THE BUDGEN PARTNERSHIP - DEMO SITE UPDATES (29 September 2026)
================================================================

CHANGES MADE IN THIS VERSION
1. Images: all project photos recompressed (progressive JPEG, quality 80, metadata removed).
   Total image weight reduced from 23.1 MB to 9.8 MB. Filenames unchanged.
2. Site icon: new square "TBP" favicon.ico (site root) and images/apple-touch-icon.png,
   cut from the existing logo, replacing the wide logo JPG in every page.
3. Sharing previews: Open Graph and Twitter card tags (title, description, site name,
   en_GB locale) added to every page.
4. 404 page: now titled "Page not found | The Budgen Partnership" and marked noindex.
5. Privacy policy: added a sentence explaining the hashed IP address kept briefly to
   limit repeated form submissions.
6. Contact/careers form (form/send.php): if the page script has not run, visitors now see
   a simple thank-you / error page instead of raw data. Normal behaviour is unchanged.
7. .htaccess:
   - HTTPS redirect
   - 301 redirects from the old .html addresses to the new pages
   - security headers (HSTS, CSP, X-Frame-Options, nosniff, Referrer and Permissions policy)
   - compression and browser caching
   - directory listings off; README.txt, config.php and _go-live/ blocked from the web
   - noindex header so search engines do not index the demo (REMOVE AT GO-LIVE)
8. _go-live/robots.txt and _go-live/sitemap.xml prepared for https://www.budgenpartnership.com.

GO-LIVE CHECKLIST (still to do)
[ ] Rebuild the site without the /demo base path. Edits 2-5 above were made to the built
    pages, so repeat them in the site source (Next.js metadata: icons, openGraph,
    metadataBase + alternates.canonical, not-found title, privacy text) or they will be lost.
[ ] Add og:image and canonical tags at rebuild (both need the final absolute domain).
[ ] form/config.php: set recipient to the practice inbox and sender to an address on the
    live domain; confirm SPF/DKIM for the web server, then send a test enquiry.
[ ] Host the full privacy notice on the new site and update the "Read the full privacy
    notice" link (it currently points to the old site's privacy-policy.html page).
[ ] Add enquiry retention period and lawful basis to the privacy page.
[ ] In .htaccess: remove the X-Robots-Tag noindex line; change /demo/ paths
    (RewriteBase, ErrorDocument, _go-live rule) to /.
[ ] Copy _go-live/robots.txt and _go-live/sitemap.xml to the web root.
