HUMANITREE WEBSITE · humanitree.co.za
Deployment and handover notes · November 2026

WHAT THIS IS
A static, dependency-free website: 19 pages of plain HTML, one CSS file, one JS file, self-hosted fonts,
and a single PHP file that handles the two forms. No CMS, no frameworks, no CDNs, no trackers.

DEPLOY (cPanel File Manager)
1. Open File Manager and go to public_html (or the document root for humanitree.co.za).
2. Upload humanitree-website.zip into that folder.
3. Right-click the zip and choose Extract. The files sit at the root of the zip, so index.html,
   .htaccess and the assets folder land directly in public_html. There is no wrapper folder.
4. Delete the zip from the server afterwards.
5. Make sure "Show hidden files" is on in File Manager so you can see that .htaccess was extracted.
6. Visit https://humanitree.co.za. The .htaccess forces HTTPS and the non-www address.
7. If the host returns a blank "500 Internal Server Error" right after extracting, remove the single line
   "Options -Indexes" from .htaccess (a few hosts do not allow it) and reload.

PREVIEW BEFORE DNS GOES LIVE
All links are page-relative, so the site also runs from a cPanel temporary URL (http://server-ip/~username/),
from a staging subfolder, or by opening index.html straight from the extracted folder on your Mac (everything
except the forms works offline).

SSL
Install the free AutoSSL / Let's Encrypt certificate in cPanel before pointing traffic at the site.
The HSTS header only switches on once the site is served over HTTPS, so there is no lock-out risk.

FORMS (contact.php)
- Both forms post to /contact.php, which emails sales@humanitree.co.za.
- Change the recipient, sender or limits in /includes/config.php (that folder is blocked from the web).
- The handler sends from noreply@humanitree.co.za. Create that mailbox (or at least an SPF record that
  allows the web server to send for humanitree.co.za) so messages are not marked as spam.
  Recommended DNS: SPF (v=spf1 +a +mx include:<your host's SPF> ~all), DKIM via cPanel Email Deliverability, and a DMARC record.
- Protection in place: same-site origin check, time-limited HMAC token, honeypot field, minimum fill time,
  per-IP rate limit (6 per hour), strict validation, header-injection stripping, fixed recipient, link-spam guard.
- If mail() is not available on the host, submissions are kept in the server's temp folder (ht_unsent_*.txt)
  and the visitor is shown the sales email address instead.
- Test after deploying: submit the contact form and confirm the email arrives (check spam the first time).

SECURITY SUMMARY
- Content-Security-Policy (header and meta): only same-origin scripts, styles, fonts and images; no inline scripts
  except one hashed one-liner; no eval; form-action limited to this site; frames from other sites blocked.
- Headers: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, CORP.
- Directory listing off, TRACE/TRACK blocked, dotfiles and config files denied, server signature off.
- No third-party code anywhere, so nothing to patch and no supply-chain exposure.
- No cookies and no analytics. If analytics are added later, extend the CSP in .htaccess and in each page's meta tag.

EDITING CONTENT
- Every page is a plain HTML file in its own folder (e.g. /services/index.html). Edit text directly.
- Shared parts (header, footer, nav) are repeated in each file. For larger changes, regenerate from the
  build source (build.js + src/data.js), which produces all pages from one content file.
- Photography: four photos in /assets/img/ (Unsplash licence, free for commercial use, no attribution required:
  Ninthgrid x2, wocintechchat.com, Simon Hurry). Replace them with Humanitree's own photography when available;
  keep the same file names and the pages pick them up unchanged.
- Insights: the listing page is ready for articles. Add an /insights/<slug>/index.html per article and link it.
- Team: deliberately excluded from this build, as requested.

SEO
- Unique title and description per page, canonical URLs, Open Graph and Twitter cards (assets/og.png).
- Structured data: ProfessionalService organisation, Service per service page, FAQPage, BreadcrumbList, WebSite.
- sitemap.xml and robots.txt included. Submit https://humanitree.co.za/sitemap.xml in Google Search Console.
- Clean folder URLs with trailing slashes; /index.html is redirected to the folder URL.

FILE MAP
/index.html                         Home
/services/                          Six-pillar overview with capability accordions
/workforce-solutions/               Landing: Outsourced People Management + Temporary Employment Services
/payroll-and-compliance/            Landing: Payroll Management + Advisory Services
/talent-and-strategy/               Landing: Recruitment & RPO + Strategic Workforce Planning
/about/  /faqs/  /insights/  /contact/  /people-health-audit/  /privacy-policy/  /thank-you/  /404.html
/assets/css/site.css  /assets/js/site.js  /assets/fonts/*.woff2  /assets/img/*.jpg  /assets/*.svg|png  /favicon.ico
/contact.php  /includes/config.php  /.htaccess  /sitemap.xml  /robots.txt  /site.webmanifest
