v16.1.0

New Features

• Added a new admin dashboard with traffic statistics, content counts, recent drafts, recent posts, and quick navigation
• Replaced TinyMCE with the new Moonglade.Editor for HTML post editing
• Added TOTP authenticator support for local administrator accounts, including QR-code setup and authenticator reset
• Added configurable comment rate limiting, honeypot protection, and submission timing checks
• Added word-filter keyword management to comment settings

Updates & Improvements

• Removed CAPTCHA from administrator sign-in and comment submission
• Improved image delivery with streaming, browser cache headers, conditional requests, and range requests
• Added default security headers and optional Content Security Policy configuration
• Fixed Microsoft Entra ID sign-in flow
• Improved the tag management toolbar and made dashboard statistic cards directly clickable
• Added permanent redirects from common default filenames such as index.html and default.aspx to the home page

Upgrade Information

• Automatic database upgrade: A new PostViewDaily table will be created for dashboard traffic statistics. If automatic migration is disabled, apply the included SQL Server or PostgreSQL migration script manually.
• Local account authentication: The first local-account sign-in after upgrading requires setting up an authenticator app. Subsequent sign-ins require a 6-digit TOTP code.
• Comment protection: The previous CaptchaSettings configuration is no longer used. Review the new CommentRateLimit and CommentSubmissionGuard settings after upgrading.
• Comment moderation: Remote content moderation has been removed. Moderation now uses the built-in local word filter, with keywords managed under /admin/settings/comment. Existing custom keywords from ContentModerator:LocalKeywords must be entered again.
• HTML editor compatibility: Existing posts remain unchanged until edited, but legacy TinyMCE HTML containing unsupported tags or styles may be normalized when saved with Moonglade.Editor.
• Dashboard statistics: Daily traffic history is collected from the upgrade onward; historical daily views are not backfilled.