# Website SEO
> Domain binding, SSL setup, Cloudflare DNS, search engine submission, sitemap management, and Windows shared hosting FTP workflows
- Skill: `clowlove/website-seo` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add clowlove/website-seo`
- Raw SKILL.md: https://api.skillmd.com/api/skills/clowlove/website-seo/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Marketing & Growth
- Author: clowlove (https://skillmd.com/u/clowlove)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/clowlove/website-seo
---
# Website SEO & Administration
## Domain Binding (GitHub Pages → Custom Domain)
### GitHub Settings
1. Repository → Settings → Pages → Custom domain: `www.example.com`
2. Do NOT check "Enforce HTTPS" until after DNS verification completes
### Cloudflare DNS
| Type | Name | Target | Proxy |
|------|------|--------|-------|
| CNAME | www | `githubtalk.github.io` | DNS only (gray) during verification |
**Critical**: Keep DNS-only (gray cloud) while GitHub validates domain ownership. After GitHub issues HTTPS cert, re-enable proxy (orange cloud).
### Why Enforce HTTPS Is Optional with Cloudflare
Cloudflare Flexible/Full SSL already handles HTTP→HTTPS redirect at CDN level. GitHub's "Enforce HTTPS" does the same. If `https://www.example.com` works in browser, the checkbox is cosmetic.
---
## Cloudflare SSL 525 Error
**Symptom**: `HTTP 525 - SSL handshake failed`
**Root cause**: Origin server has no valid SSL certificate for the domain
**Quick fix**:
- Cloudflare → SSL/TLS → Mode: **Flexible**
- Visitor → Cloudflare: HTTPS ✅
- Cloudflare → Origin: HTTP (no cert needed) ✅
**Permanent fix**: Install Let's Encrypt on origin server (requires RDP/SSH access)
---
## Cloudflare Proxy → Origin Server Setup
When your origin is a VPS/root server (not GitHub Pages), Cloudflare proxies traffic to your server's IP.
### Step 1: Start web server on origin FIRST
```bash
# On origin server
sudo systemctl start nginx
sudo systemctl enable nginx
sudo ss -tlnp | grep -E ':80|:443' # verify listening
curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1 # should NOT be 000
```
### Step 2: Check PHP-FPM if site returns 502 Bad Gateway
```bash
# If nginx serves 502, PHP-FPM is usually the cause
sudo systemctl status php8.3-fpm | grep "Active:"
# Check socket permissions
ls -la /run/php/php*-fpm.sock
# If permission denied in error log, fix:
sudo chmod 660 /run/php/php8.3-fpm.sock
sudo usermod -a -G www-data nginx
sudo systemctl restart nginx php8.3-fpm
```
**Step 2: Cloudflare DNS record**
| Type | Name | Target | Proxy |
|------|------|--------|-------|
| A | sub | `YOUR_SERVER_IP` | Proxied (☁️ orange) |
**Step 3: Verify**
```bash
# Test through Cloudflare (not direct IP)
curl -sI https://your-domain.com/ | grep cf-ray
```
Full reference: `references/cloudflare-origin-server.md`
---
## Nginx sites-enabled Gotcha (Ubuntu)
On Ubuntu, nginx configs go in `/etc/nginx/sites-enabled/` but **nginx.conf does not include it by default**. If nginx starts but serves nothing on port 80:
1. Check: `grep sites-enabled /etc/nginx/nginx.conf`
2. If missing, add inside `http {}` block: `include /etc/nginx/sites-enabled/*;`
3. Test: `sudo nginx -t`
4. Reload: `sudo systemctl reload nginx`
Note: The `include` line must be INSIDE the `http {}` block, not after the closing `}`. If you see `"server" directive is not allowed here`, the include is outside the http block.
## Creating Directory Index Pages
When migrating from ASP/PHP sites that generate listing pages dynamically, you may need to create static `index.html` for directories:
```bash
# Generate product list from existing HTML files
for f in /home/ubuntu/wwwroot/products/*.html; do
id=$(basename "$f" .html)
title=$(grep -oP '(?<=)[^<]+' "$f" 2>/dev/null | head -1)
echo "<li><a href=\"/products/$id.html\">$title</a></li>"
done > /tmp/product_list.txt
# Combine with HTML template
cat > /home/ubuntu/wwwroot/products/index.html << HTMLEOF
<!DOCTYPE html>
<html><head><title>Product Center
$(cat /tmp/product_list.txt)