Ref: CAR-<ID> or Ref: PAGE-<NAME>. Log them below to build the per-car picture.When a WhatsApp enquiry lands, its message ends with a Ref code. Log it here (10 seconds) and this page becomes the demand ledger — which cars pull enquiries, which pages convert, what changed month to month. Data lives in this browser via localStorage; export CSV for a backup or a spreadsheet.
| Date | Car / page | Via | Note |
|---|
| Leaderboard | Demand | Count |
|---|
Car.dc.html?car=<id>. A car with high views and few enquiries has a pricing or photo problem. A car with few views and steady enquiries deserves a homepage slot.| Question | Where |
|---|---|
| How many people visited today / this week? | Web Analytics → Visits |
| Which cars get looked at most? | Web Analytics → Page views → paths containing Car.dc?car= |
| Where do visitors come from? | Web Analytics → Referrers (Instagram, Google, direct…) |
| Which car produced this enquiry? | The Ref: code inside the WhatsApp message itself |
| How many enquiries per car all-time? | This page, section 01 — search WhatsApp for CAR- to backfill |
| Is the site being attacked / scraped? | Security → Analytics — blocked bot traffic |
| Is the site fast? | Web Analytics → Core Web Vitals (real visitor timings) |
| Layer | State | What it does |
|---|---|---|
| HTTPS forced | ON | Every http:// request 301s to https:// at the edge |
| Minimum TLS 1.2 | ON | Refuses obsolete, breakable TLS 1.0/1.1 connections |
| TLS 1.3 | ON | Fastest, most secure handshake for modern browsers |
| Bot Fight Mode | ON | Challenges scrapers and junk bots before they reach the site |
| Browser Integrity Check | ON | Blocks requests with forged/abusive headers |
| Security headers | ON | nosniff, frame-ancestors, referrer policy, permissions policy via _headers |
| CSP | Report-only | Logs would-be violations without breaking inline styles/scripts. Revisit after a clean week. |
| HSTS | DEFERRED | Deliberate. Turn on in SSL/TLS → Edge Certificates only after days of clean HTTPS — it is a one-way door for the max-age. |
| DDoS protection | ON | Cloudflare's always-on network-layer protection, free tier included |
| Origin exposure | NONE | Static files on Cloudflare's own network — there is no origin server to attack, no database to breach, no forms to inject |