The enforced CSP blocked the Cloudflare beacon, so Web Analytics wasn't
collecting anything on the live site. Add https://static.cloudflareinsights.com
to script-src (loads beacon.min.js) and https://cloudflareinsights.com to
connect-src (RUM data POST). Also documented that re-enabling the Preferred
Sources pill will need https://news.google.com in the CSP.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Now that msosorg.com serves the docroot, 301 every non-canonical host
(the temp domain msos.spletnimojster.si, any www., the origin host) to
https://msosorg.com to consolidate ranking signals. Runs before the
HTTPS-force so the temp domain reaches the canonical in a single hop; the
condition excludes msosorg.com itself so there is no redirect loop.
Mark the redirect steps done in the launch checklist.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Switch CSP from Report-Only to enforcing, with an allowlist verified in a
browser against a server sending this exact header (0 violations across the
homepage, a YouTube project page, the assistant, MailerLite JSONP, GA/gtag,
and the Google Forms endpoint).
Adds the sources the old report-only policy was missing (and would have
broken if enforced blindly): Google Fonts (style/font), Font Awesome cdnjs
(style/font), MailerLite newsletter (script/connect), the Google Forms
endpoint in connect-src, plus object-src 'none'. Keeps 'unsafe-inline' for
the in-<head> consent bootstrap; the host allowlists + form-action/base-uri
are the real hardening on top of existing output escaping.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Redirect all plain-http requests to https (double condition guards against
a redirect loop behind a TLS-terminating proxy).
- Add Strict-Transport-Security (6-month max-age, no preload/includeSubDomains
so it stays easy to adjust) so browsers refuse http after the first visit.
Closes the "HTTPS everywhere" gap: previously http:// served in the clear.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The earlier "canonical domain" redirect forced msos.spletnimojster.si (where
the site is actually served) to msosorg.com, which does NOT yet host these
files — so every page 404'd. Replace it with a host-relative root -> /en/
redirect so the live domain serves the site again. A canonical-host redirect
can be re-added once msosorg.com is pointed at this same docroot.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Proactive security & health pass. No live/exploitable vulnerabilities were
found; these changes remove information-disclosure surfaces and add
standard hardening.
- Remove publicly-downloadable 1.1 MB full source dump (code_export.txt)
and stray empty l.php; add code_export.txt to .gitignore.
- Exclude dev files/folders (*.sh, *.py, docs/, templates/, tools/,
README.md) from the rsync deploy so they never reach the live server.
- .htaccess: add X-Frame-Options, Referrer-Policy, Permissions-Policy,
and a report-only Content-Security-Policy; add defense-in-depth deny
block for dev/VCS files (robots.txt & sitemap.xml left served).
- .htaccess: fix root redirect to canonical msosorg.com + /en/.
- Swap 4 project-page YouTube embeds to youtube-nocookie.com so no
Google cookies are set before consent (GDPR).
- Add rel="noopener" to 30 team social links on the About Us pages.
- Harden esc() in my-route.js to also escape single quotes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Appends static-site production defaults below the existing root->/en/
redirect: ErrorDocument 404 /404.html, gzip compression, browser caching
(short for CSS/JS since unhashed, longer for images/fonts), correct WebP/
SVG/manifest MIME types, -Indexes, and X-Content-Type-Options. All guarded
by <IfModule> so a missing module cannot 500; ignored by nginx.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
popovskik
Mark Poljanšek