Site-wide audit sweep — readable blog, security hardening, faster status pages, lighter homepage
A top-to-bottom audit of the marketing site, client portal, and admin dashboard surfaced around 40 issues across visuals, performance, and security. This release fixes the substantive ones.
- The blog reads like a document again. The entire article + case-study body was rendering unstyled — headings at body size, no paragraph spacing, bullets stripped — because the Tailwind typography plugin every long-form page depends on was never installed. Installed it and wired a per-theme prose treatment, so every
/articles/*and case-study narrative (the whole SEO content push) now has real hierarchy and rhythm. - Search no longer fed two 404s and three dead redirects. The sitemap was submitting
/industries/professional-servicesand/industries/saas(empty directories), and three/services/development/*redirects pointed at a/solutions/full-stack-developmentpage that doesn't exist. Removed the phantom sitemap entries, repointed the redirects to a real page, 301'd the duplicate/insights/:slugblog route onto the canonical/articles/:slug(and deleted the broken pre-redesign version), and added/changelogto the sitemap. - Tighter access controls across the dashboards. Every staff dashboard API now enforces per-client, org-scoped permissions, so team members only reach the clients they're assigned to while super-admins retain full visibility.
- Hardened public endpoints. Added rate limiting and input-size caps on the AI chat and booking endpoints, brute-force protection on the sign-in and preview-unlock flows, and stricter file-upload validation.
- Status pages stopped getting slower every week. They were pulling up to ~26,000 raw uptime-check rows per site on every single view and bucketing them in JavaScript. Replaced that with two SQL aggregate queries, cached per-site at the 5-minute cron cadence, and added a retention job so the checks table self-prunes to 90 days.
- Security headers + a lighter homepage. Added a baseline of security headers site-wide (HSTS, nosniff, clickjacking + referrer protections). Cut the homepage's screenshot payload from ~4.5 MB of PNG to ~2 MB by converting the full-page captures to WebP. Removed the unused three.js dependency tree (~1 MB) and six dead 3D components that rendered nothing, plus nine unreferenced leftover files from the reverted 'Solagon OS' dashboard rebuild — the production build is green again.
- Polish across the board. Fixed the keyboard focus ring being invisible in dark mode; gave the whole site a branded social-share image (every page had a blank card before); added a branded error page; fixed literal
’/\u2014text bugs and a missing CSS variable that left surfaces transparent on ~9 pages; brought the comparison page onto the brand system; made the portal sign-up link visible; added the missing/admin/clients,/admin/portal, and/book/cancelpages that were dead-ending on the public 404; and pointed every 'Book a call' button at the actual scheduler instead of the contact form.
Solagon Team
solagon.com