Insites Console calls are checked with a per-instance token. Insites Console now reaches an instance's sign-in key, configuration reset and administrator invite through new routes that accept only a short-lived, single-use token signed for that instance. A refused call gets a clear error instead of a redirect. The earlier routes keep working until every instance is updated.
The reCAPTCHA secret key stays on the server. Integrations › reCAPTCHA no longer sends the secret key to the browser, and the instance keeps only its last four characters. Leave the field blank to keep the saved key, or enter a new one to replace it.
Only Insites Console is trusted as the sign-in host. An instance accepts its Console address only from the Insites Console hosts.
Bug fixes
Sitemaps list pages saved by older versions. Pages, list layouts and details layouts whose sitemap setting was saved as text appear in sitemap.xml again, and Reset Sitemap writes the corrected template.
Contact import explains header problems. A CSV whose headers don't match the template is refused before anything is imported, and the message names the unknown and missing headers. A bad row no longer stops the import.
System Logs reads "Canceled". The status uses US spelling and keeps its grey pill.
The Email Logs chart is readable in dark mode. The In progress series uses a themed colour.
API documentation shows id as type ID for contacts and companies, including where other modules nest them.
Copy fixes. The failed company delete message, the "Copied to clipboard." toast, the contact delete dialog ("Delete {name}?"), the Relationships bulk menu, the Tasks empty state, and the Activities empty state and breadcrumb.