Photo filters, layered watermarks and share cards

This release is about making your images look good wherever they show up: on your pages, under your watermark, and in the link preview when someone shares your site. It also includes security fixes, so please update soon.

Update soon

3.6.10 includes security fixes in OAuth and the HTML sanitizer. We recommend updating as soon as you can.

One change to know about: links in Text and Styled Text fields must now be web, email or phone links, or a link to a page on your own site. Any other kind of link is saved as #sanitized. If you use something like WhatsApp links, add them to htmlclean.allowed_url_schemes in tcms.php.

Photo filters for every image

ImageWorks has 21 built-in filters: warm and faded looks, crisp black and white, and duotones that tint a photo in two colors. You can stack up to three, such as a look with a little grain, and set how strong they are. The ImageWorks tool in the admin shows a thumbnail of each filter on your own image, so you can see the result before you pick.

Filters are free in every edition. They run before your watermark, so your logo keeps its colors.

Developers can write their own filters in tcms.php, and extensions can ship them. Each extension's filters get a row of their own in the ImageWorks tool.

Watermarks that do more

Tiled logos repeat your logo across the whole image, so there's no clean corner to crop out. They work on every edition, from a schema's watermark settings or the ImageWorks tool.

On Pro, one image can now carry several marks at once:

• A big headline over a small caption, or two logos side by side.
• A photo from another record, such as the author's portrait on a blog post's image, cut into a circle if you like.
• A color fill or a dark fade behind your text, so it stays readable on any photo.
• Long titles that wrap onto a second or third line instead of shrinking.

Your schema's watermark is now always drawn on top, so an image link can't hide it.

Share images that carry the page title (Pro)

When someone shares a link to your site, the preview usually shows a plain photo. Now you can design one overlay in Site SEO → Social Image Overlay, and every page's share image becomes a card: its own photo, its title, your logo and a dark fade behind the text.

The Design… button opens a designer with presets to start from, a Layers editor where you drag layers into order and add text, fills, photos and logos, and a live preview drawn on a record you pick. A collection can have its own overlay, and a single record can opt out and share its image as it is.

Before you launch, open Utilities → Reporting → Share Cards to see every page's link preview the way a social network will show it. Any card that couldn't be made says why.

Share images are made for Site Builder pages and collection pages. Stacks pages keep their plain share image.

Sitemaps that show your images and videos

A collection's sitemap can now list each object's images and videos. That helps search engines find the gallery photos a lightbox loads, the items behind a Load More button, and your videos with their thumbnails and titles. Pick the image, gallery and video fields in the collection's Sitemap settings.

Smaller improvements

• Your own HTML on the Protect page. Add a logo or welcome line above the passcode form, and a copyright line or links at the bottom of the page. Find both in Extensions → Protect.
• Password reset sends people back where they started. Someone who clicks Forgot Password from a members login page lands back on that page after resetting.
• The Sync Manager sends Site SEO too. Changes you made to it locally used to never reach your live site.
• A new sepia. It's now a warm brown that looks the same on every server.
• The Styled Text editor is updated to the latest version.

Also fixed

• Downloading a protected file named like photo.jpg no longer sends a signed-in user to the login page over and over.
• Stacks Preview no longer shows a blank page when it can't write to your Mac's temporary folder.
• A YouTube or Vimeo video in Styled Text stays where you put it, instead of moving to the end when you save.
• A file a depot turns away, for the wrong type or size, no longer sticks in the field and blocks saving.
• Cropping an image to a size bigger than the photo keeps the shape you asked for.
• Forms on a page in another language show all their text in that language.
• Connecting Claude and other AI assistants no longer fails with "Authorization code has been revoked" on many shared hosts.
• Automations sync to your live site again, and Data Views no longer always show as changed in the Sync Manager.
• The JSON field can be resized in Safari.

Before you update

• Links in text fields follow the new rule above.
• Some images are made again once. Images that use sepia or a text watermark are redrawn the first time they're viewed after the update, so those pages may load a little slower once.
• AI assistants reconnect once. Connected MCP clients are asked to reconnect after the update and do it on their own.

---

Upgrading: update as usual from Admin → Updates or composer update.

The full changelog is on GitHub: https://github.com/totalcms/cms/releases/tag/3.6.10