CMS
Django audit: csrftoken on a marketing page is a smell
· Configuration notes, not a newsroom.
SiteRune fingerprints Django cookies. The playbook is WhiteNoise or nginx for static, cache for anonymous HTML, headers at the proxy.
Session middleware is not a homepage feature
Anonymous docs and landing pages should be cacheable. If csrftoken and a session cookie hit every GET, you opted the whole site into dynamic. SiteRune will say so via Cache-Control and cookie flags.
Deploy like an adult
TLS at the edge, HSTS on the proxy, gzip/br, a sitemap view, /llms.txt as a TemplateView or a static file. We do not run manage.py. We do not suggest debug=True findings beyond what HTML and headers already leak.
Run it on a live URL
The brief will name your CMS and attach the files. Three guest scans, no card.