# Sites Production Hardening

## Security boundaries

Public Website traffic resolves a Website from its registered normalized hostname. Sites management routes are host-scoped and require Sites access; Global settings require a Sites Super Admin. Public quotation attribution is derived from a signed four-hour server context token and trusted operator resolution, never browser Website/operator identifiers.

Website Header Code is a deliberate Super Admin-only executable setting. It is injected only by the public marketing renderer, never by legal pages or management portals. It is retained as text in admin controls and audit records store only configured/not-configured state. A strict nonce-based CSP cannot be safely imposed while arbitrary trusted provider code is supported; management portals receive frame/type/referrer/permissions protections and production should introduce a reviewed nonce-based tag policy before enabling a restrictive public CSP.

## Upload policy

Public assets use randomized public-storage paths. Logo, favicon, OG image, campaign and social proof uploads allow JPG, PNG and WebP only; SVG is intentionally not accepted. Fonts accept WOFF/WOFF2 only. Controllers enforce image/file MIME, extension and size validation; replacement deletes only the previously stored path owned by the same Website/module.

## Domain Health SSRF policy

Only a registered normalized primary domain is checked. DNS answers are validated against private, loopback, link-local, carrier-grade NAT, benchmark, multicast, reserved and IPv6 ULA/link-local/loopback/documentation ranges. The HTTPS probe connects to an already validated DNS answer rather than resolving the hostname again, while preserving TLS hostname/SNI verification. It uses HEAD, a five-second timeout and no redirects. Production should still monitor egress firewall policy and resolver timeout behaviour.

## Production requirements

- `APP_ENV=production`, `APP_DEBUG=false`, HTTPS termination and a correct `APP_URL`.
- Set `TRUSTED_PROXIES` only to explicit load-balancer IPs; wildcard proxies are rejected.
- Keep `SESSION_DOMAIN` host-only unless an intentional shared-domain policy is reviewed. Custom public Website domains must not receive management session cookies.
- Run queue workers required by existing Core workflows; Sites rendering, SEO, robots and sitemap do not require a queue.
- Back up the database and public storage (logos, favicons, OG images, fonts, popup/social assets) before migration deploys. Take a rollback snapshot; deprecated legacy tables remain part of backups.
- Apply migrations before serving new code, run route/config cache in the production release process, and verify real TLS, HSTS/CDN asset caching and restore procedures in production.

## Cache and performance

The public renderer does not add an application page cache, preventing Website/operator/header/SEO cache leakage. It loads only Website content and enabled sections for the trusted context. Social Proof limits public feed retrieval and excludes hidden records. Campaign popup selection is acceptable at current small global scale; revisit random selection if the table grows substantially.