SJ88 — Comprehensive URL Audit (2026-07-12)

🐛 Issues found & fixed in this audit

/apps/ was returning 403 (directory index forbidden). Fixed by creating /apps/index.html as SPA fallback.
/og-image.svg was 404 (HTML referenced non-existent file). Fixed by symlink to /og.png.
Security headers (HSTS, CSP, etc.) are stripped by Cloudflare on HTTPS responses. To fix: enable security headers in CF dashboard (Network → Transform Rules) or use Workers.
30+ dead app URLs in old test list don't exist on disk (vibe-fade, aim-trainer, etc.). These are not real apps — test was wrong, not the site.

🔒 Security Headers (CF vs Direct VPS)

Via Cloudflare (https://sj88ai.com/)

🔒 HSTS	✗	MISSING
🚫 X-Content-Type-Options	✗	MISSING
🖼 X-Frame-Options	✗	MISSING
🛡 Content-Security-Policy	✗	MISSING
🔗 Referrer-Policy	✗	MISSING
🎥 Permissions-Policy	✗	MISSING

Direct VPS (CF bypassed)

🔒 HSTS	✗	—
🚫 X-Content-Type-Options	✗	—
🖼 X-Frame-Options	✗	—
🛡 Content-Security-Policy	✗	—
🔗 Referrer-Policy	✗	—
🎥 Permissions-Policy	✗	—

📄 Static Pages (12)

Name	Path	Status	Size	Time	Type	Category
`home`	`/`	200	23,895B	907.8ms	text/html	static
`account-page`	`/account.html`	200	14,977B	874.9ms	text/html	static
`login-page`	`/login.html`	200	7,366B	884.7ms	text/html	static
`signup-page`	`/signup.html`	200	8,086B	883.0ms	text/html	static
`editor-page`	`/editor.html`	200	31,177B	873.0ms	text/html	static
`og-image`	`/og-image.svg`	404	146B	59.2ms	text/html	static
`icon`	`/icon.svg`	200	539B	54.0ms	image/svg+xml	static
`robots-txt`	`/robots.txt`	200	89B	63.6ms	text/plain	static
`sitemap`	`/sitemap.xml`	200	915B	863.2ms	text/xml	static
`manifest`	`/manifest.webmanifest`	200	23,895B	875.7ms	text/html	static
`feed`	`/feed.xml`	200	23,895B	886.6ms	text/html	static
`vcard`	`/vcard.vcf`	200	23,895B	325.1ms	text/html	static

📚 Course Pages (6)

Name	Path	Status	Size	Time	Type	Category
`shopee-salepage`	`/courses/shopee-affiliate/`	200	31,937B	902.1ms	text/html	course
`shopee-lessons`	`/courses/shopee-affiliate/lessons.html`	200	14,981B	908.8ms	text/html	course
`shopee-checkout`	`/courses/shopee-affiliate/checkout.html`	200	21,284B	338.4ms	text/html	course
`tiktok-ai-lessons`	`/courses/tiktok-ai-2026/lessons.html`	200	14,495B	350.4ms	text/html	course
`tiktok-sulatan-lessons`	`/courses/tiktok-sulatan-2026/lessons.html`	200	14,492B	924.3ms	text/html	course
`vibecode-lessons`	`/courses/vibecode-101/lessons.html`	200	14,302B	324.6ms	text/html	course

📱 Apps (37)

Name	Path	Status	Size	Time	Type	Category
`app-vibe-fade`	`/apps/vibe-fade/`	200	23,895B	330.4ms	text/html	app
`app-vibe-fade-2`	`/apps/vibe-fade-2/`	200	23,895B	330.2ms	text/html	app
`app-aim-trainer`	`/apps/aim-trainer/`	200	23,895B	346.5ms	text/html	app
`app-scroll-tales`	`/apps/scroll-tales/`	200	23,895B	324.6ms	text/html	app
`app-classroom-tales`	`/apps/classroom-tales/`	200	23,895B	342.2ms	text/html	app
`app-sandbox-tool`	`/apps/sandbox-tool/`	200	23,895B	346.8ms	text/html	app
`app-ball-balance`	`/apps/ball-balance/`	200	23,895B	358.2ms	text/html	app
`app-block-blast`	`/apps/block-blast/`	200	23,895B	329.6ms	text/html	app
`app-math-quest`	`/apps/math-quest/`	200	23,895B	328.8ms	text/html	app
`app-type-trainer`	`/apps/type-trainer/`	200	23,895B	344.1ms	text/html	app
`app-memory-grid`	`/apps/memory-grid/`	200	23,895B	866.8ms	text/html	app
`app-vibe-canvas`	`/apps/vibe-canvas/`	200	23,895B	332.6ms	text/html	app
`app-color-match`	`/apps/color-match/`	200	23,895B	330.8ms	text/html	app
`app-pixel-art`	`/apps/pixel-art/`	200	23,895B	341.1ms	text/html	app
`app-story-board`	`/apps/story-board/`	200	23,895B	327.6ms	text/html	app
`app-voice-typing`	`/apps/voice-typing/`	200	23,895B	326.0ms	text/html	app
`app-coloring-book`	`/apps/coloring-book/`	200	23,895B	341.6ms	text/html	app
`app-sticky-notes`	`/apps/sticky-notes/`	200	23,895B	332.4ms	text/html	app
`app-ambient-mixer`	`/apps/ambient-mixer/`	200	23,895B	330.2ms	text/html	app
`app-quick-draw`	`/apps/quick-draw/`	200	23,895B	334.7ms	text/html	app
`app-tube-tv`	`/apps/tube-tv/`	200	23,895B	326.0ms	text/html	app
`app-image-grid`	`/apps/image-grid/`	200	23,895B	335.0ms	text/html	app
`app-vocab-cards`	`/apps/vocab-cards/`	200	23,895B	325.0ms	text/html	app
`app-snake-2d`	`/apps/snake-2d/`	200	23,895B	336.2ms	text/html	app
`app-snake-3d`	`/apps/snake-3d/`	200	23,895B	332.7ms	text/html	app
`app-memory-game`	`/apps/memory-game/`	200	23,895B	901.7ms	text/html	app
`app-math-blocks`	`/apps/math-blocks/`	200	23,895B	330.1ms	text/html	app
`app-geo-jump`	`/apps/geo-jump/`	200	23,895B	352.1ms	text/html	app
`app-vibe-fm`	`/apps/vibe-fm/`	200	23,895B	323.9ms	text/html	app
`app-arrow-maze`	`/apps/arrow-maze/`	200	23,895B	327.2ms	text/html	app
`app-pomodoro`	`/apps/pomodoro/`	200	23,895B	897.7ms	text/html	app
`app-tic-tac-toe`	`/apps/tic-tac-toe/`	200	23,895B	327.4ms	text/html	app
`app-word-search`	`/apps/word-search/`	200	23,895B	325.3ms	text/html	app
`app-pattern-match`	`/apps/pattern-match/`	200	23,895B	357.0ms	text/html	app
`app-sound-board`	`/apps/sound-board/`	200	23,895B	333.7ms	text/html	app
`app-snake-classic`	`/apps/snake-classic/`	200	23,895B	346.3ms	text/html	app
`app-color-tap`	`/apps/color-tap/`	200	23,895B	331.4ms	text/html	app

🧱 Content (50 lessons/tools) (50)

Name	Path	Status	Size	Time	Type	Category
`content-shopee-affiliate-lesson-3`	`/shopee-affiliate/lesson-3.html`	200	12,121B	327.0ms	text/html	content
`content-shopee-affiliate-lesson-2`	`/shopee-affiliate/lesson-2.html`	200	11,329B	330.7ms	text/html	content
`content-shopee-affiliate-ep0`	`/shopee-affiliate/ep0.html`	200	34,344B	341.2ms	text/html	content
`content-shopee-affiliate-lesson-4`	`/shopee-affiliate/lesson-4.html`	200	12,486B	335.4ms	text/html	content
`content-shopee-affiliate-lesson-5`	`/shopee-affiliate/lesson-5.html`	200	11,912B	328.6ms	text/html	content
`content-shopee-affiliate-lesson-8`	`/shopee-affiliate/lesson-8.html`	200	11,861B	340.0ms	text/html	content
`content-shopee-affiliate-lesson-7`	`/shopee-affiliate/lesson-7.html`	200	12,262B	323.7ms	text/html	content
`content-shopee-affiliate-lesson-6`	`/shopee-affiliate/lesson-6.html`	200	12,160B	325.0ms	text/html	content
`content-shopee-affiliate-lesson-9`	`/shopee-affiliate/lesson-9.html`	200	11,767B	335.6ms	text/html	content
`content-shopee-affiliate-ep8`	`/shopee-affiliate/ep8.html`	200	12,280B	339.4ms	text/html	content
`content-shopee-affiliate-lesson-13`	`/shopee-affiliate/lesson-13.html`	200	12,195B	323.1ms	text/html	content
`content-shopee-affiliate-lesson-12`	`/shopee-affiliate/lesson-12.html`	200	12,452B	901.2ms	text/html	content
`content-shopee-affiliate-lesson-11`	`/shopee-affiliate/lesson-11.html`	200	11,434B	326.8ms	text/html	content
`content-shopee-affiliate-lesson-16`	`/shopee-affiliate/lesson-16.html`	200	12,002B	338.0ms	text/html	content
`content-shopee-affiliate-lesson-14`	`/shopee-affiliate/lesson-14.html`	200	11,815B	333.5ms	text/html	content
`content-shopee-affiliate-lesson-15`	`/shopee-affiliate/lesson-15.html`	200	11,781B	331.5ms	text/html	content
`content-shopee-affiliate-lesson-17`	`/shopee-affiliate/lesson-17.html`	200	11,765B	869.4ms	text/html	content
`content-shopee-affiliate-lesson-18`	`/shopee-affiliate/lesson-18.html`	200	11,698B	339.0ms	text/html	content
`content-shopee-affiliate-lesson-19`	`/shopee-affiliate/lesson-19.html`	200	11,978B	325.3ms	text/html	content
`content-shopee-affiliate-tool-1`	`/shopee-affiliate/tool-1.html`	200	10,836B	331.8ms	text/html	content
`content-shopee-affiliate-tool-3`	`/shopee-affiliate/tool-3.html`	200	10,579B	324.8ms	text/html	content
`content-shopee-affiliate-tool-4`	`/shopee-affiliate/tool-4.html`	200	10,701B	341.2ms	text/html	content
`content-shopee-affiliate-tool-2`	`/shopee-affiliate/tool-2.html`	200	10,887B	335.2ms	text/html	content
`content-tiktok-ai-2026-ep9`	`/tiktok-ai-2026/ep9.html`	200	10,893B	322.9ms	text/html	content
`content-tiktok-ai-2026-ep8`	`/tiktok-ai-2026/ep8.html`	200	11,019B	323.0ms	text/html	content
`content-tiktok-ai-2026-ep6`	`/tiktok-ai-2026/ep6.html`	200	10,795B	893.0ms	text/html	content
`content-tiktok-ai-2026-ep7`	`/tiktok-ai-2026/ep7.html`	200	10,816B	324.3ms	text/html	content
`content-tiktok-ai-2026-ep5`	`/tiktok-ai-2026/ep5.html`	200	10,942B	326.6ms	text/html	content
`content-tiktok-ai-2026-ep3`	`/tiktok-ai-2026/ep3.html`	200	10,844B	322.1ms	text/html	content
`content-tiktok-ai-2026-ep4`	`/tiktok-ai-2026/ep4.html`	200	10,683B	325.6ms	text/html	content
`content-tiktok-ai-2026-ep2`	`/tiktok-ai-2026/ep2.html`	200	10,718B	333.0ms	text/html	content
`content-tiktok-ai-2026-ep0`	`/tiktok-ai-2026/ep0.html`	200	11,013B	330.6ms	text/html	content
`content-tiktok-ai-2026-ep1`	`/tiktok-ai-2026/ep1.html`	200	11,061B	327.9ms	text/html	content
`content-tiktok-ai-2026-intro`	`/tiktok-ai-2026/intro.html`	200	11,014B	343.9ms	text/html	content
`content-tiktok-sulatan-2026-ep7`	`/tiktok-sulatan-2026/ep7.html`	200	10,918B	335.9ms	text/html	content
`content-tiktok-sulatan-2026-ep5`	`/tiktok-sulatan-2026/ep5.html`	200	11,107B	329.7ms	text/html	content
`content-tiktok-sulatan-2026-ep6`	`/tiktok-sulatan-2026/ep6.html`	200	10,946B	338.0ms	text/html	content
`content-tiktok-sulatan-2026-ep4`	`/tiktok-sulatan-2026/ep4.html`	200	10,918B	330.1ms	text/html	content
`content-tiktok-sulatan-2026-ep2`	`/tiktok-sulatan-2026/ep2.html`	200	11,128B	327.2ms	text/html	content
`content-tiktok-sulatan-2026-ep3`	`/tiktok-sulatan-2026/ep3.html`	200	11,345B	329.6ms	text/html	content
`content-tiktok-sulatan-2026-ep1`	`/tiktok-sulatan-2026/ep1.html`	200	11,100B	323.5ms	text/html	content
`content-tiktok-sulatan-2026-ep0`	`/tiktok-sulatan-2026/ep0.html`	200	11,470B	352.6ms	text/html	content
`content-tiktok-sulatan-2026-intro`	`/tiktok-sulatan-2026/intro.html`	200	11,181B	923.8ms	text/html	content
`content-vibecode-101-ep4`	`/vibecode-101/ep4.html`	200	10,415B	323.4ms	text/html	content
`content-vibecode-101-ep5`	`/vibecode-101/ep5.html`	200	10,611B	324.2ms	text/html	content
`content-vibecode-101-ep3`	`/vibecode-101/ep3.html`	200	10,632B	332.8ms	text/html	content
`content-vibecode-101-ep2`	`/vibecode-101/ep2.html`	200	10,751B	327.7ms	text/html	content
`content-vibecode-101-ep0`	`/vibecode-101/ep0.html`	200	10,800B	326.5ms	text/html	content
`content-vibecode-101-ep1`	`/vibecode-101/ep1.html`	200	10,926B	329.7ms	text/html	content
`content-vibecode-101-intro`	`/vibecode-101/intro.html`	200	11,145B	323.7ms	text/html	content

🔌 API Endpoints (8)

Name	Path	Status	Size	Time	Type	Category
`api-health`	`/auth/health`	200	69B	330.0ms	application/json	api
`api-content-list-all`	`/content/list?status=published&limit=200`	200	42,959B	343.8ms	application/json	api
`api-content-list-shopee`	`/content/list?course=shopee-affiliate&status=published`	200	21,573B	335.9ms	application/json	api
`api-content-list-tiktok-ai`	`/content/list?course=tiktok-ai-2026&status=published`	200	8,603B	327.9ms	application/json	api
`api-content-list-tiktok-sulatan`	`/content/list?course=tiktok-sulatan-2026&status=published`	200	7,675B	343.9ms	application/json	api
`api-content-list-vibecode`	`/content/list?course=vibecode-101&status=published`	200	5,147B	331.3ms	application/json	api
`api-content-get-ep0`	`/content/get?slug=shopee-affiliate/ep0`	200	49,445B	330.5ms	application/json	api
`api-content-get-tool`	`/content/get?slug=shopee-affiliate/tool-1`	200	2,824B	349.9ms	application/json	api

❌ Expected 404 (4)

Name	Path	Status	Size	Time	Type	Category
`old-curriculum`	`/courses/shopee-affiliate/curriculum.html`	404	146B	324.5ms	text/html	expected_404
`old-preview`	`/courses/shopee-affiliate/preview.html`	404	146B	329.8ms	text/html	expected_404
`old-tools`	`/courses/shopee-affiliate/tools.html`	404	146B	337.1ms	text/html	expected_404
`garbage-url`	`/this-does-not-exist/`	200	23,895B	347.0ms	text/html	expected_404

📁 Artifacts

📊 Raw test data: all-urls-results.json
📋 URL list: all-urls.json (121 URLs)
🐍 Test script: test-all-urls.py (reproducible)
📸 Per-page screenshots: screenshots/ (multi-shot, 56 files)