Skip to content

Kaleta 2.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Oct 19:13
· 695 commits to main since this release
v2.6.0
cb8e401

Kaleta 2.6 brings sites over from any platform and lets anyone try the admin. It also measures campaigns properly through Google Tag Manager and adds an optional CAPTCHA. It includes security fixes from an audit. Kaleta is now installed one way only, like WordPress.

Import from any website

Administration → Import and export → Import from a website. Enter the address of a site on any platform, for example Wix, Webnode, Jimdo, Squarespace, Joomla, Drupal, or WordPress without an export.

What Kaleta does with it:

  • Finds the pages in the site's sitemap, or follows its links when there is none (at most 300 pages).
  • Shows what it found before anything is imported.
  • Turns each page into a hidden builder page. The images go to Media, including images on the platform's CDN.
  • Imports blog posts as news, when the address looks like a post (/blog/…) or the page has a publication date.
  • Redirects the old addresses to the new pages.
  • Leaves out the old site's header, footer, menus, cookie bars and forms. The pages take your site's look.

Running it again skips what is already there.

Claude does the same with the new import_website tool, one batch per call. It shows you what it found and imports only on your instruction.

A public demo

A site can run as a public demo ('demo' in config.php). What the demo mode does:

  • Sign-in: the sign-in screen shows the shared account.
  • Search engines: public pages are not indexed.
  • Hourly reset: php system/demo.php reset from cron restores the saved state every hour.
  • Safety: the demo refuses anything that could be abused or lock out other visitors:
    • e-mail, requests to other servers and the Claude connection;
    • accounts and passwords, imports, backups and updates;
    • code fields and secret keys.

docs/DEMO.md describes the setup.

Google Tag Manager

Settings → Analytics → Google Tag Manager: enter the container ID (GTM-…).

  • Consent: consent mode is built in. With the built-in cookie bar, the container starts only after the visitor allows analytics or marketing.
  • Conversion events: Kaleta sends these to the data layer:
    • generate_lead – a form was sent;
    • sign_up – a newsletter sign-up;
    • popup_conversion;
    • click_phone, click_email and file_download.
  • Container template: the tab offers a template to import into Tag Manager. It has triggers for these events, GA4 event tags and a Google Ads lead conversion tag.

An optional CAPTCHA

Settings → Privacy and cookies → Spam check for forms: choose hCaptcha, Google reCAPTCHA v3 or Cloudflare Turnstile.

  • An extra layer: it adds to the built-in protection, it does not replace it.
  • Light on visitors: the provider's script loads only on pages with a form.
  • Checked on the server: the visitor's answer is verified with the provider. You choose whether forms are accepted while the provider is down.
  • The secret key stays in the admin; Claude cannot read or set it.
  • Per form: a single form can opt out.
  • Privacy policy: the template names the provider.

Installed like WordPress

Upload the files, create a database and open install.php. That is now the only way to install Kaleta.

What was removed:

  • the Docker image and compose.yaml;
  • the Coolify template;
  • installation from the command line;
  • reading the database from environment variables.

Sites already installed, including those in containers, keep updating from Settings → Backups and updates.

Security

These fixes come from an audit on 1 October 2026:

  • Custom HTML is filtered by a DOM-based sanitizer. The previous pattern-based filter could be bypassed, for example with event handlers after a slash, encoded javascript: addresses, srcdoc, SVG animation or meta refresh.
  • Claude connection limited to drafts: it can no longer insert Custom HTML, or page and news HTML that is not cleaned, even for an administrator.
  • Code that runs on the site is set only in the administration, not over the Claude connection: head code, marketing code and the external cookie service code.
  • Scheduled newsletters: only someone who may send newsletters can change one.
  • MCP tokens: wrong tokens sent from a shared address no longer lock out valid ones.

Updating

Update from Settings → Backups and updates. It works from every earlier release.

Assets 4
Loading