diff --git a/.htaccess b/.htaccess
new file mode 100644
index 0000000..f62d37e
--- /dev/null
+++ b/.htaccess
@@ -0,0 +1,55 @@
+Options -Indexes
+
+# ── Routing: clean URLs ──────────────────────────────────────────
+
+ RewriteEngine On
+
+ # www → non-www redirect
+ RewriteCond %{HTTP_HOST} ^www\.quantumtaskai\.com [NC]
+ RewriteRule ^(.*)$ https://quantumtaskai.com/$1 [R=301,L]
+
+ # Serve .html files without extension
+ RewriteCond %{REQUEST_FILENAME} !-f
+ RewriteCond %{REQUEST_FILENAME} !-d
+ RewriteCond %{REQUEST_FILENAME}.html -f
+ RewriteRule ^(.*)$ $1.html [L]
+
+
+# ── Custom 404 ────────────────────────────────────────────────────
+ErrorDocument 404 /404.html
+
+# ── Security headers ─────────────────────────────────────────────
+
+ Header always set X-Frame-Options "SAMEORIGIN"
+ Header always set X-Content-Type-Options "nosniff"
+ Header always set X-XSS-Protection "1; mode=block"
+ Header always set Referrer-Policy "strict-origin-when-cross-origin"
+ Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
+
+ # ── Caching: HTML (1 hour) ──────────────────────────────────────
+
+ Header set Cache-Control "public, max-age=3600, must-revalidate"
+
+
+ # ── Caching: Static assets (1 year) ────────────────────────────
+
+ Header set Cache-Control "public, max-age=31536000, immutable"
+
+
+ # ── Caching: JS (1 year) ────────────────────────────────────────
+
+ Header set Cache-Control "public, max-age=31536000, immutable"
+
+
+ # ── Caching: shared-header.js (1 hour — overrides JS rule above)
+
+ Header set Cache-Control "public, max-age=3600, must-revalidate"
+
+
+
+# ── Gzip compression ─────────────────────────────────────────────
+
+ AddOutputFilterByType DEFLATE text/html text/plain text/css
+ AddOutputFilterByType DEFLATE application/javascript application/json
+ AddOutputFilterByType DEFLATE image/svg+xml
+
diff --git a/404.html b/404.html
index 5533ae5..35b0e8a 100644
--- a/404.html
+++ b/404.html
@@ -64,7 +64,7 @@
-
+
404
diff --git a/CLAUDE.md b/CLAUDE.md
index 2497aca..4017312 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -14,7 +14,7 @@ digital-branding.html — AI Digital Branding services page (SOSTAC+RACE)
privacy.html — Privacy Policy
terms.html — Terms of Service
404.html — Custom 404 page
-header.js — Shared self-injecting header (loaded cross-domain)
+shared-header.js — Shared self-injecting header (loaded cross-domain)
robots.txt — Search engine crawl instructions
sitemap.xml — XML sitemap (4 pages)
Dockerfile — nginx:alpine image
@@ -25,12 +25,12 @@ img/ — logo.png, favicon.ico, favicon-*.png, apple-touch-ic
## Shared Header
-`header.js` is a self-injecting IIFE loaded by all Quantum Tasks AI apps:
-- Static site: `
+
diff --git a/index.html b/index.html
index bbd9a43..8e1f228 100644
--- a/index.html
+++ b/index.html
@@ -890,7 +890,7 @@
-
+
diff --git a/privacy.html b/privacy.html
index b587731..e69cfe0 100644
--- a/privacy.html
+++ b/privacy.html
@@ -61,7 +61,7 @@
-
+
diff --git a/header.js b/shared-header.js
similarity index 98%
rename from header.js
rename to shared-header.js
index d8da3dd..11f4765 100644
--- a/header.js
+++ b/shared-header.js
@@ -1,8 +1,8 @@
/*
- Shared Header — hosted at https://quantumtaskai.com/header.js
+ Shared Header — hosted at https://quantumtaskai.com/shared-header.js
Update nav links and colors in this file only.
All connected apps will reflect changes on next page load.
- To bust cache after updates, add ?v=2 to the script src.
+ Cache: 1 hour (set via .htaccess) — no version bumps needed.
*/
(function () {
diff --git a/terms.html b/terms.html
index 5ecb506..b0680a8 100644
--- a/terms.html
+++ b/terms.html
@@ -61,7 +61,7 @@
-
+