# Changelog

## 2026-07-21 Mobile Responsive Hardening Completion

- Tightened the public mobile header with compact top-bar spacing, wrapping-safe brand/title sizing, an explicit two-column brand/hamburger layout, and a full-width mobile nav drawer.
- Added local fallback rules for the critical public navigation layout so the header remains usable even if CDN CSS is slow to load.
- Reduced mobile hero heading scale and vertical padding while preserving desktop presentation.
- Added mobile-safe content gutters, Bootstrap row overflow guards, responsive card padding/radius, readable body copy, and stacked mobile buttons/tabs.
- Improved form controls with 44px minimum tap targets, full-width mobile inputs/buttons, visible focus styles, and safer textarea sizing.
- Added blog-detail/article safeguards for responsive images, wrapping breadcrumbs/headings, related sidebar stacking, and readable article copy.
- Improved footer mobile spacing and tap targets while keeping the existing high-contrast footer design.
- Hardened the standalone admin login page for small screens with viewport padding, full-width card sizing, accessible controls, and focus states.

## 2026-07-21 Production Hardening Completion

- Fixed blog detail image URLs under pretty `/blogs/{slug}` routes by resolving stored media paths through app-base asset helpers.
- Converted shared public navigation, footer, breadcrumbs, blog cards, pagination, and blog-detail sidebar links to app-base URLs.
- Corrected the migrated Stroke article title and slug, and added a 301 redirect from the malformed slug.

- Made session startup opt-in instead of automatic for every public page.
- Added secure session helper functions and explicit admin/referral session handling.
- Added database-backed form rate limiting and duplicate submission locks.
- Added public form honeypots.
- Reworked support ticket IDs for concurrency safety.
- Strengthened referral registration/login and referral code generation.
- Added public read caching for settings, content, services, testimonials, blog categories, blog listings, blog counts, and blog details.
- Added cache invalidation after admin edits.
- Replaced broad public `SELECT *` reads with column-specific queries.
- Added blog pagination.
- Added production-safe indexes and new form guard tables to `database.sql`.
- Fixed pretty blog URL routing.
- Added friendly 404 fallback routing.
- Added protected `cache/` and `logs/` directories.
- Added WebP derivatives for all migrated media and responsive image markup helpers.
- Added dimensions/lazy-loading/eager hero handling through `responsive_image()`.
- Deferred Bootstrap JavaScript on public/admin pages.
- Added required cPanel deployment, checklist, performance audit, and security audit documents.
