A wide session. Frontend pricing plans as a separate module from SaaS billing plans — service pages can have their own pricing display. Contact form with rate limiting (5 per 5 minutes per IP) and flash validation display. Service featured image upload with server-side MIME validation, preview with AJAX remove, old file cleanup on replace or delete.
The public-facing header template was completely rewritten: dynamic title, Open Graph (type, title, description, image, URL, site name, article timestamps), Twitter Card, JSON-LD (WebSite on homepage, Article on posts, Organization elsewhere), canonical URL, robots meta, Google Analytics and GTM (only when IDs are configured). Also a full SEO settings card in Admin → General: separator, default OG image, canonical base, robots default, Twitter handle, analytics IDs, Search Console verification.
Security headers filter built from scratch — the CI4 built-in alias did not exist in this build. X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, HSTS. Session timeout reduced from 2 hours to 30 minutes. Exception messages no longer leak to user-facing flash messages.