Security
13. Add security headers security/csp · security/hsts · security/x-frame-options
Configure these at the hosting/CDN layer. Start CSP in report-only mode, observe violations, then enforce it. Payhip, Google Fonts, TripAdvisor, videos, analytics, and form endpoints may need explicit allow-list entries.
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; ...
Verify: Use SecurityHeaders.com, test every purchase/form/video flow, and review CSP reports before enforcing.
Security
14. Protect the public form from abuse security/form-captcha
Add Cloudflare Turnstile or an equivalent low-friction challenge. Validate its token server-side; a client-only widget is not sufficient. Also add rate limiting, a honeypot, and server-side input validation.
Security
15. Secure external new-tab links security/new-tab
For the TripAdvisor link and every target="_blank" link, add rel="noopener noreferrer".
<a href="https://www.tripadvisor.com/..." target="_blank" rel="noopener noreferrer">Read TripAdvisor reviews</a>
Structured data
16. Add business/service schema and VideoObject schema schema/video · video/video-schema
Add JSON-LD describing the business and its services using the most accurate Schema.org types available (for example, LocalBusiness or TravelAgency when eligibility is confirmed). Include name, URL, logo, contact data, service area, and same-as profiles. Add VideoObject only for a real embedded video, with an accurate name, description, thumbnail, upload date, duration, and embed/content URL.
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "VideoObject",
"name": "Explore Japan with Farside Japan",
"description": "A short look at personalized private experiences in Japan.",
"thumbnailUrl": "https://farsidejapan.com/path/video-thumbnail.jpg",
"uploadDate": "2026-01-01",
"embedUrl": "https://..."
}
</script>
Verify: Validate with Google Rich Results Test and Schema.org Validator. Do not add ratings, prices, addresses, or credentials that are not visible and factual.