.htaccess

@@ -1,14 +1,6 @@
 
 RewriteEngine on
 
-# ----- Canonical host -----
-# msosorg.com now serves this docroot, so consolidate ranking signals: 301
-# every other host — the old temp domain msos.spletnimojster.si, any "www.",
-# and the origin host — to the canonical bare apex over HTTPS. Runs before the
-# HTTPS-force below so the temp domain reaches the canonical in a single hop.
-RewriteCond %{HTTP_HOST} !^msosorg\.com$ [NC]
-RewriteRule ^ https://msosorg.com%{REQUEST_URI} [R=301,L]
-
 # ----- Force HTTPS everywhere -----
 # Redirect any plain-http request to https. The two conditions together avoid
 # a redirect loop when TLS is terminated by an upstream proxy (which forwards
@@ -18,8 +10,12 @@ RewriteCond %{HTTP:X-Forwarded-Proto} !=https
 RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
 
 # ----- Language root redirect -----
-# Send the bare root to the default-language homepage. After the canonical-host
-# rule above, this only runs on https://msosorg.com, so it stays relative.
+# Send the bare root to the default-language homepage, on WHATEVER host is
+# serving the site (relative — no cross-domain redirect). Do NOT force
+# msosorg.com here: the site is currently served from msos.spletnimojster.si,
+# and msosorg.com does not yet serve these files, so forcing it 404s.
+# Once msosorg.com is pointed at this same docroot, a canonical-host redirect
+# can be added back safely.
 RewriteRule ^/?$ /en/ [R=301,L]
 
 # ----- Defense-in-depth: block dev/sensitive files if they ever ship -----

docs/launch-seo-checklist.md

@@ -22,21 +22,18 @@ this is the "flip the switch" list.
 - [ ] Confirm a valid **HTTPS certificate** (Let's Encrypt / host-provided).
 - [ ] Confirm the site loads at `https://msosorg.com/en/` (and `/mk/`, `/si/`).
 
-## 2. Redirects (`.htaccess`)  ✅ done
+## 2. Redirects (`.htaccess`)
 
-- [x] Root redirect (`/` → `/en/`) is host-agnostic, so it needs no domain edit.
-- [x] **Canonical-host 301 added.** A single rule 301s every non-canonical host
-      — the temp domain `msos.spletnimojster.si`, any `www.`, and the origin
-      host — to `https://msosorg.com`, consolidating ranking signals. It runs
-      before the HTTPS-force so the temp domain reaches the canonical in one hop:
+- [ ] Update the root redirect in `.htaccess` (lines 2–5): change
+      `msos.spletnimojster.si` → `msosorg.com` so `/` → `/en/` on the real host.
+- [ ] Add a **301 from the temp domain to the final domain** so any links /
+      early indexing on `msos.spletnimojster.si` pass equity to `msosorg.com`:
       ```apache
-      RewriteCond %{HTTP_HOST} !^msosorg\.com$ [NC]
-      RewriteRule ^ https://msosorg.com%{REQUEST_URI} [R=301,L]
+      RewriteCond %{HTTP_HOST} ^(www\.)?msos\.spletnimojster\.si$ [NC]
+      RewriteRule ^(.*)$ https://msosorg.com/$1 [R=301,L]
       ```
-- [x] Host form chosen: **bare `msosorg.com`** (matches the hard-coded canonicals);
-      `www.` is folded into the rule above.
-- [ ] After this deploys, verify with `curl -I https://msos.spletnimojster.si/en/`
-      → `301` to `https://msosorg.com/en/`, and that `https://msosorg.com/en/` is `200`.
+- [ ] Pick ONE host form (www vs non-www) and 301 the other to it.
+- [ ] (Ask me to make these edits — they're quick.)
 
 ## 3. Verify the technical layer resolves on the real domain