# Future Proofing (No Generator)

This site is intentionally hand-edited PHP. Keep the *style* the same while
making maintenance easier and the surface more resilient.

## Principles

- Navigation and core content should work without JavaScript.
- External embeds should always have a plain-link fallback.
- URLs should be stable; if something must move, leave a redirect page.
- Translations follow a consistent naming rule (`_jp.php` / `_zh.php`).
- Secrets stay outside the document root.
- nginx owns security headers (CSP, HSTS, nosniff, Referrer-Policy, Permissions-Policy).

## What We Have

### 1) Sitemap and robots.txt

- `robots.txt` points to `sitemap.xml` and disallows admin/API/tools paths
- `python3 tools/generate_sitemap.py` rebuilds the public crawl map

### 2) Human-friendly site map

- `/map/` is a clickable index for humans (with JP/ZH variants)

### 3) Translation naming convention

- Default English: `page.php` or `section/index.php`
- Japanese: `page_jp.php` or `section/index_jp.php`
- Simplified Chinese: `page_zh.php` or `section/index_zh.php`
- Strings live in `locales/{en,ja,zh}.php` via `t('key')`

### 4) Redirect page pattern

If you rename or move a page, keep an old file that points to the new place.

Example:

```php
<?php
header('Location: /new-path/', true, 301);
exit;
```

Or a static HTML refresh for pure static drops.

### 5) Backups and audits

- `./tools/backup.sh` — tarball (set `BACKUP_DIR`)
- `./tools/run_audits.sh` — link/html/image checks + sitemap regen
- `./tools/uptime_check.sh` — curl probe
- Recommended cron is documented in the root `README.md`

### 6) Legacy retirement

- `/mstartpage/` permanently redirects to `/startpage/`

## Optional next steps

- Fill remaining locale gaps when shipping new UI strings
- Run `python3 tools/link_rot.py` occasionally for external URLs
- Prefer `password_hash` in `/var/lib/sillylaird/admin_auth.php` over legacy sha256