CMS
Laravel audit: cookies, Livewire, and nginx in front of PHP
· Configuration notes, not a newsroom.
SiteRune fingerprints laravel_session, XSRF-TOKEN, and Livewire. Marketing pages should not inherit the app's no-store session layout.
The app cookie poisons the brochure
If every public URL sets laravel_session and Cache-Control: no-store, perf-cache and TTFB follow. Split the marketing site or stop starting a session on anonymous GET. Livewire on the homepage is a SPA with extra steps.
Headers at the vhost
nginx add_header, or middleware that only runs on public routes. Ship files include nginx when headers are missing. llms.txt in public/. Blade can emit Organization JSON-LD. We are not going to generate a WordPress mu-plugin for Laravel.
Run it on a live URL
The brief will name your CMS and attach the files. Three guest scans, no card.