Test Report — olafernstphotography

Automated pre-launch testing summary, generated 2026-05-27.

Tested as: authenticated admin + anonymous, via curl + code inspection.
Environment: Local dev server at http://localhost:10003.
No code changes. No data modified.
Scope notes: This is the Local dev server, so anything that depends on Apache mod_headers or HTTPS can't be verified here and is flagged as prod-only. Most galleries are empty in this install (only randompic has 45 images), which limits some image-flow tests.

TL;DR

Your site is in good shape for launch from a security + transport perspective. License is valid, file protections all in place, CSRF + rate limiting work, image.php is properly scoped, code passes all the "code-level" t-checks in the checklist.

Three things to address before launch:
  1. Fix homepage <title> and add <h1> + <meta description> + OG tags.
  2. Verify security headers actually emit on production (Local's mod_headers is off, masking nothing here — it's a Local quirk).
  3. The browser-interaction items (lightbox, mobile, modals) genuinely need a pair of human eyes on a real browser.

Passed   Verified working

Site & transport

Public pages

Admin

Security — file protection (all blocked anonymously)

PathCode
/site-settings.json404 ✓
/galleries/*/config.json404 ✓
/galleries/*/proof-flags.json404 ✓
/galleries/*/uploads-metadata.json404 ✓
/logs/security.log404 ✓
/analytics/visits.json404 ✓
/cache/404 ✓
/admin-credentials.php403 ✓
/featured.json404 ✓
/.git/HEAD404 ✓
/_backup/404 ✓

_backup/.htaccess and cache/.htaccess both have Require all denied. ✓

Security — image.php scope & traversal

Security — image format negotiation

Security — CSRF

Security — rate limiting

Security — code-level checks (read from source)

License

Fix   Findings worth fixing

  1. Homepage <title> is just "Gallery" — bad for SEO. Should be brand-specific (e.g., "Olaf Ernst Photography"). Other pages are fine (Contact, My Favorites, Legal Notice & Privacy Policy, The Garage).
  2. Homepage has no <h1> — only an <h2 class="ac-modal__title"> from the confirm modal. Adding a visually-hidden or visible H1 would help SEO + screen readers (t243).
  3. No <meta name="description"> or Open Graph tags on homepage — hurts SEO and link previews on social media.
  4. No security/cache HTTP headers visible on Local responses. Your .htaccess correctly configures X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Strict-Transport-Security, CSP, and Cache-Control — all wrapped in <IfModule mod_headers.c>. But this Local Apache has mod_headers disabled, so nothing is emitted. This is a Local-only issue; production should ship with mod_headers enabled. Verify on prod with curl -I https://olafernst.com/ and confirm those headers appear (t188, t301).

Manual   Needs human eye

These can't be verified from a headless terminal session.

Generated by automated test pass against testme.php checklist · No site code or data was modified during testing.