npm - @maccesar/aiskills - Versions diffs - 1.17.0 → 1.18.0 - Mend

@maccesar/aiskills 1.17.0 → 1.18.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (46) hide show

package/skills/seo-launch/assets/social-meta.blade.php ADDED Viewed

@@ -0,0 +1,90 @@
+{{--
+  Every tag a page needs to be indexed and to render a card when its link is shared.
+  Put it in the layout's <head>, after the charset and viewport:
+      <x-social-meta
+          title="Freight and warehousing in Reynosa | Acme"
+          description="…"
+          :image="$nota?->imagen_url"
+          type="article" />
+  Per-page values arrive as props; the site-wide ones come from config. The
+  fallbacks are what make it safe to drop into a layout: a page that passes
+  nothing still emits a complete, valid block.
+  Add to config/app.php (or a dedicated config file):
+      'site_name'  => env('APP_NAME'),
+      'og_image'   => env('APP_URL') . '/images/og-image.jpg',
+      'og_locale'  => 'es_MX',
+      'theme_color' => '#0f2d52',
+--}}
+@props([
+    'title' => null,
+    'description' => null,
+    'url' => null,
+    'image' => null,
+    'imageAlt' => null,
+    'type' => 'website',
+    'locale' => null,
+    'robots' => 'index, follow',
+    'publishedAt' => null,
+    'modifiedAt' => null,
+])
+@php
+    $siteName = config('app.site_name', config('app.name'));
+    // url()->current() drops the query string, which is what a canonical wants:
+    // ?page=2&utm_source=… would otherwise mint a distinct URL per visit.
+    $canonical = $url ?? url()->current();
+    $metaTitle = $title ?? $siteName;
+    $metaDescription = $description ?? config('app.description', '');
+    // Absolute URL on purpose: Facebook, WhatsApp and X discard a relative
+    // image path — no error, no thumbnail.
+    $metaImage = $image ? (str_starts_with($image, 'http') ? $image : url($image)) : config('app.og_image');
+    $metaImageAlt = $imageAlt ?? $metaTitle;
+@endphp
+<title>{{ $metaTitle }}</title>
+<meta name="description" content="{{ $metaDescription }}">
+<link rel="canonical" href="{{ $canonical }}">
+<meta name="robots" content="{{ $robots }}">
+<meta name="theme-color" content="{{ config('app.theme_color', '#0f2d52') }}">
+{{-- An SVG favicon has no intrinsic size and draws sharp at every size iOS,
+     Safari and Chrome ask for. iOS still needs the PNG for the home screen. --}}
+<link rel="icon" type="image/svg+xml" href="{{ asset('images/logo-symbol.svg') }}">
+<link rel="apple-touch-icon" sizes="180x180" href="{{ asset('images/apple-touch-icon.png') }}">
+<meta name="apple-mobile-web-app-title" content="{{ $siteName }}">
+{{-- Open Graph: Facebook, WhatsApp, LinkedIn --}}
+<meta property="og:type" content="{{ $type }}">
+<meta property="og:locale" content="{{ $locale ?? config('app.og_locale', 'es_MX') }}">
+<meta property="og:site_name" content="{{ $siteName }}">
+<meta property="og:url" content="{{ $canonical }}">
+<meta property="og:title" content="{{ $metaTitle }}">
+<meta property="og:description" content="{{ $metaDescription }}">
+<meta property="og:image" content="{{ $metaImage }}">
+<meta property="og:image:secure_url" content="{{ $metaImage }}">
+<meta property="og:image:type" content="image/jpeg">
+{{-- These must match the real file: they exist so the client can lay out the
+     card before downloading it. --}}
+<meta property="og:image:width" content="1200">
+<meta property="og:image:height" content="630">
+<meta property="og:image:alt" content="{{ $metaImageAlt }}">
+@if ($type === 'article' && $publishedAt)
+    <meta property="article:published_time" content="{{ $publishedAt->toIso8601String() }}">
+    @if ($modifiedAt)
+        <meta property="article:modified_time" content="{{ $modifiedAt->toIso8601String() }}">
+    @endif
+@endif
+{{-- X. summary_large_image is the one that shows the photo full width. --}}
+<meta name="twitter:card" content="summary_large_image">
+<meta name="twitter:title" content="{{ $metaTitle }}">
+<meta name="twitter:description" content="{{ $metaDescription }}">
+<meta name="twitter:image" content="{{ $metaImage }}">
+<meta name="twitter:image:alt" content="{{ $metaImageAlt }}">

package/skills/seo-launch/references/head-tags.md ADDED Viewed

@@ -0,0 +1,109 @@
+# The `<head>` tags
+Everything that goes in the head, what each tag does, and the mistakes that produce a tag that is present and useless.
+---
+## Basics
+```html
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Freight and warehousing in Reynosa | Acme Logistics</title>
+<meta name="description" content="Freight, storage and crossdock from any state to the northeast border. Quotes the same day.">
+```
+**`<title>` — the searched words go first, under ~60 characters.** Google truncates around 60 and cuts the tail, which is where the brand usually sits. One title per page: repeating the same one across the site makes every page compete for the same query. The pattern that survives truncation is `Specific thing | Brand`.
+**`description` — 120 to 160 characters.** It does not influence ranking; it is the text the user reads in the results and it is what decides the click. Under 70 characters wastes the space; past 165 it gets cut. Write it per page. When it is auto-generated from a template, check what it produces: a description built from the site name alone says nothing about the page.
+**`keywords` — Google stopped using it in 2009**, and Bing does not read it either. Not harmful; just do not let anyone believe it is doing work. If the client asks for it, add it and say what it is worth.
+## Canonical
+```html
+<link rel="canonical" href="https://example.com/">
+```
+Tells search engines which address is the official one when several serve the same content. **Absolute URL, always** — a relative canonical is either ignored or resolved against the wrong base.
+It is a hint. The 301 redirects in the server config (`references/server-files.md`) are the enforcement. Ship both: the canonical for the crawler that follows hints, the 301 for everything else.
+The canonical of a page points at itself, not at the home page. A site-wide canonical pointing at `/` tells Google that every page is a duplicate of the home page, and they drop out of the index.
+## Robots and theme-color
+```html
+<meta name="robots" content="index, follow">
+<meta name="theme-color" content="#0f2d52">
+```
+`index, follow` is the default behaviour anyway; declaring it is a statement of intent that makes a stray `noindex` obvious in a diff. **Check production for a leftover `noindex`** — it is the single most effective way to be invisible, and it usually arrives from a staging template.
+`theme-color` paints the browser bar on mobile with the site's colour. Small, and it shows.
+## Open Graph — WhatsApp, Facebook, LinkedIn
+This block is what produces the card with image, title and description when someone pastes the link.
+```html
+<meta property="og:type"             content="website">
+<meta property="og:locale"           content="es_MX">
+<meta property="og:site_name"        content="Acme Logistics">
+<meta property="og:url"              content="https://example.com/">
+<meta property="og:title"            content="Freight, warehousing and crossdock">
+<meta property="og:description"      content="…">
+<meta property="og:image"            content="https://example.com/images/og-image.jpg">
+<meta property="og:image:secure_url" content="https://example.com/images/og-image.jpg">
+<meta property="og:image:type"       content="image/jpeg">
+<meta property="og:image:width"      content="1200">
+<meta property="og:image:height"     content="630">
+<meta property="og:image:alt"        content="…">
+```
+- **`og:title` is not the `<title>`.** The browser title carries the brand at the end for the search engine; the card title goes without it, because `og:site_name` already prints it right below. Repeating it wastes the width.
+- **`og:type`**: `website` for the home page and static pages, `article` for a post or a news item. With `article` you can add `article:published_time` and `article:author`.
+- **`width` and `height` explicit.** Without them WhatsApp sometimes shows a small thumbnail on first load while it downloads the image to measure it. They must match the real file — see the hard rules.
+- **`og:image:secure_url`** is the HTTPS variant some older clients ask for. Same value; costs one line.
+- **`og:image:alt`** is the alt text of the thumbnail, for screen readers.
+- **`og:locale`** in the `xx_XX` form (`es_MX`, `en_US`), not the bare language code.
+## Twitter / X
+```html
+<meta name="twitter:card"        content="summary_large_image">
+<meta name="twitter:title"       content="…">
+<meta name="twitter:description" content="…">
+<meta name="twitter:image"       content="https://example.com/images/og-image.jpg">
+<meta name="twitter:image:alt"   content="…">
+```
+`summary_large_image` shows the photo full width. The other value, `summary`, leaves it as a small square next to the text. X falls back to the Open Graph tags when the Twitter ones are missing, so the minimum that changes anything is `twitter:card`; the rest is worth writing when the copy should differ, because X truncates earlier than Facebook.
+`twitter:site` is the site's `@handle`. Skip it rather than invent it.
+## Icons
+```html
+<link rel="icon" type="image/svg+xml" href="/images/logo-symbol.svg">
+<link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon.png">
+<meta name="apple-mobile-web-app-title" content="Acme">
+```
+Why an SVG, and why iOS still needs the PNG: `references/images.md`.
+`apple-mobile-web-app-title` is the name under the icon on the iOS home screen. Without it, iOS takes the full `<title>` and cuts it wherever it fits, which for a keyword-first title is unreadable.
+## Absolute URLs, on purpose
+Every URL in this block is written in full, with the scheme and the domain.
+**Facebook, WhatsApp and X discard images with a relative path.** If `og:image` were `images/og-image.jpg`, there would be no thumbnail — no error, no warning, just a grey rectangle. The same applies to `canonical` and `og:url`.
+The places the domain appears: `canonical`, `og:url`, `og:image`, `og:image:secure_url`, `twitter:image`, and `url` / `logo` / `image` inside the JSON-LD. That is a lot of repetition of one string, which is exactly why the head belongs in a parameterized include with the domain defined once (`assets/head.php`, `assets/social-meta.blade.php`).
+## Per-page values
+The tags that must change per page: `<title>`, `description`, `canonical`, `og:url`, `og:title`, `og:description`. The ones that can stay site-wide: `og:site_name`, `og:locale`, `og:image` (with a per-page override where it is worth it), the icons, `theme-color`.
+In Laravel, that split is `@props` with defaults on the component. In a static site, variables set before the include. Either way, a page that only needs a title and a description should be able to say just that.

package/skills/seo-launch/references/images.md ADDED Viewed

@@ -0,0 +1,86 @@
+# The images the platforms fetch
+Three files do all the work: the share card, the favicon, and the iOS home-screen icon. Each has a constraint that is not obvious and fails silently when you miss it.
+---
+## `og:image` — the share card
+**1200 × 630 px, JPEG.** That is the ratio every platform lays out for; anything else gets cropped by whoever is rendering it, and you do not get to choose where.
+**JPEG, not WebP.** Several preview clients still cannot decode WebP and simply show no image. The 30 KB WebP would save are not worth an invisible link. This is the one place in a modern site where JPEG is still the right answer — the page itself can serve WebP.
+**Under ~1.5 MB, ideally under 300 KB.** WhatsApp gives up on slow or heavy images and renders the card without a thumbnail.
+What goes on it: the logo, a short claim, and one photograph or a solid brand background. It is read at postage-stamp size in a chat list — a full paragraph of text is unreadable there. Do not put anything important in the outer ~60 px, since some clients crop to a squarer ratio.
+```bash
+# From a source photo: cover-crop to 1200x630, no upscaling beyond what it has
+magick source.jpg -resize 1200x630^ -gravity center -extent 1200x630 \
+  -quality 82 -strip og-image.jpg
+```
+`-resize 1200x630^` fills the box (the `^` means "at least"), `-extent` crops the overflow, and `-strip` removes EXIF, which on a phone photo can carry GPS coordinates you did not mean to publish.
+If it carries text over a photo, add `-sampling-factor 4:4:4` — the default chroma subsampling smears coloured text at small sizes.
+**Verify the file, do not trust the command.** `og:image:width` and `og:image:height` must equal what the file really measures; the audit script reads the dimensions from the file header for exactly this reason.
+```bash
+magick identify og-image.jpg      # → og-image.jpg JPEG 1200x630 …
+```
+## Favicon — one SVG
+```html
+<link rel="icon" type="image/svg+xml" href="/images/logo-symbol.svg">
+```
+**An SVG has no intrinsic size**, so it draws sharp at 16 px in the tab and at 512 px in a bookmark grid. A `.ico` or a PNG is fixed: the browser asks for it at half a dozen different sizes — tab, bookmarks bar, reading list, home screen — and scales whatever it finds, which is where blurry favicons come from. Safari has supported `rel="icon"` with SVG since version 15 (2021); Chrome and Firefox for longer.
+Two things about the SVG file itself:
+- **It must declare real dimensions, not `width="100%" height="100%"`.** A percentage-sized SVG has no intrinsic ratio, and a browser using it as an icon does not know what shape to give it. Set `width` and `height` to the `viewBox` values in pixels.
+- **Pure vectors.** An SVG with an embedded raster or a non-outlined font is a large file that renders inconsistently. Outline the text.
+Add a `favicon.ico` in the document root only if the site must support very old browsers; modern ones stop at the SVG. Do not spend time on a folder of eight PNG sizes — that convention predates SVG favicon support.
+## `apple-touch-icon` — 180 × 180 PNG
+iOS **ignores the SVG** when the site is added to the home screen. With no PNG it screenshots the page, which at that size is a grey smudge.
+```bash
+# From the same SVG, at a size that downsamples cleanly
+rsvg-convert -w 1480 logo-symbol.svg -o /tmp/symbol.png
+magick /tmp/symbol.png -resize 148x148 -background white -alpha remove \
+  -gravity center -extent 180x180 -strip apple-touch-icon.png
+```
+Three decisions inside that command:
+- **White background, no alpha.** iOS does not honour the alpha channel on these icons — it fills transparency with black, and a dark logo vanishes into it. `-alpha remove` flattens onto `-background`.
+- **The symbol occupies 148 of 180 (~82%).** iOS applies its own rounded mask; a logo that reaches the edge loses its corners to it.
+- **Square and unrounded.** iOS draws the corners. Rounding it yourself produces a double-rounded icon with white notches.
+180 × 180 is the Retina iPhone size; iOS downscales it for everything else. One file is enough — the `sizes` attribute is a hint, not a requirement to ship every size.
+If there is no vector source, render from the largest raster available and accept it; do not upscale a 64 px PNG to 180 and call it done.
+## After changing any of them
+Facebook and WhatsApp **cache the card for days**. Change the `og:image` and the link keeps showing the old one, which reads exactly like the fix not working. Force the refresh at <https://developers.facebook.com/tools/debug/> by pasting the URL and pressing *Scrape Again*.
+If the image filename stays the same and the server sends a long `Cache-Control`, browsers hold the old one too. The discipline that replaces a short cache is **renaming the file when its content changes**.
+## Page images, for completeness
+Not part of the share card, but the same audit usually finds them:
+| Use | Format | Why |
+| --- | --- | --- |
+| Photographs | WebP, quality ~80 | 15–24× smaller than the equivalent PNG |
+| Files meant to be shared or downloaded | JPEG `4:4:4` | they travel through WhatsApp; no chroma subsampling because they carry text |
+| Logos and icons | SVG | sharp at any size, and doubles as the favicon |
+| `og:image` | JPEG | several preview clients still cannot read WebP |
+Below-the-fold images take `loading="lazy"`. Every image takes a descriptive `alt` — it is what a screen reader announces and what Google reads.

package/skills/seo-launch/references/search-engines.md ADDED Viewed

@@ -0,0 +1,77 @@
+# Registering the site and getting it indexed
+The tags and files make the site indexable. This is the part that tells the engines it exists. It needs a browser, a Google account and access to the domain's DNS — **the user has to do it**; hand them the sequence rather than pretending you can.
+---
+## Google Search Console
+<https://search.google.com/search-console>
+### Choosing the property type
+Google offers two, and they are not equivalent:
+| Type | What it covers | How it is verified |
+| --- | --- | --- |
+| **Domain** | `example.com`, `www.`, http, https, and every subdomain | DNS only |
+| URL prefix | exactly the address you type, and nothing else | HTML file, `<meta>` tag, DNS, Analytics… |
+**Prefer Domain.** With URL prefix you would have to register each variant separately, which contradicts the whole point of having redirected them to one. Use URL prefix only when there is no access to the DNS zone.
+Verification is a `TXT` record Google gives you, pasted into the domain's DNS zone at the registrar. Search Console calls this "Domain name provider". Propagation is usually minutes.
+> **Never delete that TXT record.** If it disappears from the DNS, the verification is lost and the reports go with it. From *Settings → Ownership verification* you can add a second method as a backup.
+### Submitting the sitemap
+Left menu → **Sitemaps**, under *Indexing*. On a Domain property the field wants the full URL:
+```
+https://example.com/sitemap.xml
+```
+It should land in **Success** state with the page count discovered. For the first few minutes it may say "Couldn't fetch"; that usually resolves itself.
+This does not replace the `Sitemap:` line in `robots.txt` — they complement each other. Search Console tells Google directly; `robots.txt` serves every other crawler that comes by.
+### Requesting indexing
+Top bar → **URL Inspection** → paste the home page URL.
+It will say **"URL is not on Google"**, which is expected for a domain that just went live. Press **Request indexing**. That puts the page in the crawl queue instead of waiting for Google to arrive on its own. Do it for the home page and the two or three pages that matter most; the quota is limited and the sitemap covers the rest.
+### What to expect
+The *Performance* and *Indexing* panels will show **"Processing data, please check back tomorrow"**. That is normal — first data takes between **3 days and 2 weeks**. It is not a configuration error, and re-submitting does not speed it up.
+## Bing Webmaster Tools
+<https://www.bing.com/webmasters>
+Worth ten minutes: it also feeds DuckDuckGo and, increasingly, the AI assistants that use Bing's index. It offers **import from Google Search Console**, which carries over the property and the verification in a couple of clicks — do that instead of repeating the DNS dance.
+Then submit the same sitemap URL. Its **IndexNow** feature accepts an explicit ping when a page changes, which is useful for a site publishing several times a day.
+## Validators, once it is live
+| Tool | What it tells you |
+| --- | --- |
+| <https://validator.schema.org/> | the JSON-LD is well-formed and its properties exist |
+| <https://search.google.com/test/rich-results> | whether the page qualifies for a rich result (a different question — see `structured-data.md`) |
+| <https://developers.facebook.com/tools/debug/> | how the card renders, and the button that busts the cache |
+| <https://cards-dev.twitter.com/validator> | the X card, when it is reachable |
+| <https://pagespeed.web.dev/> | Core Web Vitals and performance |
+| <https://securityheaders.com/> | the headers from the `.htaccess` |
+## Facebook's cache
+Facebook and WhatsApp cache the card for days. After changing an `og:` tag or the image, paste the URL into the **Sharing Debugger** and press *Scrape Again*. Without it, the link keeps showing the old card and it reads exactly like the change never deployed.
+WhatsApp uses Facebook's crawler, so refreshing there fixes both. A trick that works when the cache will not budge: append a harmless query string (`?v=2`) to the URL you are testing to force a fresh scrape.
+## What none of this buys
+Registering a site does not rank it. What Search Console gives you is visibility into what Google sees — which pages it indexed, which queries reach you, which URLs it refused and why. Indexing itself is a matter of days to weeks for a new domain, and no button shortens it.
+If after two weeks the pages are still not indexed, the *Pages* report says why in plain language: `noindex` detected, crawl blocked by `robots.txt`, redirect, duplicate without a canonical, or "discovered but not indexed" — which usually means the content is too thin to be worth a slot.

package/skills/seo-launch/references/server-files.md ADDED Viewed

@@ -0,0 +1,168 @@
+# Server files: `robots.txt`, `sitemap.xml`, `.htaccess`
+The three files that live in the document root. Put them one level above it and the work silently does nothing — check where Apache actually serves from before writing.
+---
+## `robots.txt`
+```
+User-agent: *
+Allow: /
+Disallow: /send.php
+Sitemap: https://example.com/sitemap.xml
+```
+Its main job here is the **`Sitemap:` line**: it is the only standard place to point at the sitemap without submitting it by hand to each engine. The `Sitemap:` URL must be absolute.
+`Disallow` is for endpoints that are not pages — a form handler, an internal API, a debug route. Do not disallow `/admin` and think it is protected: `robots.txt` is public and reads as a directory of interesting URLs to anyone curious. It keeps polite crawlers out; it is not access control.
+**A missing `robots.txt` returns 404**, which crawlers accept as "everything is allowed" — so the site still gets indexed. What you lose is the sitemap pointer.
+**Never ship `Disallow: /`** to production. It is the staging default and it removes the whole site from the index.
+## `sitemap.xml`
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+  <url>
+    <loc>https://example.com/</loc>
+    <lastmod>2026-08-13</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>1.0</priority>
+  </url>
+  <url>
+    <loc>https://example.com/faq.html</loc>
+    <lastmod>2026-08-13</lastmod>
+    <priority>0.6</priority>
+  </url>
+</urlset>
+```
+- **URLs, not fragments.** The sections of a single page (`#services`, `#contact`) are anchors in the same document and do not go in. A sitemap indexes documents.
+- **Only canonical URLs.** Listing both `www.` and the apex, or both `http` and `https`, contradicts the redirects and the canonical tag.
+- **`lastmod` must be truthful.** It is the signal that tells a crawler to come back; a file that stamps today's date on every page every day gets its `lastmod` ignored entirely.
+- **`changefreq` and `priority` are advisory** and Google largely disregards them. They are harmless. `priority` is relative *within your site*, so making everything 1.0 says nothing.
+- Serve it as `application/xml`. If the server sends `text/plain`, add the MIME type (below).
+For a site with dozens of pages, write it by hand or generate it in the build. For a database-driven site (Laravel, WordPress), generate it from a route or a scheduled command — a hand-written sitemap of a news site is stale the day it ships.
+## `.htaccess`
+For a **static site** served directly by Apache. A Laravel project already has an `.htaccess` with the front-controller rewrite: add these blocks to it, do not replace it. Full commented template in `assets/htaccess-static`.
+### One canonical domain
+Before this, three URLs typically serve the same content with a 200: `http://example.com/`, `https://www.example.com/`, `https://example.com/`. For a search engine that is duplicate content, and the authority is split across the three.
+```apache
+RewriteEngine On
+RewriteCond %{HTTPS} !=on
+RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
+RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
+RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
+```
+**The double HTTPS condition is not redundant.** Behind a proxy or CDN — which is most shared hosting — `%{HTTPS}` can arrive off even though the request was secure. Testing only that variable produces an infinite redirect loop.
+Pick apex or `www` and be consistent with the canonical tag and the sitemap. Which one does not matter; disagreeing about it does.
+### Caching
+```apache
+<IfModule mod_headers.c>
+  <FilesMatch "\.(webp|jpe?g|png|svg|ico|woff2)$">
+    Header set Cache-Control "public, max-age=31536000, immutable"
+  </FilesMatch>
+  <FilesMatch "\.(html|css|js)$">
+    Header set Cache-Control "public, max-age=0, must-revalidate"
+  </FilesMatch>
+</IfModule>
+```
+**Images and fonts: a year, `immutable`** — the browser will not even ask whether they changed. The discipline that makes this safe is renaming a file when its content changes.
+**HTML and CSS: revalidate every time.** This is the counter-intuitive half, and it is the one that bites. A CSS file that is always called `app.css` cannot be cached long: recompile it, and every returning visitor keeps the old one until the cache expires — new utility classes silently missing, no console error, the page just looks broken for the people who visited before. A revalidation costs a 304 with an empty body; a month of stale CSS costs a bug you cannot reproduce on your own machine.
+That trade only flips when the build fingerprints filenames (`app.4f3a1c.css`) and rewrites the references, which is what Vite and friends do — then the CSS is immutable like the images.
+### Compression
+```apache
+<IfModule mod_deflate.c>
+  AddOutputFilterByType DEFLATE text/html text/css text/plain text/xml \
+    application/javascript application/json image/svg+xml
+</IfModule>
+```
+`image/svg+xml` is the one usually missing from a default config. An SVG is text and compresses enormously — a 17 KB logo drops to 6 KB.
+### Security headers
+```apache
+<IfModule mod_headers.c>
+  Header always set X-Content-Type-Options "nosniff"
+  Header always set Referrer-Policy "strict-origin-when-cross-origin"
+  Header always set X-Frame-Options "SAMEORIGIN"
+  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
+</IfModule>
+```
+| Header | What it prevents |
+| --- | --- |
+| `nosniff` | the browser guessing a file's type and executing something that is not a script |
+| `Referrer-Policy` | leaking the full originating URL when the user follows a link out |
+| `X-Frame-Options` | the site being framed for clickjacking |
+| `Permissions-Policy` | the page requesting camera, microphone or location |
+**`Content-Security-Policy` is deliberately not in the default set.** A miscalibrated CSP strips the site of its styles, and any page with an inline `<script>` or a third-party font needs it tuned per site. Add it once those are self-hosted and you can test it; shipping a broken one is worse than shipping none.
+### Hidden files and working files
+```apache
+RedirectMatch 404 /\.(?!well-known/)
+<FilesMatch "\.(md|json|lock|yml|yaml|sh|sql|bak|log)$">
+  Require all denied
+</FilesMatch>
+```
+Any path starting with a dot returns 404. This matters more than it sounds: an SFTP watcher that uploads the project directory can put `.vscode/sftp.json` — with the hosting password in plain text — inside the document root, where it is one guessed URL away from anyone.
+**The `(?!well-known/)` exception is not optional.** AutoSSL renews the certificate by placing a file in `/.well-known/acme-challenge/`. Without the exception the validation fails silently and you find out when the certificate expires. Test it by serving a real file from that path before calling the rule done.
+The real fix for that class of problem is upstream — the document root should be a subdirectory (`public/`) with the repository and its config living above it, and the deploy tool's ignore list should exclude `.vscode`, `.git` and `node_modules`. The `.htaccess` rule is the second barrier, not the first.
+### MIME types
+```apache
+AddType image/svg+xml .svg
+AddType image/webp    .webp
+AddType application/xml .xml
+```
+An SVG served as `text/plain` renders **blank**. If the logo and the favicon are SVG, this line is the difference between a site with a logo and a site without one.
+## Verifying, from the terminal
+```bash
+# Redirects: expect 301 and the canonical target
+curl -so /dev/null -w '%{http_code} → %{redirect_url}\n' http://example.com/
+curl -so /dev/null -w '%{http_code} → %{redirect_url}\n' https://www.example.com/
+# Headers on an image (cache) and on the HTML (security, revalidation)
+curl -sI https://example.com/images/hero.webp
+curl -sI https://example.com/
+# Something that must not be reachable
+curl -sI https://example.com/CLAUDE.md | head -1
+# Real transferred weight, compressed
+curl -s --compressed -o /dev/null -w '%{size_download}\n' https://example.com/
+```