentic Future [Who Programs Your Agent's Taste? Why Brand Marketing Matters More in an Agentic Future](https://flowmediamarketing.com/blog/who-programs-your-agents-taste-why-brand-marketing-matters-more-in-an-agentic-future.html) #### The Cruise Industry's Mega-Ship Bet Makes Perfect Sense - If You Understand Gen Z [The Cruise Industry's Mega-Ship Bet Makes Perfect Sense - If You Understand Gen Z](https://flowmediamarketing.com/blog/cruise-industry-mega-ship-bet-makes-perfect-sense-if-you-understand-gen-z.html) #### How I Turned My UGREEN NAS Into a Dev Server for Vibe Coding (And Stopped Breaking Production) [How I Turned My UGREEN NAS Into a Dev Server for Vibe Coding (And Stopped Breaking Production)](https://flowmediamarketing.com/blog/how-i-turned-my-ugreen-nas-into-a-dev-server-for-vibe-coding-and-stopped-breaking-production.html) - - Flow Media Marketing is based in Southwest Michigan. Learn More About Our People and Brands: - [James Hills](https://flowmediamarketing.com/james-hills.html) - [Heather Hills](https://flowmediamarketing.com/heather-hills.html) - [Flow Media Marketing](https://flowmediamarketing.com/flow-media-marketing.html) - [Flow Voyages](https://flowmediamarketing.com/flow-voyages.html) - [Cruise West Coast](https://flowmediamarketing.com/cruise-west-coast.html) - [Couple Places](https://flowmediamarketing.com/couple-places.html) - [MenWhoBlog](https://flowmediamarketing.com/menwhoblog.html) - [ManTripping](https://flowmediamarketing.com/mantripping.html) - [The Grape Stomp](https://flowmediamarketing.com/the-grape-stomp.html) --- *Source: [FlowMap Changelog](https://flowmediamarketing.com/flowmap-changelog.html)*