diff --git a/.env.example b/.env.example
index ada60d43c..8b8eb1ef1 100644
--- a/.env.example
+++ b/.env.example
@@ -56,6 +56,11 @@ SESSION_DOMAIN=null
 # since it needs no real DNS.
 # AFFILIATE_SUBDOMAIN=affiliate.affilstack.com
 
+# The developer portal (add-on marketplace developers) on its own
+# subdomain. Point its DNS at this same application. Leave unset to serve
+# it from /developers on the app instead.
+# DEVELOPER_SUBDOMAIN=developer.affilstack.com
+
 BROADCAST_CONNECTION=log
 FILESYSTEM_DISK=local
 QUEUE_CONNECTION=database
@@ -108,6 +113,14 @@ STRIPE_PUBLISHABLE_KEY=
 STRIPE_SECRET_KEY=
 STRIPE_WEBHOOK_SECRET=
 
+# --- AffilStack: Paystack and PayPal (optional payment gateways) ---
+# PAYSTACK_PUBLIC_KEY=
+# PAYSTACK_SECRET_KEY=
+# PAYSTACK_USD_TO_NGN_RATE=1600
+# PAYPAL_CLIENT_ID=
+# PAYPAL_CLIENT_SECRET=
+# PAYPAL_WEBHOOK_ID=
+
 # --- AffilStack: Google Places (Phase 2, Google Maps lead-finding) ---
 GOOGLE_PLACES_API_KEY=
 
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ae67c4dd8..2a12c0fdc 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,3 +10,27 @@ updates:
       github-actions:
         patterns:
           - "*"
+
+  # PHP and JavaScript libraries: security fixes arrive as pull requests,
+  # which the Tests workflow checks on PHP 8.4 and 8.5 before merging.
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      composer-patches:
+        update-types:
+          - "patch"
+          - "minor"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      npm-patches:
+        update-types:
+          - "patch"
+          - "minor"
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 136bd35f6..72abda1a4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -3,7 +3,9 @@ name: Tests
 on:
   push:
     branches:
+      - main
       - master
+      - affilstack-app
       - '*.x'
   pull_request:
   schedule:
@@ -19,7 +21,7 @@ jobs:
     strategy:
       fail-fast: true
       matrix:
-        php: [8.3, 8.4, 8.5]
+        php: [8.4, 8.5]
 
     name: PHP ${{ matrix.php }}
 
@@ -39,6 +41,19 @@ jobs:
       - name: Install Composer dependencies
         run: composer install --prefer-dist --no-interaction --no-progress
 
+      # Pages load the built CSS/JS (public/build is not committed), so the
+      # tests need the front end built first.
+      - name: Setup Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Build front end
+        run: |
+          npm ci --no-audit --no-fund
+          npm run build
+
       - name: Copy environment file
         run: cp .env.example .env
 
diff --git a/.hostinger/site.json b/.hostinger/site.json
new file mode 100644
index 000000000..7c16f25a7
--- /dev/null
+++ b/.hostinger/site.json
@@ -0,0 +1,11 @@
+{
+    "domain": "affilstack.com",
+    "username": "u281901129",
+    "type": "php",
+    "layout": "releases",
+    "releases": "/home/u281901129/domains/affilstack.com/releases/<time>",
+    "current": "/home/u281901129/domains/affilstack.com/current -> latest release",
+    "shared": "/home/u281901129/domains/affilstack.com/shared (.env, storage, backups)",
+    "public_html": "symlink to current/public",
+    "deploy": "/home/u281901129/domains/affilstack.com/deploy/deploy.sh <package.zip> [report-name]; rollback.sh [report-name]"
+}
diff --git a/app/Console/Commands/Dev/SeedDemoData.php b/app/Console/Commands/Dev/SeedDemoData.php
index 5ca644084..1c56b7edf 100644
--- a/app/Console/Commands/Dev/SeedDemoData.php
+++ b/app/Console/Commands/Dev/SeedDemoData.php
@@ -2,6 +2,8 @@
 
 namespace App\Console\Commands\Dev;
 
+use App\Models\Addon;
+use App\Models\AddonInstall;
 use App\Models\ApiToken;
 use App\Models\CrmCampaign;
 use App\Models\CrmCampaignRecipient;
@@ -9,11 +11,14 @@
 use App\Models\CrmEmailSend;
 use App\Models\CrmList;
 use App\Models\CrmReply;
+use App\Models\DeveloperProfile;
 use App\Models\Earning;
 use App\Models\EmailConnection;
 use App\Models\Generation;
 use App\Models\LinkClick;
 use App\Models\LinkedinReplyDraft;
+use App\Models\NetworkConnection;
+use App\Models\NetworkProgram;
 use App\Models\Offer;
 use App\Models\Plan;
 use App\Models\Referral;
@@ -22,6 +27,9 @@
 use App\Models\TrackedLink;
 use App\Models\User;
 use App\Models\WebhookEndpoint;
+use App\Models\WordpressDelivery;
+use App\Models\WordpressSite;
+use App\Services\Marketplace\AddonInstaller;
 use Illuminate\Console\Attributes\Description;
 use Illuminate\Console\Attributes\Signature;
 use Illuminate\Console\Command;
@@ -49,6 +57,9 @@ class SeedDemoData extends Command
 
     public const PASSWORD = 'demo-password';
 
+    /** The demo add-on developer (feature 7). */
+    protected const DEVELOPER_EMAIL = 'dev@demo-dev.affilstack.test';
+
     public function handle(): int
     {
         if (app()->isProduction()) {
@@ -80,6 +91,9 @@ public function handle(): int
             $this->team($ada, $notion, $hostinger);
             $this->integrations($ada);
             $this->referrals($ada);
+            $this->networks($ada, $notion, $hostinger);
+            $this->wordpress($ada);
+            $this->marketplace($ada);
         });
 
         $this->info('Demo customer ready: '.self::EMAIL.' / '.self::PASSWORD);
@@ -91,6 +105,7 @@ protected function wipe(): void
     {
         $ids = User::withTrashed()->where('email', self::EMAIL)->pluck('id');
         $ids = $ids->merge(User::withTrashed()->whereIn('agency_owner_id', $ids)->pluck('id'))
+            ->merge(User::withTrashed()->where('email', self::DEVELOPER_EMAIL)->pluck('id'))
             ->merge(User::withTrashed()->where('email', 'like', '%@demo-referral.affilstack.test')->pluck('id'));
 
         if ($ids->isEmpty()) {
@@ -112,6 +127,12 @@ protected function wipe(): void
             CrmList::whereIn('user_id', $ids)->delete();
             CrmContact::whereIn('id', $contactIds)->delete();
             Earning::whereIn('user_id', $ids)->delete();
+            AddonInstall::whereIn('user_id', $ids)->delete();
+            Addon::whereIn('developer_profile_id', DeveloperProfile::whereIn('user_id', $ids)->pluck('id'))->each(fn (Addon $addon) => $addon->forceFill(['live_version_id' => null])->save());
+            Addon::whereIn('developer_profile_id', DeveloperProfile::whereIn('user_id', $ids)->pluck('id'))->delete();
+            DeveloperProfile::whereIn('user_id', $ids)->delete();
+            WordpressSite::whereIn('user_id', $ids)->delete();
+            NetworkConnection::whereIn('user_id', $ids)->delete();
             TrackedLink::whereIn('id', $linkIds)->delete();
             LinkedinReplyDraft::whereIn('user_id', $ids)->delete();
             Generation::whereIn('user_id', $ids)->delete();
@@ -804,6 +825,175 @@ protected function referrals(User $ada): void
      * @param  array<string, mixed>  $input
      * @param  array<string, mixed>  $extra
      */
+    /**
+     * Feature 5: three connected affiliate networks, their programs, and
+     * commissions imported from them.
+     */
+    protected function networks(User $ada, Offer $notion, Offer $hostinger): void
+    {
+        $connections = [];
+
+        foreach ([['impact', 'IR-4471-AdaOkafor', 'Ada Okafor Media', 2], ['partnerstack', 'ps_ada_okafor', 'Ada Okafor', 5], ['awin', '1189234', 'Okafor Reviews', 9]] as [$network, $accountId, $accountName, $hoursAgo]) {
+            $connections[$network] = NetworkConnection::forceCreate([
+                'user_id' => $ada->id,
+                'network' => $network,
+                'credentials' => ['demo' => true],
+                'account_id' => $accountId,
+                'account_name' => $accountName,
+                'status' => 'connected',
+                'last_synced_at' => now()->subHours($hoursAgo),
+                'programs_synced_at' => now()->subHours($hoursAgo),
+                'last_sync_new' => [3, 2, 1][count($connections)],
+                'last_sync_updated' => [5, 1, 0][count($connections)],
+            ]);
+        }
+
+        $programs = [
+            ['impact', 'Hostinger', 'Hostinger International', 'joined', 'Web hosting', '60% per sale', 'https://www.hostinger.com'],
+            ['impact', 'Canva', 'Canva Pty Ltd', 'joined', 'Design', '$36 per Pro sign-up', 'https://www.canva.com'],
+            ['impact', 'Semrush', 'Semrush Inc.', 'available', 'Marketing software', '$200 per sale', 'https://www.semrush.com'],
+            ['impact', 'Shopify', 'Shopify Inc.', 'pending', 'E-commerce', '$150 per paid store', 'https://www.shopify.com'],
+            ['partnerstack', 'Notion', 'Notion Labs', 'joined', 'Productivity', '50% for 12 months', 'https://www.notion.so'],
+            ['partnerstack', 'Monday.com', 'monday.com', 'joined', 'Project management', '100% first year', 'https://monday.com'],
+            ['partnerstack', 'Webflow', 'Webflow Inc.', 'available', 'Website builder', '50% for 12 months', 'https://webflow.com'],
+            ['awin', 'Jumia', 'Jumia Nigeria', 'joined', 'Retail', '6–11% per order', 'https://www.jumia.com.ng'],
+            ['awin', 'Etsy', 'Etsy UK', 'available', 'Retail', '4% per order', 'https://www.etsy.com'],
+        ];
+
+        foreach ($programs as $i => [$network, $name, $advertiser, $status, $category, $commission, $homepage]) {
+            NetworkProgram::forceCreate([
+                'network_connection_id' => $connections[$network]->id,
+                'external_id' => (string) (10000 + $i),
+                'name' => $name,
+                'advertiser_name' => $advertiser,
+                'status' => $status,
+                'homepage_url' => $homepage,
+                'tracking_url' => $status === 'joined' ? $homepage.'/?ref=ada-'.$network : null,
+                'category' => $category,
+                'currency' => 'USD',
+                'commission' => $commission,
+                'description' => $name.' affiliate program on '.ucfirst($network).'.',
+                'deep_linking' => true,
+                'last_seen_at' => now()->subHours(3),
+            ]);
+        }
+
+        Earning::query()->where('user_id', $ada->id)->where('network', '!=', 'manual')->update(['source' => 'network_sync']);
+    }
+
+    /**
+     * Feature 4: a connected WordPress blog with articles sent as drafts.
+     */
+    protected function wordpress(User $ada): void
+    {
+        $site = WordpressSite::forceCreate([
+            'user_id' => $ada->id,
+            'site_url' => 'https://okaforreviews.com',
+            'rest_url' => 'https://okaforreviews.com/wp-json/',
+            'name' => 'Okafor Reviews',
+            'secret' => Str::random(64),
+            'status' => 'connected',
+            'auto_send' => true,
+            'seo_plugin' => 'rank_math',
+            'wp_version' => '6.8.2',
+            'plugin_version' => '1.0.0',
+            'connected_at' => now()->subDays(9),
+            'last_seen_at' => now()->subMinutes(40),
+        ]);
+
+        Generation::query()->where('user_id', $ada->id)->where('module', 'blog_article')->get()->each(function (Generation $generation, int $i) use ($site, $ada) {
+            WordpressDelivery::forceCreate([
+                'wordpress_site_id' => $site->id,
+                'generation_id' => $generation->id,
+                'requested_by_id' => $ada->id,
+                'status' => 'sent',
+                'wp_post_id' => 412 + $i,
+                'wp_post_status' => $i === 0 ? 'publish' : 'draft',
+                'edit_url' => 'https://okaforreviews.com/wp-admin/post.php?post='.(412 + $i).'&action=edit',
+                'preview_url' => 'https://okaforreviews.com/?p='.(412 + $i).'&preview=true',
+                'automatic' => $i > 0,
+                'sent_at' => now()->subDays(4 - $i),
+            ]);
+        });
+    }
+
+    /**
+     * Feature 7: a developer with three approved add-ons; Ada has added
+     * the template pack and the automation recipe.
+     */
+    protected function marketplace(User $ada): void
+    {
+        $developer = User::forceCreate([
+            'name' => 'Tunde Bakare',
+            'email' => self::DEVELOPER_EMAIL,
+            'password' => Hash::make(Str::random(32)),
+            'email_verified_at' => now(),
+            'credits_balance' => 0,
+        ]);
+
+        $profile = DeveloperProfile::forceCreate([
+            'user_id' => $developer->id,
+            'display_name' => 'Northwind Labs',
+            'slug' => 'northwind-labs',
+            'support_email' => 'help@northwind.example',
+            'status' => 'active',
+            'terms_accepted_at' => now()->subDays(20),
+        ]);
+
+        $listings = [
+            ['app', 'rank-watcher', 'Rank Watcher', 'See where your review articles rank on Google, every morning.', 'analytics', 1500, 48, [
+                'install_url' => 'https://rankwatcher.example/connect', 'privacy_url' => 'https://rankwatcher.example/privacy',
+                'redirect_uris' => ['https://rankwatcher.example/callback'], 'scopes' => ['profile:read', 'offers:read', 'content:read'],
+            ]],
+            ['template_pack', 'hook-vault', 'Hook Vault', '120 scroll-stopping hooks for TikTok, Reels and X.', 'content', 900, 131, ['content' => ['items' => [
+                ['kind' => 'hook', 'title' => 'Curiosity hook', 'body' => 'Nobody tells you this about [PRODUCT]…'],
+                ['kind' => 'hook', 'title' => 'Before and after', 'body' => 'I spent [TIME] doing [TASK] by hand. Then I found [PRODUCT].'],
+                ['kind' => 'email', 'title' => 'Cold email: first touch', 'body' => "Hi [NAME],\n\nI noticed you're comparing tools for [PROBLEM]…"],
+                ['kind' => 'post', 'title' => 'LinkedIn: lesson post', 'body' => 'The one thing I wish I knew before recommending [PRODUCT]:'],
+            ]]]],
+            ['automation', 'typeform-leads-to-crm', 'Typeform Leads to CRM', 'Add every new Typeform lead to your AffilStack CRM automatically.', 'automation', 0, 77, ['content' => [
+                'platform' => 'zapier', 'share_url' => 'https://zapier.com/shared/affilstack-typeform',
+                'steps' => "- Open the Zap template\n- Connect Typeform\n- Paste your AffilStack API key\n- Turn it on",
+            ]]],
+        ];
+
+        foreach ($listings as [$type, $slug, $name, $tagline, $category, $price, $installs, $extra]) {
+            $addon = Addon::forceCreate([
+                'developer_profile_id' => $profile->id,
+                'slug' => $slug,
+                'type' => $type,
+                'status' => 'published',
+                'installs_count' => $installs,
+                'is_featured' => $slug === 'hook-vault',
+                'published_at' => now()->subDays(14),
+            ]);
+
+            $version = $addon->versions()->create(array_merge([
+                'version' => '1.0.0',
+                'status' => 'approved',
+                'name' => $name,
+                'tagline' => $tagline,
+                'description' => $tagline."\n\nBuilt by an affiliate marketer for affiliate marketers.\n\n- Works on every AffilStack plan\n- Set up in under five minutes\n- Cancel any time",
+                'category' => $category,
+                'pricing' => $price > 0 ? 'monthly' : 'free',
+                'price_cents' => $price,
+                'reviewed_at' => now()->subDays(14),
+            ], $extra));
+
+            $addon->forceFill(['live_version_id' => $version->id])->save();
+
+            if ($type === 'app') {
+                $addon->issueClientCredentials();
+            }
+
+            if ($type !== 'app') {
+                $install = app(AddonInstaller::class)->install($ada->fresh(), $addon->fresh(), [], 'active');
+                $install->update(['status' => 'active', 'price_cents' => $price, 'current_period_end' => $price > 0 ? now()->addDays(21) : null]);
+                app(AddonInstaller::class)->provision($install->fresh());
+            }
+        }
+    }
+
     protected function generation(User $ada, Offer $offer, string $module, string $output, array $meta, int $daysAgo, array $input = [], ?string $calendarStatus = null, ?int $scheduledInDays = null, array $extra = []): Generation
     {
         $created = now()->subDays($daysAgo)->subHours(random_int(1, 8));
diff --git a/app/Console/Commands/Security/CheckPhpRuntime.php b/app/Console/Commands/Security/CheckPhpRuntime.php
new file mode 100644
index 000000000..015739c01
--- /dev/null
+++ b/app/Console/Commands/Security/CheckPhpRuntime.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Console\Commands\Security;
+
+use App\Support\Security\PhpRuntime;
+use Illuminate\Console\Attributes\Description;
+use Illuminate\Console\Attributes\Signature;
+use Illuminate\Console\Command;
+
+/**
+ * Run on the server during a deploy: fails (exit code 1) when the PHP
+ * running AffilStack is below a critical security fix such as PHP2Shell's,
+ * and shows the website's PHP too once a page has been served.
+ */
+#[Signature('security:check-php')]
+#[Description('Check that the PHP running AffilStack has every critical security fix (PHP2Shell and later)')]
+class CheckPhpRuntime extends Command
+{
+    public function handle(): int
+    {
+        $buildDate = PhpRuntime::buildDate();
+        $rows = [['Command line (cron, deploys)', PHP_VERSION.($buildDate ? " (built {$buildDate})" : '')]];
+        $problems = PhpRuntime::problemsFor(PHP_VERSION, true, $buildDate);
+
+        if ($web = PhpRuntime::webRuntime()) {
+            $rows[] = ['Website', $web['version'].' ('.$web['sapi'].($web['build_date'] ? ', built '.$web['build_date'] : '').', seen '.date('Y-m-d H:i', (int) $web['recorded_at']).' UTC)'];
+            $problems = [...$problems, ...PhpRuntime::problemsFor($web['version'], true, $web['build_date']), ...PhpRuntime::riskyIniProblems($web['ini'] ?? [])];
+        } else {
+            $rows[] = ['Website', 'not seen yet — open any page, then run this again'];
+        }
+
+        $this->table(['PHP', 'Version'], $rows);
+
+        $problems = collect($problems)->unique('title')->values();
+
+        if ($problems->isEmpty()) {
+            $this->info('PHP is up to date with every known security fix.');
+
+            return self::SUCCESS;
+        }
+
+        foreach ($problems as $problem) {
+            $line = '['.strtoupper($problem['severity']).'] '.$problem['title'].' — '.$problem['detail'];
+            in_array($problem['severity'], ['critical', 'high'], true) ? $this->error($line) : $this->warn($line);
+        }
+
+        return $problems->contains('severity', 'critical') ? self::FAILURE : self::SUCCESS;
+    }
+}
diff --git a/app/Filament/Pages/BingWebmasterSettings.php b/app/Filament/Pages/BingWebmasterSettings.php
index 10437b72a..67b71525a 100644
--- a/app/Filament/Pages/BingWebmasterSettings.php
+++ b/app/Filament/Pages/BingWebmasterSettings.php
@@ -6,6 +6,7 @@
 use App\Filament\Concerns\WritesMaskedCredentials;
 use App\Models\BingWebmasterSetting;
 use App\Services\Analytics\BingWebmasterClient;
+use App\Support\Seo\SiteVerificationCode;
 use App\Support\SiteDomains;
 use BackedEnum;
 use Filament\Actions\Action;
@@ -104,7 +105,7 @@ protected function persist(array $data): void
 
         $settings->update([
             'is_enabled' => (bool) ($data['is_enabled'] ?? false),
-            'verification_code' => $data['verification_code'] ?? null,
+            'verification_code' => SiteVerificationCode::normalize($data['verification_code'] ?? null),
             'credentials' => $this->mergeMaskedCredentials($settings->credentials ?? [], [
                 'api_key' => $data['api_key'] ?? null,
             ], ['api_key']),
diff --git a/app/Filament/Pages/FeatureDemoSettings.php b/app/Filament/Pages/FeatureDemoSettings.php
index 7b2e078c4..85ab2abcd 100644
--- a/app/Filament/Pages/FeatureDemoSettings.php
+++ b/app/Filament/Pages/FeatureDemoSettings.php
@@ -10,11 +10,11 @@
 use Filament\Forms\Components\ToggleButtons;
 use Filament\Notifications\Notification;
 use Filament\Pages\Page;
+use Filament\Schemas\Components\Actions;
 use Filament\Schemas\Components\Callout;
 use Filament\Schemas\Components\Grid;
 use Filament\Schemas\Components\Html;
 use Filament\Schemas\Components\Section;
-use Filament\Schemas\Components\Utilities\Get;
 use Filament\Schemas\Schema;
 use Filament\Support\Icons\Heroicon;
 use Illuminate\Support\Facades\Storage;
@@ -48,6 +48,11 @@ class FeatureDemoSettings extends Page
      */
     public ?array $data = [];
 
+    /**
+     * @var array<string, string>|null
+     */
+    protected ?array $uploadedVideos = null;
+
     public function mount(): void
     {
         $this->fillForm();
@@ -80,23 +85,7 @@ protected function card(string $name): Section
             ->description('Used on the homepage and feature pages wherever this screenshot appears.')
             ->compact()
             ->components([
-                Html::make(function (Get $get) use ($name, $key): HtmlString {
-                    $screenshot = e(asset('images/features/'.$name.'.webp'));
-                    $uploaded = $get("video_{$key}");
-                    $uploaded = is_array($uploaded) ? reset($uploaded) : $uploaded;
-                    $videoPath = FeatureMedia::isUploadPath($uploaded) && Storage::disk('public')->exists($uploaded)
-                        ? $uploaded
-                        : FeatureMedia::bundledVideoPath($name);
-
-                    $video = $videoPath
-                        ? '<video src="'.e(Storage::disk('public')->url($videoPath)).'" poster="'.$screenshot.'" muted loop playsinline controls preload="none" style="width:100%;border-radius:8px;border:1px solid rgba(0,0,0,.1)"></video>'
-                        : '<div style="display:flex;align-items:center;justify-content:center;aspect-ratio:16/10;border-radius:8px;border:1px dashed rgba(0,0,0,.2);font-size:12px;color:#6b7280;text-align:center;padding:8px">No animation installed yet</div>';
-
-                    return new HtmlString('<div style="display:grid;grid-template-columns:1fr 1fr;gap:8px">'
-                        .'<figure style="margin:0"><img src="'.$screenshot.'" alt="" loading="lazy" style="width:100%;border-radius:8px;border:1px solid rgba(0,0,0,.1)"><figcaption style="font-size:11px;color:#6b7280;margin-top:4px">Screenshot</figcaption></figure>'
-                        .'<figure style="margin:0">'.$video.'<figcaption style="font-size:11px;color:#6b7280;margin-top:4px">Animation</figcaption></figure>'
-                        .'</div>');
-                }),
+                Html::make(fn (): HtmlString => $this->preview($name)),
                 ToggleButtons::make("choice_{$key}")
                     ->label('Show visitors')
                     ->options([FeatureMedia::SCREENSHOT => 'Screenshot', FeatureMedia::ANIMATION => 'Animation'])
@@ -104,31 +93,111 @@ protected function card(string $name): Section
                     ->default(FeatureMedia::SCREENSHOT)
                     ->inline()
                     ->required(),
-                FileUpload::make("video_{$key}")
-                    ->label('Your own video (optional)')
-                    ->helperText('MP4 or WebM, up to 12 MB, silent. Replaces the built-in animation for this screenshot. Remove it to go back to the built-in one.')
-                    ->disk('public')
-                    ->directory(FeatureMedia::DIRECTORY.'/uploads')
-                    ->acceptedFileTypes(['video/mp4', 'video/webm'])
-                    ->maxSize(12 * 1024)
-                    ->live(),
+                // The upload box lives in a modal, not on the page: 37 inline
+                // upload fields each fired their own request as the page
+                // opened, which ran past the host's database connection limit.
+                Actions::make([
+                    Action::make("upload_{$key}")
+                        ->label(fn (): string => $this->uploadedVideo($name) ? 'Replace my video' : 'Upload my own video')
+                        ->icon(Heroicon::OutlinedArrowUpTray)
+                        ->color('gray')
+                        ->size('sm')
+                        ->modalHeading('Your own video: '.FeatureMedia::label($name))
+                        ->modalDescription('Replaces the built-in animation for this screenshot.')
+                        ->modalSubmitActionLabel('Upload')
+                        ->schema([
+                            FileUpload::make('video')
+                                ->label('Video')
+                                ->helperText('MP4 or WebM, up to 12 MB, silent.')
+                                ->disk('public')
+                                ->directory(FeatureMedia::DIRECTORY.'/uploads')
+                                ->acceptedFileTypes(['video/mp4', 'video/webm'])
+                                ->maxSize(12 * 1024)
+                                ->required(),
+                        ])
+                        ->action(fn (array $data) => $this->storeVideo($name, $data['video'] ?? null)),
+                    Action::make("remove_{$key}")
+                        ->label('Remove my video')
+                        ->icon(Heroicon::OutlinedTrash)
+                        ->color('danger')
+                        ->link()
+                        ->size('sm')
+                        ->visible(fn (): bool => $this->uploadedVideo($name) !== null)
+                        ->requiresConfirmation()
+                        ->modalDescription('This screenshot goes back to its built-in animation.')
+                        ->action(fn () => $this->storeVideo($name, null)),
+                ])->key("actions_{$key}"),
             ]);
     }
 
+    protected function preview(string $name): HtmlString
+    {
+        $screenshot = e(asset('images/features/'.$name.'.webp'));
+        $videoPath = $this->uploadedVideo($name) ?? FeatureMedia::bundledVideoPath($name);
+
+        $video = $videoPath
+            ? '<video src="'.e(Storage::disk('public')->url($videoPath)).'" poster="'.$screenshot.'" muted loop playsinline controls preload="none" style="width:100%;border-radius:8px;border:1px solid rgba(0,0,0,.1)"></video>'
+            : '<div style="display:flex;align-items:center;justify-content:center;aspect-ratio:16/10;border-radius:8px;border:1px dashed rgba(0,0,0,.2);font-size:12px;color:#6b7280;text-align:center;padding:8px">No animation installed yet</div>';
+
+        return new HtmlString('<div style="display:grid;grid-template-columns:1fr 1fr;gap:8px">'
+            .'<figure style="margin:0"><img src="'.$screenshot.'" alt="" loading="lazy" style="width:100%;border-radius:8px;border:1px solid rgba(0,0,0,.1)"><figcaption style="font-size:11px;color:#6b7280;margin-top:4px">Screenshot</figcaption></figure>'
+            .'<figure style="margin:0">'.$video.'<figcaption style="font-size:11px;color:#6b7280;margin-top:4px">Animation</figcaption></figure>'
+            .'</div>');
+    }
+
+    /**
+     * The admin's own video for a screenshot, when one is saved and still on disk.
+     */
+    protected function uploadedVideo(string $name): ?string
+    {
+        $this->uploadedVideos ??= FeatureMedia::uploadedVideos();
+        $path = $this->uploadedVideos[$name] ?? null;
+
+        return FeatureMedia::isUploadPath($path) && Storage::disk('public')->exists($path) ? $path : null;
+    }
+
+    /**
+     * Saves (or, with null, removes) the admin's own video for one
+     * screenshot straight away, deleting the file it replaces.
+     */
+    protected function storeVideo(string $name, mixed $path): void
+    {
+        $path = is_array($path) ? reset($path) : $path;
+        $videos = FeatureMedia::uploadedVideos();
+        $previous = $videos[$name] ?? null;
+
+        if (is_string($path) && FeatureMedia::isUploadPath($path)) {
+            $videos[$name] = $path;
+        } else {
+            unset($videos[$name]);
+        }
+
+        FeatureMedia::save(FeatureMedia::choices(), $videos);
+        $this->uploadedVideos = null;
+
+        if (FeatureMedia::isUploadPath($previous) && $previous !== ($videos[$name] ?? null)) {
+            Storage::disk('public')->delete($previous);
+        }
+
+        Notification::make()
+            ->title(isset($videos[$name]) ? 'Video uploaded' : 'Video removed')
+            ->body(isset($videos[$name])
+                ? 'Visitors see it wherever this screenshot is set to "Animation".'
+                : 'This screenshot uses its built-in animation again.')
+            ->success()
+            ->send();
+    }
+
     public function save(): void
     {
         $data = $this->form->getState();
         $choices = [];
-        $videos = [];
 
         foreach (FeatureMedia::names() as $name) {
-            $key = self::key($name);
-            $choices[$name] = (string) ($data["choice_{$key}"] ?? FeatureMedia::SCREENSHOT);
-            $video = $data["video_{$key}"] ?? null;
-            $videos[$name] = is_string($video) ? $video : null;
+            $choices[$name] = (string) ($data['choice_'.self::key($name)] ?? FeatureMedia::SCREENSHOT);
         }
 
-        FeatureMedia::save($choices, $videos);
+        FeatureMedia::save($choices, FeatureMedia::uploadedVideos());
 
         $missing = collect($choices)
             ->filter(fn (string $choice, string $name): bool => $choice === FeatureMedia::ANIMATION && FeatureMedia::videoPaths($name) === [])
@@ -190,13 +259,10 @@ protected function setEverywhere(string $choice): void
     protected function fillForm(): void
     {
         $choices = FeatureMedia::choices();
-        $videos = FeatureMedia::uploadedVideos();
         $state = [];
 
         foreach (FeatureMedia::names() as $name) {
-            $key = self::key($name);
-            $state["choice_{$key}"] = ($choices[$name] ?? null) === FeatureMedia::ANIMATION ? FeatureMedia::ANIMATION : FeatureMedia::SCREENSHOT;
-            $state["video_{$key}"] = $videos[$name] ?? null;
+            $state['choice_'.self::key($name)] = ($choices[$name] ?? null) === FeatureMedia::ANIMATION ? FeatureMedia::ANIMATION : FeatureMedia::SCREENSHOT;
         }
 
         $this->form->fill($state);
diff --git a/app/Filament/Pages/GitHubSyncSettings.php b/app/Filament/Pages/GitHubSyncSettings.php
index 65497a4d1..60d1b6a1a 100644
--- a/app/Filament/Pages/GitHubSyncSettings.php
+++ b/app/Filament/Pages/GitHubSyncSettings.php
@@ -2,6 +2,7 @@
 
 namespace App\Filament\Pages;
 
+use App\Jobs\RunGitHubSync;
 use App\Models\GitHubSyncRun;
 use App\Models\GitHubSyncSetting;
 use App\Services\GitHub\GitHubSyncService;
@@ -196,26 +197,21 @@ public function verifyConnection(GitHubSyncService $service): void
             ->send();
     }
 
-    public function syncNow(GitHubSyncService $service): void
+    /**
+     * Runs in the background worker rather than this request, so the
+     * website never needs proc_open (see RunGitHubSync). The result shows on
+     * this page once it finishes.
+     */
+    public function syncNow(): void
     {
         $this->persist($this->form->getState());
-        $settings = GitHubSyncSetting::current();
 
-        $run = $service->sync($settings, GitHubSyncRun::TRIGGER_MANUAL);
+        RunGitHubSync::dispatch(GitHubSyncRun::TRIGGER_MANUAL);
 
         Notification::make()
-            ->title(match ($run->status) {
-                GitHubSyncRun::STATUS_SUCCESS => 'Sync complete',
-                GitHubSyncRun::STATUS_BLOCKED => 'Sync refused',
-                default => 'Sync failed',
-            })
-            ->body($run->message)
-            ->status(match ($run->status) {
-                GitHubSyncRun::STATUS_SUCCESS => 'success',
-                GitHubSyncRun::STATUS_BLOCKED => 'warning',
-                default => 'danger',
-            })
-            ->persistent()
+            ->title('Sync started')
+            ->body('It runs in the background and usually takes under a minute. Refresh this page to see the result.')
+            ->info()
             ->send();
     }
 
@@ -261,7 +257,7 @@ protected function getHeaderActions(): array
                 ->icon(Heroicon::OutlinedArrowPath)
                 ->requiresConfirmation()
                 ->modalDescription('This commits and pushes any pending changes in this application\'s own working copy to the connected GitHub repository right now.')
-                ->action(fn (GitHubSyncService $service) => $this->syncNow($service)),
+                ->action(fn () => $this->syncNow()),
             Action::make('explain')
                 ->label('Explain with AI')
                 ->color('gray')
diff --git a/app/Filament/Pages/SeoSettings.php b/app/Filament/Pages/SeoSettings.php
index 366dd5bf8..90a72afff 100644
--- a/app/Filament/Pages/SeoSettings.php
+++ b/app/Filament/Pages/SeoSettings.php
@@ -7,6 +7,7 @@
 use App\Models\SiteSetting;
 use App\Services\Seo\SeoHeadBuilder;
 use App\Support\Seo\RobotsTxt;
+use App\Support\Seo\SiteVerificationCode;
 use BackedEnum;
 use Filament\Actions\Action;
 use Filament\Forms\Components\Textarea;
@@ -193,6 +194,8 @@ public function save(): void
             $data['seo_twitter_handle'] = ltrim((string) $data['seo_twitter_handle'], '@');
         }
 
+        $data['seo_gsc_verification'] = SiteVerificationCode::normalize($data['seo_gsc_verification'] ?? null);
+
         foreach ($data as $key => $value) {
             SiteSetting::set($key, $value);
         }
diff --git a/app/Http/Controllers/BillingController.php b/app/Http/Controllers/BillingController.php
index e8adb19fb..9714a1d7e 100644
--- a/app/Http/Controllers/BillingController.php
+++ b/app/Http/Controllers/BillingController.php
@@ -247,7 +247,7 @@ public function callback(Request $request, PaymentGatewayManager $gateways, Paym
             if ($transaction->type === 'addon_subscription' && $transaction->addonInstall) {
                 $return = $request->session()->pull('addon_return');
 
-                return redirect()->to(is_string($return) && str_starts_with($return, url('/')) ? $return : route('addons.show', $transaction->addonInstall))
+                return redirect()->to(is_string($return) && str_starts_with($return, route('oauth.authorize').'?') ? $return : route('addons.show', $transaction->addonInstall))
                     ->with('success', 'Payment received — your add-on is active.');
             }
 
diff --git a/app/Http/Controllers/NotificationController.php b/app/Http/Controllers/NotificationController.php
index 437552097..d3e3fb984 100644
--- a/app/Http/Controllers/NotificationController.php
+++ b/app/Http/Controllers/NotificationController.php
@@ -55,6 +55,7 @@ protected function messageFor(array $data): string
                 'ticket_status_changed' => 'Your ticket was '.(($data['status'] ?? 'resolved') === 'closed' ? 'closed' : 'marked resolved').': '.($data['subject'] ?? ''),
                 'referral_payout_processed' => 'Your referral payout of $'.number_format(($data['amount_cents'] ?? 0) / 100, 2).' was sent',
                 'referral_payout_rejected' => 'Your referral payout request needs attention',
+                'security_alert', 'funding_alert' => (string) ($data['title'] ?? 'Update from AffilStack'),
                 default => $data['reason'] ?? 'Update from AffilStack',
             };
         }
diff --git a/app/Http/Controllers/SeoController.php b/app/Http/Controllers/SeoController.php
index fab903c15..66e1f095d 100644
--- a/app/Http/Controllers/SeoController.php
+++ b/app/Http/Controllers/SeoController.php
@@ -2,6 +2,7 @@
 
 namespace App\Http\Controllers;
 
+use App\Models\Addon;
 use App\Models\FaqItem;
 use App\Models\FeaturePage;
 use App\Models\PageSeo;
@@ -73,6 +74,13 @@ public function sitemap(): Response
             $urls[] = ['loc' => $featurePage->url(), 'priority' => '0.7', 'lastmod' => $featurePage->updated_at?->toAtomString()];
         }
 
+        // Feature 7: every add-on listed in the public marketplace.
+        if (PublicPages::isLive('marketplace.index')) {
+            foreach (Addon::query()->listed()->get(['slug', 'updated_at']) as $addon) {
+                $urls[] = ['loc' => route('marketplace.show', $addon), 'priority' => '0.5', 'lastmod' => $addon->updated_at?->toAtomString()];
+            }
+        }
+
         if ($blogUrl = SiteSetting::get('seo_blog_url')) {
             $urls[] = ['loc' => rtrim($blogUrl, '/'), 'priority' => '0.8'];
         }
diff --git a/app/Http/Middleware/RecordPhpRuntime.php b/app/Http/Middleware/RecordPhpRuntime.php
new file mode 100644
index 000000000..643afdb8b
--- /dev/null
+++ b/app/Http/Middleware/RecordPhpRuntime.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Support\Security\PhpRuntime;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Notes which PHP version the website is served with, so the daily
+ * security scan checks the PHP visitors actually reach — on Hostinger the
+ * cron's command-line PHP can be a different build. Runs after the
+ * response is sent, and only writes when something changed.
+ */
+class RecordPhpRuntime
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        return $next($request);
+    }
+
+    public function terminate(Request $request, Response $response): void
+    {
+        if (app()->runningInConsole()) {
+            return;
+        }
+
+        PhpRuntime::recordCurrent();
+    }
+}
diff --git a/app/Http/Middleware/RejectExecutableUploads.php b/app/Http/Middleware/RejectExecutableUploads.php
new file mode 100644
index 000000000..a11f7d87c
--- /dev/null
+++ b/app/Http/Middleware/RejectExecutableUploads.php
@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Support\Security\ExecutableFileDetector;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Http\UploadedFile;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Turns away any upload that is, or carries, server-side code: a .php (or
+ * similar) name, a server config file such as .htaccess, a file the server
+ * would treat as PHP, or PHP code hidden inside an otherwise ordinary file
+ * (a "polyglot" image). AffilStack never needs one, and a web shell is
+ * exactly what an attacker uploads to keep control of a server. Every form
+ * and API route goes through this, so future upload fields are covered
+ * without anyone remembering to.
+ */
+class RejectExecutableUploads
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        foreach ($this->files($request->allFiles()) as $file) {
+            if ($this->isExecutable($file)) {
+                $message = 'That file type can\'t be uploaded. Upload an image, document or data file instead.';
+
+                return $request->expectsJson() || ! $request->hasSession()
+                    ? response()->json(['message' => $message, 'errors' => ['file' => [$message]]], 422)
+                    : back()->withErrors(['file' => $message])->withInput($request->except(array_keys($request->allFiles())));
+            }
+        }
+
+        return $next($request);
+    }
+
+    public function isExecutable(UploadedFile $file): bool
+    {
+        if (ExecutableFileDetector::nameIsExecutable($file->getClientOriginalName())) {
+            return true;
+        }
+
+        if (ExecutableFileDetector::extensionIsExecutable($file->guessExtension())) {
+            return true;
+        }
+
+        $path = $file->getRealPath();
+
+        return $path !== false && ExecutableFileDetector::containsPhp($path);
+    }
+
+    /**
+     * @param  array<mixed>  $files
+     * @return iterable<UploadedFile>
+     */
+    protected function files(array $files): iterable
+    {
+        foreach ($files as $file) {
+            if ($file instanceof UploadedFile) {
+                yield $file;
+            } elseif (is_array($file)) {
+                yield from $this->files($file);
+            }
+        }
+    }
+}
diff --git a/app/Jobs/RunGitHubSync.php b/app/Jobs/RunGitHubSync.php
new file mode 100644
index 000000000..1b2106867
--- /dev/null
+++ b/app/Jobs/RunGitHubSync.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\GitHubSyncRun;
+use App\Models\GitHubSyncSetting;
+use App\Services\GitHub\GitHubSyncService;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+
+/**
+ * "Sync now" from the GitHub Sync page. Git runs as a separate program,
+ * which needs PHP's proc_open; doing it in the background worker (whose cron
+ * lifts Hostinger's function limits for the command line only) lets the
+ * website itself keep proc_open switched off — so a web shell, if one ever
+ * got in, couldn't start programs either.
+ */
+class RunGitHubSync implements ShouldBeUnique, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable;
+
+    public int $tries = 1;
+
+    public int $timeout = 300;
+
+    public int $uniqueFor = 600;
+
+    public function __construct(public string $trigger = GitHubSyncRun::TRIGGER_MANUAL) {}
+
+    public function handle(GitHubSyncService $service): void
+    {
+        $service->sync(GitHubSyncSetting::current(), $this->trigger);
+    }
+}
diff --git a/app/Notifications/SecurityAlert.php b/app/Notifications/SecurityAlert.php
new file mode 100644
index 000000000..02933aefa
--- /dev/null
+++ b/app/Notifications/SecurityAlert.php
@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Notifications;
+
+use App\Models\SecurityFinding;
+use Illuminate\Bus\Queueable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+/**
+ * Sent to the admins by Tom, the Security Agent, the moment his daily scan
+ * finds something new that is critical or high — an unpatched PHP such as
+ * one open to PHP2Shell, or a possible web shell — so it doesn't wait for
+ * someone to open the Security Center.
+ */
+class SecurityAlert extends Notification
+{
+    use Queueable;
+
+    /**
+     * @param  array<int, SecurityFinding>  $findings
+     */
+    public function __construct(public array $findings) {}
+
+    /**
+     * @return array<int, string>
+     */
+    public function via(object $notifiable): array
+    {
+        return ['database', 'mail'];
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $mail = (new MailMessage)
+            ->subject($this->headline())
+            ->line('Tom, the Security Agent, found '.(count($this->findings) === 1 ? 'something that needs' : 'things that need').' your attention:');
+
+        foreach ($this->findings as $finding) {
+            $mail->line('• ['.strtoupper($finding->severity).'] '.$finding->title);
+
+            if (is_string($finding->evidence['what_to_do'] ?? null)) {
+                $mail->line($finding->evidence['what_to_do']);
+            }
+        }
+
+        return $mail->action('Open the Security Center', $this->url());
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(object $notifiable): array
+    {
+        return [
+            'type' => 'security_alert',
+            'title' => $this->headline(),
+            'findings' => array_map(fn (SecurityFinding $finding) => ['id' => $finding->id, 'severity' => $finding->severity, 'title' => $finding->title], $this->findings),
+            'url' => $this->url(),
+        ];
+    }
+
+    protected function headline(): string
+    {
+        return count($this->findings) === 1
+            ? 'Security alert: '.$this->findings[0]->title
+            : 'Security alert: '.count($this->findings).' new issues need attention';
+    }
+
+    protected function url(): string
+    {
+        return route('filament.admin.resources.security-findings.index');
+    }
+}
diff --git a/app/Providers/Filament/AdminPanelProvider.php b/app/Providers/Filament/AdminPanelProvider.php
index 659c7550a..abc63f111 100644
--- a/app/Providers/Filament/AdminPanelProvider.php
+++ b/app/Providers/Filament/AdminPanelProvider.php
@@ -9,6 +9,7 @@
 use App\Models\SiteSetting;
 use App\Services\Seo\FaviconGenerator;
 use App\Support\Brand;
+use App\Support\Security\PhpRuntime;
 use App\Support\SiteDomains;
 use Filament\Auth\MultiFactor\App\AppAuthentication;
 use Filament\Http\Middleware\Authenticate;
@@ -56,6 +57,9 @@ public function panel(Panel $panel): Panel
             ->databaseNotifications()
             // Brand Settings: preview the white logo uploads on a dark panel.
             ->renderHook(PanelsRenderHook::STYLES_AFTER, fn (): string => '<style>.affil-dark-preview .filepond--panel-root,.affil-dark-preview .filepond--image-preview{background:#0B1E3D!important}.affil-dark-preview .filepond--drop-label{color:#fff}</style>')
+            // PHP2Shell: a red bar on every admin page while the website's
+            // PHP is below a critical security fix (see PhpRuntime).
+            ->renderHook(PanelsRenderHook::CONTENT_START, fn (): string => PhpRuntime::webIsCriticallyVulnerable() ? view('filament.security.php-runtime-banner', ['web' => PhpRuntime::webRuntime()])->render() : '')
             ->colors([
                 'primary' => Color::hex('#2452D9'), // brand blue
                 'gray' => Color::hex('#0B1E3D'),     // navy-tinted neutrals
diff --git a/app/Services/Agents/SecurityScanService.php b/app/Services/Agents/SecurityScanService.php
index 2834057b7..461b08f18 100644
--- a/app/Services/Agents/SecurityScanService.php
+++ b/app/Services/Agents/SecurityScanService.php
@@ -4,12 +4,16 @@
 
 use App\Models\SecurityFinding;
 use App\Models\User;
+use App\Notifications\SecurityAlert;
 use App\Services\AI\AIGenerationException;
 use App\Services\AI\AIProvider;
+use App\Support\Security\ExecutableFileDetector;
+use App\Support\Security\PhpRuntime;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Notification;
 use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Str;
@@ -89,9 +93,157 @@ public function scan(): Collection
             ...$this->checkAdminsMissingTwoFactor(),
             ...$this->checkUnencryptedSecretColumns(),
             ...$this->checkAiPromptCredentialInterpolation(),
+            ...$this->checkPhpRuntime(),
+            ...$this->checkExecutableFiles(),
         ]);
 
-        return $rawFindings->map(fn (array $raw) => $this->persist($raw));
+        $this->resolveCleared('php_runtime', $rawFindings);
+        $this->resolveCleared('web_shell', $rawFindings);
+
+        $findings = $rawFindings->map(fn (array $raw) => $this->persist($raw));
+
+        $this->alertAdmins($findings->filter(fn (SecurityFinding $finding) => $finding->wasRecentlyCreated && in_array($finding->severity, ['critical', 'high'], true)));
+
+        return $findings;
+    }
+
+    /**
+     * PHP2Shell and anything like it: the PHP that serves the website (as
+     * recorded by RecordPhpRuntime) and the PHP that runs the scheduler,
+     * checked against known critical fixes and php.net's newest release,
+     * plus the php.ini settings PHP2Shell reaches through. The host has to
+     * update PHP, so there is no automatic fix_action.
+     *
+     * @return array<int, array<string, mixed>>
+     */
+    protected function checkPhpRuntime(): array
+    {
+        $runtimes = ['scheduler (command line)' => ['version' => PHP_VERSION, 'sapi' => PHP_SAPI, 'build_date' => PhpRuntime::buildDate(), 'ini' => []]];
+
+        if ($web = PhpRuntime::webRuntime()) {
+            $runtimes = ['website' => $web] + $runtimes;
+        }
+
+        $findings = [];
+        $seen = [];
+
+        foreach ($runtimes as $label => $runtime) {
+            $problems = [...PhpRuntime::problemsFor($runtime['version'], true, $runtime['build_date'] ?? null), ...PhpRuntime::riskyIniProblems($runtime['ini'] ?? [])];
+
+            foreach ($problems as $problem) {
+                // The same version on both: one finding naming both.
+                if (isset($seen[$problem['title']])) {
+                    $findings[$seen[$problem['title']]]['evidence']['where'][] = $label;
+
+                    continue;
+                }
+
+                $seen[$problem['title']] = count($findings);
+                $findings[] = [
+                    'category' => 'php_runtime',
+                    'title' => $problem['title'],
+                    'severity' => $problem['severity'],
+                    'evidence' => ['where' => [$label], 'php_version' => $runtime['version'], 'php_build_date' => $runtime['build_date'] ?? null, 'php_sapi' => $runtime['sapi'], 'what_to_do' => $problem['detail']],
+                    'fix_action' => null,
+                ];
+            }
+        }
+
+        return $findings;
+    }
+
+    /**
+     * Web shells: PHP (or a server config file that could switch PHP back
+     * on) anywhere in the public folder or the upload folders, where only
+     * public/index.php and public/.htaccess belong, and PHP code hidden in
+     * a publicly served upload.
+     *
+     * @return array<int, array<string, mixed>>
+     */
+    protected function checkExecutableFiles(): array
+    {
+        $allowed = (array) config('security.executable_allowlist', []);
+        $suspicious = [];
+
+        foreach ((array) config('security.executable_scan_paths', []) as $relative) {
+            $root = base_path($relative);
+
+            if (! is_dir($root)) {
+                continue;
+            }
+
+            $files = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($root, \FilesystemIterator::SKIP_DOTS));
+
+            foreach ($files as $file) {
+                if (! $file->isFile()) {
+                    continue;
+                }
+
+                $path = str_replace('\\', '/', Str::after($file->getPathname(), base_path().DIRECTORY_SEPARATOR));
+
+                if (in_array($path, $allowed, true) || str_starts_with($path, 'public/build/')) {
+                    continue;
+                }
+
+                if (ExecutableFileDetector::nameIsExecutable($file->getFilename())) {
+                    $suspicious[] = $path;
+                } elseif (str_starts_with($path, 'storage/app/public/') && ExecutableFileDetector::containsPhp($file->getPathname(), 10 * 1024 * 1024)) {
+                    $suspicious[] = $path.' (PHP code inside)';
+                }
+
+                if (count($suspicious) >= 50) {
+                    break 2;
+                }
+            }
+        }
+
+        if ($suspicious === []) {
+            return [];
+        }
+
+        return [[
+            'category' => 'web_shell',
+            'title' => 'Possible web shell: PHP or server config files where none should be',
+            'severity' => 'critical',
+            'evidence' => ['files' => $suspicious, 'what_to_do' => 'AffilStack never puts these files there. Check each one in hPanel → File Manager, delete anything you did not add, change your hosting and admin passwords, and check the server for other changes (new cron jobs, new admin accounts).'],
+            'fix_action' => null,
+        ]];
+    }
+
+    /**
+     * A runtime problem the scan no longer sees (PHP was updated, the
+     * file was removed) is marked fixed instead of lingering as open.
+     *
+     * @param  Collection<int, array<string, mixed>>  $raw
+     */
+    protected function resolveCleared(string $category, Collection $raw): void
+    {
+        $current = $raw->where('category', $category)->map(fn (array $finding) => sha1($finding['category'].'|'.$finding['title']))->all();
+
+        SecurityFinding::query()
+            ->where('category', $category)
+            ->where('status', SecurityFinding::STATUS_OPEN)
+            ->whereNotIn('fingerprint', $current)
+            ->update(['status' => SecurityFinding::STATUS_FIXED]);
+    }
+
+    /**
+     * New critical and high findings are emailed to the admins straight
+     * away rather than waiting for someone to open the Security Center.
+     *
+     * @param  Collection<int, SecurityFinding>  $findings
+     */
+    protected function alertAdmins(Collection $findings): void
+    {
+        if ($findings->isEmpty()) {
+            return;
+        }
+
+        $admins = User::role(['admin', 'super-admin'])->get();
+
+        if ($admins->isNotEmpty()) {
+            Notification::send($admins, new SecurityAlert($findings->values()->all()));
+        }
     }
 
     protected function persist(array $raw): SecurityFinding
diff --git a/app/Services/Analytics/GoogleSiteAnalyticsService.php b/app/Services/Analytics/GoogleSiteAnalyticsService.php
index 58cfebc83..3450ef264 100644
--- a/app/Services/Analytics/GoogleSiteAnalyticsService.php
+++ b/app/Services/Analytics/GoogleSiteAnalyticsService.php
@@ -5,7 +5,9 @@
 use App\Models\GoogleOauthSetting;
 use App\Models\GoogleSiteAnalyticsSetting;
 use App\Models\SiteSetting;
+use App\Support\Seo\SiteVerificationCode;
 use App\Support\SiteDomains;
+use Illuminate\Http\Client\Response;
 use Illuminate\Support\Facades\Http;
 use RuntimeException;
 
@@ -56,9 +58,18 @@ class GoogleSiteAnalyticsService
     protected const SCOPE = 'openid email '.
         'https://www.googleapis.com/auth/analytics.edit '.
         'https://www.googleapis.com/auth/webmasters '.
+        // Search Console's "webmasters" scope doesn't cover the separate Site
+        // Verification API, which issues and checks the homepage meta tag.
+        'https://www.googleapis.com/auth/siteverification.verify_only '.
         'https://www.googleapis.com/auth/tagmanager.edit.containers '.
         'https://www.googleapis.com/auth/tagmanager.publish';
 
+    /**
+     * Shown when a connection made before a scope was added to SCOPE is
+     * used for a step that needs the new scope.
+     */
+    public const RECONNECT_MESSAGE = 'Your Google connection is missing a permission AffilStack now needs. Click "Reconnect with Google" at the top of this page, tick every box on Google\'s screen, then try again.';
+
     protected GoogleOauthSetting $oauthSettings;
 
     public function __construct()
@@ -269,10 +280,13 @@ public function verifySearchConsole(): array
             'site' => ['type' => 'SITE', 'identifier' => $siteUrl],
         ]);
 
-        $verificationToken = $tokenResponse->json('token');
+        // Google returns the whole <meta> tag here; only its content value is stored.
+        $verificationToken = SiteVerificationCode::normalize($tokenResponse->json('token'));
 
         if ($tokenResponse->failed() || ! $verificationToken) {
-            return ['success' => false, 'message' => 'Could not get a verification token from Google: '.$tokenResponse->body()];
+            return ['success' => false, 'message' => self::isMissingScope($tokenResponse)
+                ? self::RECONNECT_MESSAGE
+                : 'Could not get a verification token from Google: '.$tokenResponse->body()];
         }
 
         // Renders immediately via the existing <meta name="google-site-
@@ -286,13 +300,19 @@ public function verifySearchConsole(): array
         ]);
 
         if ($insert->failed()) {
+            $reason = (string) ($insert->json('error.message') ?? '');
+
             return [
                 'success' => false,
-                'message' => "The verification tag is saved and live on your homepage, but Google couldn't confirm it yet — this usually means the site isn't publicly reachable at {$siteUrl} right now. Once it's deployed and live, click this again.",
+                'message' => "The verification tag is saved on your homepage, but Google couldn't confirm it yet. Wait a minute and click this again; if it still fails, check that {$siteUrl} opens publicly.".($reason !== '' ? " Google said: {$reason}" : ''),
             ];
         }
 
-        $addSite = Http::withToken($token)->put(self::SEARCH_CONSOLE_ENDPOINT.'/sites/'.rawurlencode($siteUrl));
+        // These Search Console calls take no request body. Laravel would send
+        // an empty JSON array ("[]"), which Google rejects with "Root element
+        // must be a message", so an empty JSON object is sent instead.
+        $addSite = Http::withToken($token)->withBody('{}', 'application/json')
+            ->put(self::SEARCH_CONSOLE_ENDPOINT.'/sites/'.rawurlencode($siteUrl));
 
         if ($addSite->failed() && $addSite->status() !== 409) {
             // 409 = already added, which is fine — anything else is a real failure.
@@ -300,7 +320,7 @@ public function verifySearchConsole(): array
         }
 
         $sitemapUrl = rtrim(SiteDomains::publicUrl(), '/').'/sitemap.xml';
-        Http::withToken($token)->put(
+        $sitemap = Http::withToken($token)->withBody('{}', 'application/json')->put(
             self::SEARCH_CONSOLE_ENDPOINT.'/sites/'.rawurlencode($siteUrl).'/sitemaps/'.rawurlencode($sitemapUrl)
         );
 
@@ -308,6 +328,12 @@ public function verifySearchConsole(): array
             'credentials' => [...$settings->credentialsArray(), 'gsc_site_url' => $siteUrl, 'gsc_verified_at' => now()->toIso8601String()],
         ]);
 
+        if ($sitemap->failed()) {
+            $reason = (string) ($sitemap->json('error.message') ?? $sitemap->body());
+
+            return ['success' => true, 'message' => "Search Console verified for {$siteUrl}, but Google didn't accept the sitemap yet ({$reason}). Use Re-submit sitemap later, or add {$sitemapUrl} under Sitemaps in Search Console."];
+        }
+
         return ['success' => true, 'message' => "Search Console verified for {$siteUrl} and the sitemap was submitted."];
     }
 
@@ -371,4 +397,13 @@ public function disconnect(): void
             'connected_at' => null,
         ]);
     }
+
+    /**
+     * Google answers 403 ACCESS_TOKEN_SCOPE_INSUFFICIENT when the stored token
+     * was granted before a scope was added; only a reconnect fixes it.
+     */
+    protected static function isMissingScope(Response $response): bool
+    {
+        return $response->status() === 403 && str_contains($response->body(), 'ACCESS_TOKEN_SCOPE_INSUFFICIENT');
+    }
 }
diff --git a/app/Services/Payments/PayPalGateway.php b/app/Services/Payments/PayPalGateway.php
index 7c13b87e4..d0176c031 100644
--- a/app/Services/Payments/PayPalGateway.php
+++ b/app/Services/Payments/PayPalGateway.php
@@ -361,7 +361,9 @@ protected function captureOrder(string $orderId): array
             return $existing->json();
         }
 
-        $response = $this->client()->post("/v2/checkout/orders/{$orderId}/capture");
+        // Capture takes no body; send "{}" rather than Laravel's default "[]",
+        // which PayPal can reject as malformed JSON.
+        $response = $this->client()->withBody('{}', 'application/json')->post("/v2/checkout/orders/{$orderId}/capture");
 
         if ($response->failed()) {
             throw new RuntimeException('PayPal order capture failed: '.$response->body());
diff --git a/app/Support/Features/FeatureCatalog.php b/app/Support/Features/FeatureCatalog.php
index 1fa49196b..aac9ebb25 100644
--- a/app/Support/Features/FeatureCatalog.php
+++ b/app/Support/Features/FeatureCatalog.php
@@ -613,6 +613,164 @@ public static function all(): array
                 'cta_heading' => 'Automate your affiliate workflow',
                 'cta_text' => 'API access is available on every plan.',
             ],
+            [
+                'slug' => 'affiliate-networks',
+                'name' => 'Affiliate Network Connections',
+                'icon' => 'arrows-right-left',
+                'menu_group' => 'grow',
+                'menu_description' => 'Impact, PartnerStack, Awin, CJ, ClickBank and Digistore24.',
+                'hero_eyebrow' => 'Affiliate networks',
+                'hero_headline' => 'Your networks, programs and commissions *in one place*',
+                'hero_subheadline' => 'Connect Impact, PartnerStack, Awin, CJ, ClickBank or Digistore24 once. AffilStack brings in the programs you\'ve joined, turns any of them into a researched product with its tracked link, and imports your commissions into Earnings every day.',
+                'hero_default_image' => 'affiliate-networks.webp',
+                'hero_image_alt' => 'The Affiliate Networks page with Impact, PartnerStack and Awin connected',
+                'sections' => [
+                    [
+                        'heading' => 'Programs become products in one click',
+                        'body' => 'Browse the programs on each network, see which ones you\'ve joined, and add any of them as a product. AffilStack researches it like any other product and uses the network\'s tracked link — deep-linked to the product page where the program allows it.',
+                        'bullets' => ['Joined, pending and available programs side by side', 'Tracked links made for you', 'Switch an existing product to its network link and back at any time'],
+                        'default_image' => 'network-programs.webp',
+                        'image_alt' => 'Programs from a connected network with their status and commission',
+                    ],
+                    [
+                        'heading' => 'Commissions you don\'t have to type in',
+                        'body' => 'Every connected network syncs overnight, and you can sync on demand. New and updated commissions land in Earnings next to the ones you log yourself, so your numbers are always in one place.',
+                        'bullets' => ['Automatic daily sync', 'Imported and manual earnings together', 'Your API keys are stored encrypted'],
+                        'default_image' => 'earnings.webp',
+                        'image_alt' => 'Earnings with commissions imported from affiliate networks',
+                    ],
+                ],
+                'steps' => [
+                    ['title' => 'Connect a network', 'description' => 'Paste the API details from your network account — the page shows where to find them.'],
+                    ['title' => 'Pick your programs', 'description' => 'Add a joined program as a product, or switch an existing product to its tracked link.'],
+                    ['title' => 'Watch commissions arrive', 'description' => 'Earnings fill in on their own after every sync.'],
+                ],
+                'faqs' => [
+                    ['question' => 'Which networks can I connect?', 'answer' => 'Impact, PartnerStack, Awin and CJ connect with their API. ClickBank and Digistore24 have no program API, so you add a product by its ID and AffilStack builds the tracked link.'],
+                    ['question' => 'Does connecting a network change my existing links?', 'answer' => 'No. Your own affiliate link stays on the product. You choose when to switch a product to the network\'s tracked link, and you can switch back.'],
+                    ['question' => 'How many networks can I connect?', 'answer' => 'It depends on your plan — see the Pricing page.'],
+                ],
+                'cta_heading' => 'Bring your networks into AffilStack',
+                'cta_text' => 'Connect your first network in a couple of minutes.',
+            ],
+            [
+                'slug' => 'wordpress-publishing',
+                'name' => 'WordPress Publishing',
+                'icon' => 'globe-alt',
+                'menu_group' => 'content',
+                'menu_description' => 'Send blog articles to your WordPress site as drafts.',
+                'hero_eyebrow' => 'WordPress publishing',
+                'hero_headline' => 'From AffilStack to your WordPress site *in one click*',
+                'hero_subheadline' => 'Install the free AffilStack Connector plugin and every blog article you generate can arrive on your WordPress site as a draft — with images, SEO fields, categories, tags, FAQ schema and your tracked links already in place.',
+                'hero_default_image' => 'wordpress-publishing.webp',
+                'hero_image_alt' => 'A connected WordPress site with automatic sending switched on',
+                'sections' => [
+                    [
+                        'heading' => 'Drafts that are ready to publish',
+                        'body' => 'Articles arrive as WordPress drafts with the featured image, meta title and description filled in for Yoast SEO, Rank Math or All in One SEO. Nothing goes live until you review it and press Publish.',
+                        'bullets' => ['Images uploaded to your media library', 'SEO fields, categories and tags', 'FAQ schema and tracked links included'],
+                        'default_image' => 'blog-article.webp',
+                        'image_alt' => 'A generated blog article ready to send to WordPress',
+                    ],
+                    [
+                        'heading' => 'Connect without copying keys',
+                        'body' => 'Click "Connect to AffilStack" in the plugin, approve the site in your dashboard and you\'re done. Turn on automatic sending and every new article goes to your site on its own.',
+                        'bullets' => ['One-click connect', 'Send by hand or automatically', 'Connect several sites on bigger plans'],
+                        'default_image' => 'wordpress-publishing.webp',
+                        'image_alt' => 'The WordPress Sites page with setup steps',
+                    ],
+                ],
+                'steps' => [
+                    ['title' => 'Download the plugin', 'description' => 'From the WordPress Sites page in your dashboard.'],
+                    ['title' => 'Install and connect', 'description' => 'Upload it to WordPress, activate it and approve the connection.'],
+                    ['title' => 'Send articles', 'description' => 'One click per article, or automatic sending for every new one.'],
+                ],
+                'faqs' => [
+                    ['question' => 'Does AffilStack publish anything without me?', 'answer' => 'No. Articles always arrive as drafts. You review and publish them in WordPress.'],
+                    ['question' => 'Which SEO plugins are supported?', 'answer' => 'Yoast SEO, Rank Math and All in One SEO. Without one, the article still arrives with its title, content and images.'],
+                    ['question' => 'How many sites can I connect?', 'answer' => 'It depends on your plan — see the Pricing page.'],
+                ],
+                'cta_heading' => 'Publish your next article to WordPress',
+                'cta_text' => 'Generate a blog article and send it to your site in one click.',
+            ],
+            [
+                'slug' => 'multi-language',
+                'name' => 'AffilStack in Your Language',
+                'icon' => 'language',
+                'menu_group' => 'grow',
+                'menu_description' => 'Use the whole dashboard in your own language.',
+                'hero_eyebrow' => 'Your language',
+                'hero_headline' => 'Work in the language *you think in*',
+                'hero_subheadline' => 'Switch AffilStack to French, Spanish, Portuguese, Arabic, Swahili and other languages. Menus, pages, buttons and emails change language — your products, contacts and content stay exactly as you wrote them.',
+                'hero_default_image' => 'multi-language.webp',
+                'hero_image_alt' => 'The AffilStack dashboard shown in French',
+                'sections' => [
+                    [
+                        'heading' => 'The app changes, your data doesn\'t',
+                        'body' => 'Pick a language from the menu and every page follows, including right-to-left layouts for Arabic and other right-to-left languages. Product names, contact details and the content you generate are never translated behind your back.',
+                        'bullets' => ['Every dashboard page and email', 'Right-to-left layouts', 'Your own data left untouched'],
+                        'default_image' => 'multi-language.webp',
+                        'image_alt' => 'A dashboard page in French with customer data unchanged',
+                    ],
+                    [
+                        'heading' => 'Rewrite content for another market',
+                        'body' => 'When you want content itself in another market\'s voice, Localization adapts it with local spelling, currency, references and the right disclosure.',
+                        'bullets' => ['Works with any generated content', 'Market-specific disclosure', 'Lands on your content calendar'],
+                        'default_image' => 'localization.webp',
+                        'image_alt' => 'Localizing generated content for a different market',
+                    ],
+                ],
+                'steps' => [
+                    ['title' => 'Open the language menu', 'description' => 'At the bottom of the dashboard sidebar.'],
+                    ['title' => 'Pick your language', 'description' => 'The whole app switches straight away.'],
+                    ['title' => 'Keep working', 'description' => 'Your choice is saved to your account on every device.'],
+                ],
+                'faqs' => [
+                    ['question' => 'Which languages are available?', 'answer' => 'The language menu lists every language that is switched on. More are added over time.'],
+                    ['question' => 'Will my products and contacts be translated?', 'answer' => 'No. Only AffilStack\'s own words change. Everything you add or generate stays as it is.'],
+                ],
+                'cta_heading' => 'Use AffilStack in your language',
+                'cta_text' => 'Every plan includes every available language.',
+            ],
+            [
+                'slug' => 'add-on-marketplace',
+                'name' => 'Add-on Marketplace',
+                'icon' => 'puzzle-piece',
+                'menu_group' => 'grow',
+                'menu_description' => 'Apps, template packs and automation recipes.',
+                'hero_eyebrow' => 'Add-on marketplace',
+                'hero_headline' => 'Add exactly the tools *your workflow is missing*',
+                'hero_subheadline' => 'Browse apps that connect to your account, template and prompt packs, and ready-made automation recipes from independent developers. Every add-on is reviewed by AffilStack before it goes live, and every update is reviewed again.',
+                'hero_default_image' => 'add-on-marketplace.webp',
+                'hero_image_alt' => 'The Add-on Marketplace with a template pack, an automation recipe and a connected app',
+                'sections' => [
+                    [
+                        'heading' => 'Three kinds of add-on',
+                        'body' => 'Connected apps work with your AffilStack data after you approve exactly what they can see. Template packs fill your Template Library with hooks, emails and prompts. Automation recipes walk you through a ready-made Zapier, Make or n8n workflow.',
+                        'bullets' => ['Connected apps with permissions you approve', 'Template and prompt packs', 'Automation recipes with step-by-step setup'],
+                        'default_image' => 'template-library.webp',
+                        'image_alt' => 'The Template Library filled by an installed template pack',
+                    ],
+                    [
+                        'heading' => 'Free or a simple monthly price',
+                        'body' => 'Many add-ons are free. Paid ones are a monthly subscription you can cancel at any time, and removing an add-on takes back everything it was allowed to do.',
+                        'bullets' => ['Reviewed before every release', 'Cancel any time', 'Remove an add-on and its access goes with it'],
+                        'default_image' => 'add-on-marketplace.webp',
+                        'image_alt' => 'Add-ons with their type and price',
+                    ],
+                ],
+                'steps' => [
+                    ['title' => 'Browse the marketplace', 'description' => 'Search or filter by type and category.'],
+                    ['title' => 'Add what you need', 'description' => 'Free add-ons install in one click; paid ones start a monthly subscription.'],
+                    ['title' => 'Manage your add-ons', 'description' => 'See, update or remove them from My add-ons.'],
+                ],
+                'faqs' => [
+                    ['question' => 'Can I build and sell my own add-on?', 'answer' => 'Yes. Sign in to the developer portal with your AffilStack account, create a listing and submit it for review. You keep 70% of every paid subscription.'],
+                    ['question' => 'What can a connected app see?', 'answer' => 'Only what you approve when you connect it. You can disconnect it at any time from My add-ons.'],
+                ],
+                'cta_heading' => 'Find your next favourite tool',
+                'cta_text' => 'Browse the marketplace — no account needed to look around.',
+            ],
         ];
     }
 
diff --git a/app/Support/Homepage/HomepageContent.php b/app/Support/Homepage/HomepageContent.php
index c97aee9ed..58fafa139 100644
--- a/app/Support/Homepage/HomepageContent.php
+++ b/app/Support/Homepage/HomepageContent.php
@@ -63,7 +63,7 @@ public static function defaults(): array
             'home_how_heading' => 'From product idea to paid commission in *four steps*',
             'home_how_subheading' => $siteName.' follows the real affiliate journey, so you always know what to do next.',
             'home_features_heading' => 'Everything an affiliate marketer needs, in one place',
-            'home_features_subheading' => 'From your first offer to your first payout — research, buyers, campaigns, content and tracking, without stitching together a dozen tools.',
+            'home_features_subheading' => 'From your first offer to your first payout — research, buyers, campaigns, content and tracking, connected to your affiliate networks and your WordPress site, without stitching together a dozen tools.',
             'home_video_heading' => 'See '.$siteName.' in action',
             'home_video_subheading' => 'Watch one product go from research to real buyers, a full campaign and tracked clicks.',
             'home_video_points' => "Product research in minutes\nBuyers from Google Maps & LinkedIn\nCampaigns and content written for you",
@@ -119,8 +119,8 @@ public static function defaultSteps(): array
         return [
             ['icon' => 'magnifying-glass', 'title' => 'Research a product', 'description' => 'Paste a product name or affiliate link. Get the ideal buyer, their pain points, the best channel and angle — plus Google Maps and LinkedIn keywords to find them — in minutes.', 'default_image' => 'offer-research.webp', 'image_alt' => 'AffilStack research results for a product, showing the ideal buyer and the best channel to promote it', 'link_url' => '/features/offer-research'],
             ['icon' => 'map-pin', 'title' => 'Find buyers on Maps & LinkedIn', 'description' => 'Pull real businesses from Google Maps and decision-makers from LinkedIn straight into a CRM list for that product — in one click with the Chrome extension.', 'default_image' => 'local-leads.webp', 'image_alt' => 'Google Maps business results ready to add to the CRM', 'link_url' => '/features/google-maps-lead-finder'],
-            ['icon' => 'sparkles', 'title' => 'Launch AI campaigns & content', 'description' => 'A personalised email campaign to the whole list, sent from your own inbox — plus blog, LinkedIn, YouTube, UGC video, TikTok, X and Pinterest content written for you.', 'default_image' => 'campaign-results.webp', 'image_alt' => 'An email campaign showing who opened, clicked and replied', 'link_url' => '/features/ai-email-campaigns'],
-            ['icon' => 'banknotes', 'title' => 'Track clicks & earnings', 'description' => 'Every link click and commission in one dashboard, by product and by channel, so you know exactly what is paying.', 'default_image' => 'earnings.webp', 'image_alt' => 'Earnings by product and channel with pending, approved and paid totals', 'link_url' => '/features/earnings-tracker'],
+            ['icon' => 'sparkles', 'title' => 'Launch AI campaigns & content', 'description' => 'A personalised email campaign to the whole list, sent from your own inbox — plus blog, LinkedIn, YouTube, UGC video, TikTok, X and Pinterest content written for you, with articles sent to your WordPress site as drafts.', 'default_image' => 'campaign-results.webp', 'image_alt' => 'An email campaign showing who opened, clicked and replied', 'link_url' => '/features/ai-email-campaigns'],
+            ['icon' => 'banknotes', 'title' => 'Track clicks & earnings', 'description' => 'Every link click and commission in one dashboard, by product and by channel — with commissions imported from Impact, PartnerStack, Awin and CJ — so you know exactly what is paying.', 'default_image' => 'earnings.webp', 'image_alt' => 'Earnings by product and channel with pending, approved and paid totals', 'link_url' => '/features/earnings-tracker'],
         ];
     }
 
diff --git a/app/Support/Security/ExecutableFileDetector.php b/app/Support/Security/ExecutableFileDetector.php
new file mode 100644
index 000000000..99f3e350b
--- /dev/null
+++ b/app/Support/Security/ExecutableFileDetector.php
@@ -0,0 +1,81 @@
+<?php
+
+namespace App\Support\Security;
+
+/**
+ * Spots files a web server could run as code: PHP-like names (including
+ * "photo.php.jpg" double extensions), server config files that could
+ * switch PHP back on (.htaccess, .user.ini), and PHP code hidden inside an
+ * otherwise ordinary file. Shared by the upload guard and Tom's daily
+ * web-shell scan so both use the same rules.
+ */
+class ExecutableFileDetector
+{
+    protected const CHUNK = 1048576;
+
+    protected const CONFIG_FILES = ['.htaccess', '.user.ini', 'php.ini', '.php.ini', 'web.config'];
+
+    public static function nameIsExecutable(string $fileName): bool
+    {
+        $name = strtolower(basename($fileName));
+        $blocked = array_map('strtolower', (array) config('security.executable_extensions', []));
+
+        if (in_array($name, self::CONFIG_FILES, true)) {
+            return true;
+        }
+
+        return array_intersect(array_slice(explode('.', $name), 1), $blocked) !== [];
+    }
+
+    public static function extensionIsExecutable(?string $extension): bool
+    {
+        return $extension !== null && in_array(strtolower($extension), array_map('strtolower', (array) config('security.executable_extensions', [])), true);
+    }
+
+    /**
+     * Looks for PHP code in a file, reading it in chunks with a small
+     * overlap so a tag split across two chunks is still found. "<?php"
+     * counts anywhere; the short tags "<?=" and "<? " can occur by chance
+     * in binary data, so they only count in text files.
+     */
+    public static function containsPhp(string $path, ?int $maxBytes = null): bool
+    {
+        $maxBytes ??= (int) config('security.upload_content_scan_max_bytes');
+
+        if (! is_file($path) || filesize($path) > $maxBytes) {
+            return false;
+        }
+
+        $handle = @fopen($path, 'rb');
+
+        if ($handle === false) {
+            return false;
+        }
+
+        $tail = '';
+        $first = true;
+
+        try {
+            while (! feof($handle)) {
+                $chunk = $tail.(string) fread($handle, self::CHUNK);
+
+                if (preg_match('/<\?php[\s\/]/i', $chunk) === 1) {
+                    return true;
+                }
+
+                $isText = ! str_contains($chunk, "\0");
+
+                if ($isText && (str_contains($chunk, '<?=') || ($first && preg_match('/^\s*<\?\s/', $chunk) === 1))) {
+                    return true;
+                }
+
+                $tail = substr($chunk, -8);
+                $first = false;
+            }
+        } finally {
+            fclose($handle);
+        }
+
+        return false;
+    }
+}
diff --git a/app/Support/Security/PhpRuntime.php b/app/Support/Security/PhpRuntime.php
new file mode 100644
index 000000000..91c6fd627
--- /dev/null
+++ b/app/Support/Security/PhpRuntime.php
@@ -0,0 +1,311 @@
+<?php
+
+namespace App\Support\Security;
+
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Throwable;
+
+/**
+ * Is the PHP that runs AffilStack safe? PHP2Shell (CVE-2026-109618 and
+ * CVE-2026-109619) attacks PHP itself before any application code runs, so
+ * the only real protection is a patched PHP on the server. This class
+ * knows which versions are patched, records which PHP the website actually
+ * serves with (the cron's command-line PHP can differ from it on Hostinger),
+ * asks php.net daily whether a newer security release exists, and checks
+ * the php.ini settings that make PHP2Shell easier to reach.
+ */
+class PhpRuntime
+{
+    protected const RELEASE_CACHE_PREFIX = 'security:php-latest:';
+
+    /**
+     * The PHP the website served with most recently, as recorded by
+     * RecordPhpRuntime.
+     *
+     * @return array{version: string, sapi: string, build_date: string|null, ini: array<string, string|false>, recorded_at: int}|null
+     */
+    public static function webRuntime(): ?array
+    {
+        $path = static::recordPath();
+
+        if (! is_file($path)) {
+            return null;
+        }
+
+        $data = json_decode((string) @file_get_contents($path), true);
+
+        return is_array($data) && isset($data['version'], $data['sapi']) ? $data + ['build_date' => null, 'ini' => [], 'recorded_at' => 0] : null;
+    }
+
+    /**
+     * Writes this request's PHP version (and the risky ini values) for the
+     * daily check — only when it changed or the record is old, so a normal
+     * request costs one small file read.
+     */
+    public static function recordCurrent(): void
+    {
+        $path = static::recordPath();
+        $current = static::webRuntime();
+        $fresh = $current !== null
+            && $current['version'] === PHP_VERSION
+            && $current['sapi'] === PHP_SAPI
+            && $current['recorded_at'] > time() - (int) config('security.php_runtime_record_minutes', 360) * 60;
+
+        if ($fresh) {
+            return;
+        }
+
+        $ini = [];
+
+        foreach ([...array_keys((array) config('security.php_risky_ini', [])), 'post_max_size', 'disable_functions'] as $key) {
+            $ini[$key] = ini_get($key);
+        }
+
+        @file_put_contents($path, json_encode([
+            'version' => PHP_VERSION,
+            'sapi' => PHP_SAPI,
+            'build_date' => static::buildDate(),
+            'ini' => $ini,
+            'recorded_at' => time(),
+        ]), LOCK_EX);
+    }
+
+    /**
+     * Everything wrong with a PHP version, worst first.
+     *
+     * Managed hosts (Hostinger's CloudLinux PHP among them) often backport a
+     * security fix into the version they already run without changing its
+     * number, so a PHP built on or after a fix's release date is treated as
+     * carrying it — reported as a low note to confirm with the host rather
+     * than as critical.
+     *
+     * @return array<int, array{severity: string, title: string, detail: string}>
+     */
+    public static function problemsFor(string $version, bool $checkPhpNet = true, ?string $buildDate = null): array
+    {
+        $branch = static::branch($version);
+        $problems = [];
+
+        if (! in_array($branch, (array) config('security.php_supported_branches', []), true)) {
+            $problems[] = [
+                'severity' => 'critical',
+                'title' => "PHP {$version} is not a supported version for AffilStack",
+                'detail' => 'AffilStack runs on PHP '.implode(' or ', (array) config('security.php_supported_branches', [])).'. Switch the website to one of them in hPanel → Advanced → PHP Configuration.',
+            ];
+
+            return $problems;
+        }
+
+        $minimum = ((array) config('security.php_minimum_patches', []))[$branch] ?? null;
+        $fixedOn = ((array) config('security.php_fix_released', []))[$branch] ?? null;
+        $belowFix = is_string($minimum) && version_compare($version, $minimum, '<');
+        $backported = $belowFix && static::builtOnOrAfter($buildDate, $fixedOn);
+
+        if ($belowFix && ! $backported) {
+            $problems[] = [
+                'severity' => 'critical',
+                'title' => "PHP {$version} is vulnerable to PHP2Shell — {$minimum} or newer is needed",
+                'detail' => "PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an attacker run code on the server without logging in, before AffilStack itself runs. PHP {$minimum} fixes it. Ask the host to update PHP {$branch} to {$minimum} or newer (or confirm they have backported the fix), then restart PHP.",
+            ];
+        } elseif ($backported) {
+            $problems[] = [
+                'severity' => 'low',
+                'title' => "PHP {$version} was built on {$buildDate}, after the PHP2Shell fix — the host's backport is assumed",
+                'detail' => "The version number is older than {$minimum}, but this build is dated after the fix was released ({$fixedOn}). Hosts such as Hostinger backport the fix without changing the number. If in doubt, ask the host to confirm their PHP {$branch} build includes the PHP2Shell fix (CVE-2026-109618 and CVE-2026-109619).",
+            ];
+        }
+
+        if ($checkPhpNet && ($latest = static::latestRelease($branch)) && version_compare($version, $latest['version'], '<')
+            && ! static::builtOnOrAfter($buildDate, $latest['date'] ?? null)) {
+            $security = in_array('security', $latest['tags'], true);
+
+            // Already covered by the PHP2Shell message above.
+            if (! ($belowFix && ! $backported && $minimum === $latest['version'])) {
+                $problems[] = [
+                    'severity' => $security ? 'high' : 'low',
+                    'title' => $security
+                        ? "PHP {$latest['version']} is a security release and this server runs {$version}"
+                        : "PHP {$latest['version']} is available and this server runs {$version}",
+                    'detail' => $security
+                        ? "php.net released PHP {$latest['version']} with security fixes. Ask the host to update PHP {$branch} (or confirm they have backported the fixes), then restart PHP."
+                        : "A newer PHP {$branch} release is out. Updating soon keeps the server current.",
+                ];
+            }
+        }
+
+        return $problems;
+    }
+
+    /**
+     * The date this PHP binary was built ("Y-m-d"), from phpinfo(), or null
+     * when it can't be read.
+     */
+    public static function buildDate(): ?string
+    {
+        static $date = false;
+
+        if ($date !== false) {
+            return $date;
+        }
+
+        try {
+            ob_start();
+            phpinfo(INFO_GENERAL);
+            $info = strip_tags((string) ob_get_clean());
+        } catch (Throwable) {
+            return $date = null;
+        }
+
+        if (preg_match('/Build Date\s*(?:=>)?\s*([A-Z][a-z]{2}\s+\d{1,2}\s+\d{4})/', $info, $match) !== 1) {
+            return $date = null;
+        }
+
+        $parsed = \DateTimeImmutable::createFromFormat('!M j Y', (string) preg_replace('/\s+/', ' ', $match[1]));
+
+        return $date = $parsed ? $parsed->format('Y-m-d') : null;
+    }
+
+    protected static function builtOnOrAfter(?string $buildDate, ?string $releaseDate): bool
+    {
+        if ($buildDate === null || $releaseDate === null) {
+            return false;
+        }
+
+        $build = strtotime($buildDate);
+        $release = strtotime($releaseDate);
+
+        return $build !== false && $release !== false && $build >= $release;
+    }
+
+    /**
+     * php.ini settings on the website that should be off.
+     *
+     * @param  array<string, string|false>  $ini
+     * @return array<int, array{severity: string, title: string, detail: string}>
+     */
+    public static function riskyIniProblems(array $ini): array
+    {
+        $problems = [];
+
+        foreach ((array) config('security.php_risky_ini', []) as $key => $safe) {
+            if (! array_key_exists($key, $ini) || $ini[$key] === false) {
+                continue;
+            }
+
+            if (static::normalizeIni((string) $ini[$key]) !== static::normalizeIni((string) $safe)) {
+                $problems[] = [
+                    'severity' => 'medium',
+                    'title' => "PHP setting {$key} is on",
+                    'detail' => "AffilStack doesn't use it, and PHP2Shell can be reached through it. public/.user.ini turns it off; if the host ignores that file, set {$key} = {$safe} in hPanel → Advanced → PHP Configuration or ask the host to.",
+                ];
+            }
+        }
+
+        if (isset($ini['disable_functions']) && is_string($ini['disable_functions'])) {
+            $disabled = array_map('trim', explode(',', strtolower($ini['disable_functions'])));
+            $open = array_values(array_diff((array) config('security.web_disabled_functions', []), $disabled));
+
+            if ($open !== []) {
+                $problems[] = [
+                    'severity' => 'medium',
+                    'title' => 'The website can start other programs ('.implode(', ', $open).' allowed)',
+                    'detail' => 'AffilStack\'s website never needs these (the cron job turns them on for itself), but a web shell would use them to take over the server. Add '.implode(', ', $open).' to disable_functions in hPanel → Advanced → PHP Configuration → PHP options.',
+                ];
+            }
+        }
+
+        $maxPost = (int) config('security.php_max_post_megabytes', 64);
+
+        if (isset($ini['post_max_size']) && is_string($ini['post_max_size']) && static::megabytes($ini['post_max_size']) > $maxPost) {
+            $problems[] = [
+                'severity' => 'medium',
+                'title' => "PHP accepts requests up to {$ini['post_max_size']} (post_max_size)",
+                'detail' => 'AffilStack never needs more than about 25 MB, and very large requests are how PHP2Shell exhausts memory. public/.user.ini lowers it to 40M; if the host ignores that file, choose the smallest post_max_size and upload_max_filesize in hPanel → Advanced → PHP Configuration.',
+            ];
+        }
+
+        return $problems;
+    }
+
+    /**
+     * "2048M", "1G", "40M", "0" (unlimited) as megabytes.
+     */
+    public static function megabytes(string $value): float
+    {
+        $value = trim($value);
+        $number = (float) $value;
+
+        if ($number <= 0) {
+            return INF;
+        }
+
+        return match (strtolower(substr($value, -1))) {
+            'g' => $number * 1024,
+            'm' => $number,
+            'k' => $number / 1024,
+            default => $number / 1048576,
+        };
+    }
+
+    /**
+     * The newest release of a branch on php.net, cached for 12 hours.
+     * Null when php.net can't be reached or the check is off.
+     *
+     * @return array{version: string, tags: array<int, string>, date: string|null}|null
+     */
+    public static function latestRelease(string $branch): ?array
+    {
+        if (! config('security.php_release_check', true)) {
+            return null;
+        }
+
+        try {
+            return Cache::remember(static::RELEASE_CACHE_PREFIX.$branch, now()->addHours(12), function () use ($branch) {
+                $response = Http::timeout(10)->acceptJson()
+                    ->get((string) config('security.php_release_feed'), ['json' => '', 'version' => $branch]);
+
+                $version = $response->json('version');
+
+                if (! $response->successful() || ! is_string($version) || ! preg_match('/^\d+\.\d+\.\d+$/', $version) || static::branch($version) !== $branch) {
+                    throw new \RuntimeException('Unexpected answer from php.net.');
+                }
+
+                $date = $response->json('date');
+
+                return [
+                    'version' => $version,
+                    'tags' => array_values(array_filter((array) $response->json('tags', []), 'is_string')),
+                    'date' => is_string($date) && strtotime($date) !== false ? date('Y-m-d', (int) strtotime($date)) : null,
+                ];
+            });
+        } catch (Throwable) {
+            return null;
+        }
+    }
+
+    /**
+     * True when the website's PHP is known to be below a critical fix.
+     */
+    public static function webIsCriticallyVulnerable(): bool
+    {
+        $web = static::webRuntime();
+
+        return $web !== null && collect(static::problemsFor($web['version'], false, $web['build_date']))->contains('severity', 'critical');
+    }
+
+    public static function branch(string $version): string
+    {
+        return implode('.', array_slice(explode('.', $version), 0, 2));
+    }
+
+    protected static function normalizeIni(string $value): string
+    {
+        return in_array(strtolower(trim($value)), ['', '0', 'off', 'false', 'no', 'none'], true) ? '0' : '1';
+    }
+
+    protected static function recordPath(): string
+    {
+        return storage_path('framework/php-runtime.json');
+    }
+}
diff --git a/app/Support/Seo/SiteVerificationCode.php b/app/Support/Seo/SiteVerificationCode.php
new file mode 100644
index 000000000..1a7b0b416
--- /dev/null
+++ b/app/Support/Seo/SiteVerificationCode.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Support\Seo;
+
+/**
+ * The value that goes inside a search engine's verification meta tag
+ * (google-site-verification, msvalidate.01).
+ *
+ * Google's Site Verification API hands back the whole tag rather than just
+ * its code, and people often paste the whole tag too — printing that inside
+ * content="" breaks verification. This keeps only the code.
+ */
+final class SiteVerificationCode
+{
+    public static function normalize(?string $value): ?string
+    {
+        $value = trim((string) $value);
+
+        if (preg_match('/content\s*=\s*(["\'])(.*?)\1/i', html_entity_decode($value, ENT_QUOTES | ENT_HTML5), $matches)) {
+            $value = trim($matches[2]);
+        }
+
+        $value = trim($value, " \t\n\r\0\x0B\"'");
+
+        return $value === '' ? null : $value;
+    }
+}
diff --git a/app/Support/Translation/Catalog.php b/app/Support/Translation/Catalog.php
index e39604dff..1d06eb159 100644
--- a/app/Support/Translation/Catalog.php
+++ b/app/Support/Translation/Catalog.php
@@ -77,6 +77,12 @@ public static function build(): int
             }
 
             foreach (File::allFiles($directory) as $file) {
+                // Development-only demo data (sample customer names) isn't
+                // AffilStack's own interface text.
+                if (str_contains(str_replace('\\', '/', $file->getPathname()), '/Console/Commands/Dev/')) {
+                    continue;
+                }
+
                 if ($file->getExtension() === 'php') {
                     static::collect((string) file_get_contents($file->getPathname()), $strings);
                 }
diff --git a/app/Support/Website/NavigationMenu.php b/app/Support/Website/NavigationMenu.php
index ffd482acd..97dcf4513 100644
--- a/app/Support/Website/NavigationMenu.php
+++ b/app/Support/Website/NavigationMenu.php
@@ -69,6 +69,8 @@ public static function destinations(): array
             'pricing' => ['label' => 'Pricing', 'description' => 'Plans and prices.', 'icon' => 'currency-dollar'],
             'blog' => ['label' => 'Blog', 'description' => 'Guides and strategies from our blog.', 'icon' => 'newspaper'],
             'faq' => ['label' => 'Frequently Asked Questions', 'description' => 'Quick answers before you start.', 'icon' => 'question-mark-circle'],
+            'marketplace' => ['label' => 'Add-on Marketplace', 'description' => 'Apps, template packs and automation recipes.', 'icon' => 'puzzle-piece'],
+            'developers' => ['label' => 'Developers', 'description' => 'Build and sell add-ons for AffilStack.', 'icon' => 'code-bracket'],
             'affiliate' => ['label' => 'Affiliate Program', 'description' => 'Earn recurring commission by referring us.', 'icon' => 'gift'],
             'help' => ['label' => 'Help Centre', 'description' => 'Support, guides and tutorials.', 'icon' => 'lifebuoy'],
             'learn' => ['label' => 'Learning Centre', 'description' => 'Free video tutorials.', 'icon' => 'academic-cap'],
@@ -110,6 +112,8 @@ public static function urlFor(string $key, ?string $customUrl = null): ?string
             'pricing' => $route('registration.pricing'),
             'blog' => BlogFeed::baseUrl(),
             'faq' => $route('faq.index'),
+            'marketplace' => $route('marketplace.index'),
+            'developers' => $route('developer.home'),
             'affiliate' => SiteSetting::flag('affiliate_program_enabled') ? $route('affiliate.landing') : null,
             'help' => $route('help.index'),
             'learn' => $route('tutorials.index'),
@@ -148,7 +152,7 @@ public static function defaultResources(): array
             'visible' => $visible,
         ];
 
-        return [$item('blog'), $item('faq'), $item('affiliate'), $item('help'), $item('learn', false)];
+        return [$item('blog'), $item('marketplace'), $item('faq'), $item('affiliate'), $item('help'), $item('developers', false), $item('learn', false)];
     }
 
     /**
@@ -201,8 +205,8 @@ public static function defaultFooter(): array
         $link = fn (string $key, ?string $label = null): array => ['key' => $key, 'label' => $label ?? static::destinations()[$key]['label'], 'visible' => true];
 
         return [
-            ['heading' => 'Product', 'links' => [$link('features'), $link('how-it-works'), $link('pricing'), $link('mobile-apps')]],
-            ['heading' => 'Resources', 'links' => [$link('learn'), $link('blog', 'Visit our blog'), $link('faq', 'FAQ'), $link('help')]],
+            ['heading' => 'Product', 'links' => [$link('features'), $link('how-it-works'), $link('pricing'), $link('marketplace'), $link('mobile-apps')]],
+            ['heading' => 'Resources', 'links' => [$link('learn'), $link('blog', 'Visit our blog'), $link('faq', 'FAQ'), $link('help'), $link('developers')]],
             ['heading' => 'Company', 'links' => [$link('about'), $link('affiliate'), $link('contact'), $link('login')]],
             ['heading' => 'Legal', 'links' => [$link('terms'), $link('privacy'), $link('refunds'), $link('cookies'), $link('cookie-settings')]],
         ];
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 5b8e7bd92..5eb404428 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -14,6 +14,8 @@
 use App\Http\Middleware\LogApiRequest;
 use App\Http\Middleware\MarkLocalizedUrl;
 use App\Http\Middleware\MeterApiUsage;
+use App\Http\Middleware\RecordPhpRuntime;
+use App\Http\Middleware\RejectExecutableUploads;
 use App\Http\Middleware\RestrictAffiliateOnlyAccounts;
 use App\Http\Middleware\RestrictAgencySeats;
 use App\Http\Middleware\SecurityHeaders;
@@ -57,6 +59,13 @@
         // docblock. Global (web + api) since every response needs them.
         $middleware->append(SecurityHeaders::class);
 
+        // PHP2Shell hardening: the website records which PHP it runs on for
+        // Tom's daily check, and no upload may carry server-side code (in
+        // the groups, so a rejected form gets its error back on the page).
+        $middleware->append(RecordPhpRuntime::class);
+        $middleware->appendToGroup('web', RejectExecutableUploads::class);
+        $middleware->appendToGroup('api', RejectExecutableUploads::class);
+
         // Feature 6: /fr/pricing is the French /pricing — the language code
         // comes off the address before routing (see StripLocalePrefix), and
         // every web page is shown in the visitor's language (LocalizeResponse).
diff --git a/composer.json b/composer.json
index f15a71ce0..914fbb39a 100644
--- a/composer.json
+++ b/composer.json
@@ -6,7 +6,7 @@
     "keywords": ["laravel", "framework"],
     "license": "MIT",
     "require": {
-        "php": "^8.3",
+        "php": "^8.4",
         "doctrine/dbal": "^4.4",
         "filament/filament": "^5.7",
         "laravel/fortify": "^1.39",
diff --git a/composer.lock b/composer.lock
index 6e06834ae..e709cf25c 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "5fbd969957f023e0d9fddc47cb0be4b8",
+    "content-hash": "7c4f4b63d7106e4489e69cb5cb929eb0",
     "packages": [
         {
             "name": "anourvalar/eloquent-serialize",
@@ -9543,12 +9543,12 @@
             "version": "v5.7.0",
             "source": {
                 "type": "git",
-                "url": "https://github.com/vlucas/phpdotenv.git",
+                "url": "https://github.com/phpdotenv/phpdotenv.git",
                 "reference": "301c07936b16d88628b126b01d082ba153cf4c40"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40",
+                "url": "https://api.github.com/repos/phpdotenv/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40",
                 "reference": "301c07936b16d88628b126b01d082ba153cf4c40",
                 "shasum": ""
             },
@@ -12452,16 +12452,16 @@
         },
         {
             "name": "symfony/yaml",
-            "version": "v8.1.5",
+            "version": "v8.1.9",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/yaml.git",
-                "reference": "b3fc9e8888eeb9daddc33bfbd15d282a61f543cd"
+                "reference": "6107ee26a25215c3df3af0a3315e56bb4fd0b7db"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/yaml/zipball/b3fc9e8888eeb9daddc33bfbd15d282a61f543cd",
-                "reference": "b3fc9e8888eeb9daddc33bfbd15d282a61f543cd",
+                "url": "https://api.github.com/repos/symfony/yaml/zipball/6107ee26a25215c3df3af0a3315e56bb4fd0b7db",
+                "reference": "6107ee26a25215c3df3af0a3315e56bb4fd0b7db",
                 "shasum": ""
             },
             "require": {
@@ -12504,7 +12504,7 @@
             "description": "Loads and dumps YAML files",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/yaml/tree/v8.1.5"
+                "source": "https://github.com/symfony/yaml/tree/v8.1.9"
             },
             "funding": [
                 {
@@ -12524,7 +12524,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-21T12:16:08+00:00"
+            "time": "2026-10-12T12:37:13+00:00"
         },
         {
             "name": "theseer/tokenizer",
@@ -12583,7 +12583,7 @@
     "prefer-stable": true,
     "prefer-lowest": false,
     "platform": {
-        "php": "^8.3"
+        "php": "^8.4"
     },
     "platform-dev": {},
     "plugin-api-version": "2.6.0"
diff --git a/config/security.php b/config/security.php
new file mode 100644
index 000000000..58e75123f
--- /dev/null
+++ b/config/security.php
@@ -0,0 +1,86 @@
+<?php
+
+/**
+ * Runtime security checks (App\Support\Security\PhpRuntime), run daily by
+ * Tom, the Security Agent, and shown to admins as a banner when something
+ * needs the host's attention.
+ */
+return [
+
+    /*
+    | The oldest patch of each PHP branch that is safe to serve the site on.
+    | PHP2Shell (CVE-2026-109618 / CVE-2026-109619, October 2026) is fixed in
+    | 8.4.27 and 8.5.12 — anything older on those branches is critical. Raise
+    | these when PHP ships a future critical fix; the daily php.net check
+    | below also catches any newer security release on its own.
+    */
+    'php_minimum_patches' => [
+        '8.4' => '8.4.27',
+        '8.5' => '8.5.12',
+    ],
+
+    // When each fix above was released. A host that backports the fix
+    // without changing the version number (Hostinger does) ships a build
+    // dated on or after this day, which the check accepts.
+    'php_fix_released' => [
+        '8.4' => '2026-10-21',
+        '8.5' => '2026-10-21',
+    ],
+
+    // Branches AffilStack runs on (composer.json requires PHP ^8.4).
+    'php_supported_branches' => ['8.4', '8.5'],
+
+    /*
+    | Daily lookup of the newest release of the running branch on php.net, so
+    | a security release AffilStack hasn't been told about yet is still
+    | reported. Set PHP_RELEASE_CHECK=false to turn it off.
+    */
+    'php_release_check' => (bool) env('PHP_RELEASE_CHECK', true),
+    'php_release_feed' => 'https://www.php.net/releases/index.php',
+
+    /*
+    | php.ini settings that widen PHP2Shell's attack surface when switched on
+    | (see public/.user.ini, which turns them off where the host allows it).
+    | Each value is the safe setting.
+    */
+    'php_risky_ini' => [
+        'session.upload_progress.enabled' => '0',
+    ],
+
+    // A bigger post_max_size on the website is reported (AffilStack's
+    // largest form is about 25 MB).
+    'php_max_post_megabytes' => 64,
+
+    // Functions the website should have switched off (disable_functions):
+    // only the command-line cron, which lifts the limits for itself, runs
+    // programs such as git and composer.
+    'web_disabled_functions' => ['exec', 'shell_exec', 'system', 'passthru', 'popen', 'proc_open'],
+
+    // How often each web worker re-records the PHP version it serves with.
+    'php_runtime_record_minutes' => 360,
+
+    /*
+    | Folders under the app that must never contain PHP: uploads and public
+    | files. A PHP file in one of them is treated as a possible web shell.
+    | Paths are relative to the app's base folder.
+    */
+    'executable_scan_paths' => [
+        'public',
+        'storage/app',
+    ],
+
+    // The only PHP and server config files allowed in those folders.
+    'executable_allowlist' => [
+        'public/index.php',
+        'public/.htaccess',
+        'public/.user.ini',
+        'storage/app/public/.htaccess',
+    ],
+
+    // Extensions a web server may run as PHP. Never stored from an upload.
+    'executable_extensions' => ['php', 'php3', 'php4', 'php5', 'php7', 'php8', 'phtml', 'pht', 'phar', 'phps', 'pgif', 'shtml', 'cgi', 'pl', 'py', 'asp', 'aspx', 'jsp', 'htaccess'],
+
+    // Uploads larger than this are checked by name only, not by content.
+    'upload_content_scan_max_bytes' => 25 * 1024 * 1024,
+
+];
diff --git a/database/migrations/2026_10_22_202615_ship_marketing_content_for_new_features.php b/database/migrations/2026_10_22_202615_ship_marketing_content_for_new_features.php
new file mode 100644
index 000000000..78ea09b61
--- /dev/null
+++ b/database/migrations/2026_10_22_202615_ship_marketing_content_for_new_features.php
@@ -0,0 +1,83 @@
+<?php
+
+use App\Support\Features\FeatureCatalog;
+use Database\Seeders\FaqItemsSeeder;
+use Database\Seeders\HomepageFeaturesSeeder;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    /**
+     * Ships the marketing content for WordPress publishing, affiliate
+     * network connections, the dashboard in your language and the add-on
+     * marketplace to sites that already exist: the new feature pages, help
+     * answers, and three homepage cards placed before "Earn by sharing it,
+     * too". Never
+     * overwrites anything an admin has edited. A brand-new site (empty
+     * homepage_features table) gets the cards from HomepageFeaturesSeeder.
+     */
+    public function up(): void
+    {
+        FeatureCatalog::seedMissing();
+        $this->addFaqs();
+
+        if (! DB::table('homepage_features')->exists()) {
+            return;
+        }
+
+        $closer = DB::table('homepage_features')->where('title', 'Earn by sharing it, too')->first();
+        $sortOrder = $closer ? (int) $closer->sort_order : (int) DB::table('homepage_features')->max('sort_order') + 1;
+        $added = 0;
+
+        foreach (HomepageFeaturesSeeder::NEW_FEATURE_CARDS as $card) {
+            if (DB::table('homepage_features')->where('title', $card['title'])->exists()) {
+                continue;
+            }
+
+            DB::table('homepage_features')->insert($card + [
+                'media_type' => 'none',
+                'sort_order' => $sortOrder + $added,
+                'is_active' => true,
+                'created_at' => now(),
+                'updated_at' => now(),
+            ]);
+            $added++;
+        }
+
+        if ($closer && $added > 0) {
+            DB::table('homepage_features')->where('id', $closer->id)->update(['sort_order' => $sortOrder + $added]);
+        }
+
+        Cache::forget('homepage_features:active_list');
+    }
+
+    /**
+     * The new answers go after the existing FAQs; questions an admin
+     * already added (or the seeder created) are left alone.
+     */
+    private function addFaqs(): void
+    {
+        if (! DB::table('faq_items')->exists()) {
+            return;
+        }
+
+        $sortOrder = (int) DB::table('faq_items')->max('sort_order') + 1;
+
+        foreach (FaqItemsSeeder::NEW_FEATURE_FAQS as $faq) {
+            if (DB::table('faq_items')->where('question', $faq['question'])->exists()) {
+                continue;
+            }
+
+            DB::table('faq_items')->insert($faq + ['sort_order' => $sortOrder++, 'is_published' => true, 'created_at' => now(), 'updated_at' => now()]);
+        }
+
+        Cache::forget('faq_items:published_grouped');
+    }
+
+    public function down(): void
+    {
+        //
+    }
+};
diff --git a/database/seeders/FaqItemsSeeder.php b/database/seeders/FaqItemsSeeder.php
index e34423242..e6d1100ad 100644
--- a/database/seeders/FaqItemsSeeder.php
+++ b/database/seeders/FaqItemsSeeder.php
@@ -12,6 +12,40 @@
  */
 class FaqItemsSeeder extends Seeder
 {
+    /**
+     * Answers for features 4–7, also added to existing sites by the
+     * 2026_10_22_202615 migration.
+     *
+     * @var array<int, array{category: string, question: string, answer: string}>
+     */
+    public const NEW_FEATURE_FAQS = [
+        [
+            'category' => 'features',
+            'question' => 'Can AffilStack publish articles to my WordPress site?',
+            'answer' => 'Yes. Go to WordPress Sites in your dashboard, download the free AffilStack Connector plugin, install it in WordPress and click "Connect to AffilStack". Articles arrive as drafts with images, SEO fields, categories, tags, FAQ schema and tracked links — nothing is published until you press Publish. The number of sites you can connect depends on your plan.',
+        ],
+        [
+            'category' => 'features',
+            'question' => 'Which affiliate networks can I connect?',
+            'answer' => 'Impact, PartnerStack, Awin and CJ connect with their API: AffilStack brings in your programs, makes tracked links and imports your commissions into Earnings every day. ClickBank and Digistore24 have no program API, so you add a product by its ID and AffilStack builds the tracked link. Open Affiliate Networks in your dashboard to connect one. The number of connections depends on your plan.',
+        ],
+        [
+            'category' => 'features',
+            'question' => 'Can I use AffilStack in another language?',
+            'answer' => 'Yes. Pick a language from the menu at the bottom of the dashboard sidebar and the whole app switches — menus, pages and emails. Your products, contacts and generated content are never translated. To rewrite content itself for another market, use Localization.',
+        ],
+        [
+            'category' => 'features',
+            'question' => 'What is the Add-on Marketplace?',
+            'answer' => 'A place to add extra tools to your account: connected apps, template and prompt packs, and automation recipes for Zapier, Make and n8n, made by independent developers and reviewed by AffilStack before they go live. Many are free; paid add-ons are a monthly subscription you can cancel at any time from My add-ons.',
+        ],
+        [
+            'category' => 'features',
+            'question' => 'Can I build and sell add-ons?',
+            'answer' => 'Yes. Open the developer portal (the "Build an add-on" link on the Add-on Marketplace page) and sign in with your AffilStack account. Create a listing, submit it for review, and once it is approved it appears in the marketplace. You keep 70% of every paid subscription, paid out the same way as affiliate commissions.',
+        ],
+    ];
+
     public function run(): void
     {
         $items = [
@@ -53,13 +87,14 @@ public function run(): void
             [
                 'category' => 'features',
                 'question' => 'Where is the blog?',
-                'answer' => "Our blog lives on a separate site (look for the \"Blog\" link in the navigation) — it's where we publish guides and updates, separate from the in-app blog article generator you use to create your own content.",
+                'answer' => "Our blog lives on a separate site (look for the \"Blog\" link in the navigation) — it's where we publish guides and updates, separate from the in-app blog article generator you use to create your own content. To send the articles you generate to your own WordPress site, use WordPress Sites in your dashboard.",
             ],
             [
                 'category' => 'general',
                 'question' => 'How do I contact a real human for support?',
                 'answer' => 'Ask our AI assistant here in the chat — if it can\'t resolve your issue, it will offer to open a support ticket with our team, transcript included. You can also open a ticket directly from the Support page.',
             ],
+            ...self::NEW_FEATURE_FAQS,
         ];
 
         foreach ($items as $index => $item) {
diff --git a/database/seeders/HomepageFeaturesSeeder.php b/database/seeders/HomepageFeaturesSeeder.php
index f6a9577ee..cf6c95ecf 100644
--- a/database/seeders/HomepageFeaturesSeeder.php
+++ b/database/seeders/HomepageFeaturesSeeder.php
@@ -15,6 +15,36 @@ class HomepageFeaturesSeeder extends Seeder
 {
     use WithoutModelEvents;
 
+    /**
+     * Cards for features 4, 5 and 7, also added to existing sites by the
+     * 2026_10_22_202615 migration.
+     *
+     * @var array<int, array{icon: string, title: string, default_image: string, link_url: string, description: string}>
+     */
+    public const NEW_FEATURE_CARDS = [
+        [
+            'icon' => 'arrows-right-left',
+            'title' => 'Your affiliate networks, connected',
+            'default_image' => 'affiliate-networks.webp',
+            'link_url' => '/features/affiliate-networks',
+            'description' => 'Connect Impact, PartnerStack, Awin, CJ, ClickBank or Digistore24 — turn joined programs into products and import your commissions every day.',
+        ],
+        [
+            'icon' => 'globe-alt',
+            'title' => 'Straight to your WordPress site',
+            'default_image' => 'wordpress-publishing.webp',
+            'link_url' => '/features/wordpress-publishing',
+            'description' => 'The free AffilStack Connector plugin delivers every article as a draft, with images, SEO fields, FAQ schema and tracked links in place.',
+        ],
+        [
+            'icon' => 'puzzle-piece',
+            'title' => 'An add-on marketplace',
+            'default_image' => 'add-on-marketplace.webp',
+            'link_url' => '/features/add-on-marketplace',
+            'description' => 'Connected apps, template packs and automation recipes from independent developers, each one reviewed before it goes live.',
+        ],
+    ];
+
     public function run(): void
     {
         if (HomepageFeature::query()->exists()) {
@@ -78,6 +108,7 @@ public function run(): void
                 'link_url' => '/features/localization',
                 'description' => 'Regenerate any piece of content for a different country or language in one click — currency, culture, and compliance included.',
             ],
+            ...self::NEW_FEATURE_CARDS,
             [
                 'icon' => 'banknotes',
                 'title' => 'Earn by sharing it, too',
diff --git a/database/seeders/PlansSeeder.php b/database/seeders/PlansSeeder.php
index 5f4e170de..9496c836e 100644
--- a/database/seeders/PlansSeeder.php
+++ b/database/seeders/PlansSeeder.php
@@ -56,6 +56,8 @@ public function run(): void
             [
                 'name' => 'Starter',
                 'slug' => 'starter',
+                'wordpress_sites_limit' => 1,
+                'network_connections_limit' => 1,
                 'description' => 'For beginners testing their first offer.',
                 'price_monthly_cents' => 1900,
                 'credits_per_month' => 200,
@@ -69,6 +71,8 @@ public function run(): void
             [
                 'name' => 'Growth',
                 'slug' => 'growth',
+                'wordpress_sites_limit' => 3,
+                'network_connections_limit' => 3,
                 'description' => 'For affiliates running multiple offers across every channel.',
                 'price_monthly_cents' => 5900,
                 'credits_per_month' => 700,
@@ -82,6 +86,8 @@ public function run(): void
             [
                 'name' => 'Pro',
                 'slug' => 'pro',
+                'wordpress_sites_limit' => 10,
+                'network_connections_limit' => -1,
                 'description' => 'For full-time affiliates and small teams.',
                 'price_monthly_cents' => 14900,
                 'credits_per_month' => 2200,
@@ -95,6 +101,8 @@ public function run(): void
             [
                 'name' => 'Business',
                 'slug' => 'business',
+                'wordpress_sites_limit' => 10,
+                'network_connections_limit' => -1,
                 'description' => 'For an in-house team collaborating on one brand — every seat shares the whole offer list.',
                 'price_monthly_cents' => 24900,
                 'credits_per_month' => 4000,
@@ -109,6 +117,8 @@ public function run(): void
             [
                 'name' => 'Agency',
                 'slug' => 'agency',
+                'wordpress_sites_limit' => -1,
+                'network_connections_limit' => -1,
                 'description' => 'For agencies managing client affiliate accounts.',
                 'price_monthly_cents' => 39900,
                 'credits_per_month' => 7000,
diff --git a/package-lock.json b/package-lock.json
index 9157808f8..b86a79dfb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4,6 +4,7 @@
     "requires": true,
     "packages": {
         "": {
+            "name": "app",
             "devDependencies": {
                 "@tailwindcss/vite": "^4.0.0",
                 "concurrently": "^10.0.3",
@@ -105,19 +106,19 @@
             }
         },
         "node_modules/@oxc-project/types": {
-            "version": "0.147.0",
-            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.147.0.tgz",
-            "integrity": "sha512-IJ3s6ltHLp45S0bh7phkX+gJO7A1Wuz2EaqpAhb8WjqDwbzMiWKHhyyT42tskaWjEYXtHtVCPpnBJVT9+dcRLg==",
+            "version": "0.155.0",
+            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.155.0.tgz",
+            "integrity": "sha512-SeE8JPwW1xs1tHeNycjUtUBdhorRa8o4jlvjwk49R7/Z291i+4DQa7JJIgOm/TaYQZx+QrPQbVJ/9c8dMIZN8Q==",
             "dev": true,
             "license": "MIT",
             "funding": {
-                "url": "https://github.com/sponsors/Boshen"
+                "url": "https://github.com/sponsors/oxc-project"
             }
         },
         "node_modules/@rolldown/binding-android-arm-eabi": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.6.tgz",
-            "integrity": "sha512-b+jTcARdTiFLI6jB4a5XjTm0RWd6KcRfQj/I2356fxUZemiho9zQLxo0RtCuMDAyKcLo6cEltkgbQp6d1+sjjQ==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.15.tgz",
+            "integrity": "sha512-aLcgK9gIJ3YRvrrtfSBbRa27F5WrpiTaPulnFpsHPxpUHgFlSgnU4854MHwoRGEBhfRJDWCS2WQ7lIjskE9Olw==",
             "cpu": [
                 "arm"
             ],
@@ -132,9 +133,9 @@
             }
         },
         "node_modules/@rolldown/binding-android-arm64": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.6.tgz",
-            "integrity": "sha512-lkWU8ZJaRk9q3CIEY1Tc7vIFALp3Xw5NfGJo2hQg5oIqNgxWi1zI+IiDEK3r70BF5Dzol1tcXsnzsRc8NLhG+Q==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.15.tgz",
+            "integrity": "sha512-xD7DdZCrbThKuxNg7ooQmvp07ys4J/pnSEMTG3/OdOWl6daC67m/Q4fL78sRHMxTH/N4fGUbYhcPM0MF5WFHkg==",
             "cpu": [
                 "arm64"
             ],
@@ -149,9 +150,9 @@
             }
         },
         "node_modules/@rolldown/binding-darwin-arm64": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.6.tgz",
-            "integrity": "sha512-dgR56NYnvAszm7Ob1B2/Vn0e8bUQYZH2UjVaMMtMVOCKFSfjhfLmuA/9+O+F+ajUdG6B/bSssrKW6JJYASa8jA==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.15.tgz",
+            "integrity": "sha512-m2WuQ6r0B4OTYxyPpNLtXaMRbRDUbG8YQV2Q3KTdSSK8Th6KHCnC8jVCJt8bvYeSB5WivkkNbc85mKadaSdOxA==",
             "cpu": [
                 "arm64"
             ],
@@ -166,9 +167,9 @@
             }
         },
         "node_modules/@rolldown/binding-darwin-x64": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.6.tgz",
-            "integrity": "sha512-vpVxFvUCFioJqug7OTvqptkc4yb8UX0AwfDmJpaR/0sWz+BUmqSVAf7c8JkUgnN8YLspb4a/N6NhTyMAmdyQ7Q==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.15.tgz",
+            "integrity": "sha512-5RtnsHM36nodM9WbMy+zip0LGS/G+y5wro5RHrpOlr4ac24+1zSi9kiV2MP1myZeZ/ifEHfulQcWjnAXzc2C2A==",
             "cpu": [
                 "x64"
             ],
@@ -183,9 +184,9 @@
             }
         },
         "node_modules/@rolldown/binding-freebsd-x64": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.6.tgz",
-            "integrity": "sha512-h1wG6Y6K3JlRswxsI64qQJqBAy4vrLuHgRbc8CZMGSWTOFRY6ghMApM1NKzB2I0n5xV1fjkE18SuVl2QpLeNpA==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.15.tgz",
+            "integrity": "sha512-g3l09pyFqhu+135JKkbkwiKGQmwU5hUMUPJ4VdBADvuqR8d33L6H578rh8m7rtxbdp+VmX/+nzI7nvhSZlzpUQ==",
             "cpu": [
                 "x64"
             ],
@@ -200,9 +201,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.6.tgz",
-            "integrity": "sha512-tbCiqub0q2MVWJKgF5PoAlNWCtQydiOYSLIkd8sByqK/6MMYLJRcSXSYodqYtd0O+Fw7QaVmKKlS4oL94YRZ0w==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.15.tgz",
+            "integrity": "sha512-nIe3VugI97nGQtspPxDqA4sXMUpeiocKIP/CqpY/u/vgbT+alX+cVxu1C/oVBPKg4feNTmYovE91v4DgXvXNwQ==",
             "cpu": [
                 "arm"
             ],
@@ -217,9 +218,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-arm64-gnu": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.6.tgz",
-            "integrity": "sha512-oxK9+baEBPhZG5HB4URY+uU04zJWeZlH6Tb9rB5DK4DF9XR1uXNLXt5Q5ZsugTKayNCNLhkcwz/ye74hRI98dg==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.15.tgz",
+            "integrity": "sha512-iTBjXx+B5QSvgI89lJfmqh4wTh8NabR1YZIIN3hNx4zSG0EVfVqkOvLulNpG4251pbd6/IAmZ/LefVk1Y4rPhw==",
             "cpu": [
                 "arm64"
             ],
@@ -234,9 +235,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-arm64-musl": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.6.tgz",
-            "integrity": "sha512-muWCk27FVBEZtv0MsK8gnfSmgczA8KQ0uRVJbTABKhkRfQc38aUrcb7fhi3BNiyseFmgcRsoMfQsSNJ+DbZdSw==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.15.tgz",
+            "integrity": "sha512-uN26XOnVR7rqQupG3V9oAG2EGGatWjcJHOeDOHUFCh4TBWmP2tHTFoVN13aYbwfm0aHqJAEmcwhAu6sooIjfqQ==",
             "cpu": [
                 "arm64"
             ],
@@ -251,9 +252,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.6.tgz",
-            "integrity": "sha512-eWDoSfU7Co2qj3vgB3Dt4lj1mG6CoWbcJQkRMP3XJplyCMtuaq3LHvPFjS9QIPvMGWVadJC04Xiy0IdcVPtnwQ==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.15.tgz",
+            "integrity": "sha512-9nWkcdd+H+XhaA3fQIwpHnKIrfx/PQ6rO0pivr78Og07tXlUlctBBJoEYLPfhTmCR/QxEVdn6uPjHV5SymPhdw==",
             "cpu": [
                 "ppc64"
             ],
@@ -268,9 +269,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-s390x-gnu": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.6.tgz",
-            "integrity": "sha512-2bWNjRSIayvupRKxXUY2tWG9fYdoUlTqWywHRvE8Eq3GvuQ+f2HeIkve697fIt+IQs/PV8yFsdWuhp1aJ1PdnA==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.15.tgz",
+            "integrity": "sha512-Ggh0ciFjLwIusLSLz7LZYEaGdxOAUJXI+Qu5JCbhPJJHEt8vP+IjRATTJheiJsdzzTYgUiHUiw3X1Ea3ZpMBdA==",
             "cpu": [
                 "s390x"
             ],
@@ -285,9 +286,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-x64-gnu": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.6.tgz",
-            "integrity": "sha512-KekI0gS0wLxe1UBSQSjenBVwou/JkcQPDzBPICGZjxUv9k3RteHDPBQaiOicZUFKRIH2wKEimGwVpnJsbPzu7w==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.15.tgz",
+            "integrity": "sha512-FHg60rS6DBePAYZ9X9F67x+JObFdmgn6tupA1C/a3B+CufFmTD4mX+e8M75tCiAO3foR/6xwVBI0KQiI7sn/rw==",
             "cpu": [
                 "x64"
             ],
@@ -302,9 +303,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-x64-musl": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.6.tgz",
-            "integrity": "sha512-TvtPnfVr+HtyGiDmPK4VWmlNm7QhNNAcK5Q9A7aOXsI8545yCyaoMaicXrFZ72JzeYjaUVk7yT243zT0jzjFKQ==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.15.tgz",
+            "integrity": "sha512-/cvV/7v5VGz/moiz0XKRj2dE8DzsKyhIu1KpOvJGPjRywg3yscON889UGvAe8zfiJLHup7VLjBduoGWi3HusWQ==",
             "cpu": [
                 "x64"
             ],
@@ -319,9 +320,9 @@
             }
         },
         "node_modules/@rolldown/binding-openharmony-arm64": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.6.tgz",
-            "integrity": "sha512-iOo0VEay2XFhaCcH0sps5XIimkSuOnNaZrf6+ZkoSOQBJPKNU48RkmJv0/lSpipexu5P+ouFgafe5IGr/DiQfg==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.15.tgz",
+            "integrity": "sha512-MyzC5Hrv/sm+Z7TSGKP/j8001RO2xQm1zOpCNVL4j0cY/VhBZviludA2YFQ7i4lH6ZAXxQm0lcMdBzM+99mE7w==",
             "cpu": [
                 "arm64"
             ],
@@ -336,9 +337,9 @@
             }
         },
         "node_modules/@rolldown/binding-win32-arm64-msvc": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.6.tgz",
-            "integrity": "sha512-y5NTmmasMS455JlOCO4ZM9krIchv3Mvm1crL1iUPGOPgEzSkves9n0SdC5Sjz6+qWDFhd8/JpfWMH8NSWNHe+A==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.15.tgz",
+            "integrity": "sha512-+PgYiS+AH5omy6L45ZLxybasauJaj3M8buoT83D+nzPmCayXlxUV9hydhciCKVyIg0B/v0BtXPDE1uGqNwCPpg==",
             "cpu": [
                 "arm64"
             ],
@@ -353,9 +354,9 @@
             }
         },
         "node_modules/@rolldown/binding-win32-x64-msvc": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.6.tgz",
-            "integrity": "sha512-np8iZSLfXlAD4kWhiyq/u0Yt8oZDtRQ8lGhQaCXo2rl37KNjeU0GjJuwr4P3oeZ++ROfofsKNBqR5LTO8aXyWQ==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.15.tgz",
+            "integrity": "sha512-HFZd2QNQYn1JbIi+Hpd7H+r/lkWxcfIu28nirZ6eCn2LafuvmExMlb/P96Sfx5tf7pPArw39IdhmCF8vmV+NhQ==",
             "cpu": [
                 "x64"
             ],
@@ -837,15 +838,15 @@
             }
         },
         "node_modules/concurrently": {
-            "version": "10.0.5",
-            "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-10.0.5.tgz",
-            "integrity": "sha512-JaP/CoftUrCcAFW/g//RbgEGwlelnEae6cfBLgH6ZdO6s8jPkn6p9SB9u6pdVxYXoiSnFqseOlHfrEfF82TVOg==",
+            "version": "10.0.6",
+            "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-10.0.6.tgz",
+            "integrity": "sha512-qgICXXFp2/3nAebRLmxcINKEXM1mLK3ij/y31P02VTs/KIkddIeC05n73DxOXsXMB9LFSqNU1/na3lDlOhcbIw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "chalk": "5.6.2",
                 "rxjs": "7.8.2",
-                "shell-quote": "1.9.0",
+                "shell-quote": "1.12.0",
                 "supports-color": "10.2.2",
                 "tree-kill": "1.2.2",
                 "yargs": "18.0.0"
@@ -1425,9 +1426,9 @@
             }
         },
         "node_modules/nanoid": {
-            "version": "3.3.18",
-            "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
-            "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
+            "version": "3.3.20",
+            "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz",
+            "integrity": "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==",
             "dev": true,
             "funding": [
                 {
@@ -1490,9 +1491,9 @@
             }
         },
         "node_modules/postcss": {
-            "version": "8.5.26",
-            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
-            "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
+            "version": "8.5.31",
+            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.31.tgz",
+            "integrity": "sha512-YUbWYCgErwnMAVkjUnYa+KlMBzGpHwiIt/DE7f0G33AuX2LH9UcTk6KgWxd3zRU+pN3u/C+Xl3EnMLM4Hea7Sg==",
             "dev": true,
             "funding": [
                 {
@@ -1510,9 +1511,9 @@
             ],
             "license": "MIT",
             "dependencies": {
-                "nanoid": "^3.3.17",
+                "nanoid": "^3.3.20",
                 "picocolors": "^1.1.1",
-                "source-map-js": "^1.2.1"
+                "source-map-js": "^1.2.2"
             },
             "engines": {
                 "node": "^10 || ^12 || >=14"
@@ -1562,13 +1563,13 @@
             }
         },
         "node_modules/rolldown": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.6.tgz",
-            "integrity": "sha512-vMM4q3aixf46GiF1Kok8jDPFsEpXgFWGjUHXNkNHNm+Y2adXAG2dbX91jkti3i0ZRsOlcmbuzAz1poObSHCmUA==",
+            "version": "1.2.15",
+            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.15.tgz",
+            "integrity": "sha512-6odND+fel5zVw3I4Yc2e69gvguDnX0CAAGiNDZSq4ik5WUcaLrkD2GLuog0XcODbor31hZ5ayEMgVDno+KPV5g==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@oxc-project/types": "=0.147.0",
+                "@oxc-project/types": "=0.155.0",
                 "@rolldown/pluginutils": "^1.0.0"
             },
             "bin": {
@@ -1578,21 +1579,21 @@
                 "node": "^20.19.0 || >=22.12.0"
             },
             "optionalDependencies": {
-                "@rolldown/binding-android-arm-eabi": "1.2.6",
-                "@rolldown/binding-android-arm64": "1.2.6",
-                "@rolldown/binding-darwin-arm64": "1.2.6",
-                "@rolldown/binding-darwin-x64": "1.2.6",
-                "@rolldown/binding-freebsd-x64": "1.2.6",
-                "@rolldown/binding-linux-arm-gnueabihf": "1.2.6",
-                "@rolldown/binding-linux-arm64-gnu": "1.2.6",
-                "@rolldown/binding-linux-arm64-musl": "1.2.6",
-                "@rolldown/binding-linux-ppc64-gnu": "1.2.6",
-                "@rolldown/binding-linux-s390x-gnu": "1.2.6",
-                "@rolldown/binding-linux-x64-gnu": "1.2.6",
-                "@rolldown/binding-linux-x64-musl": "1.2.6",
-                "@rolldown/binding-openharmony-arm64": "1.2.6",
-                "@rolldown/binding-win32-arm64-msvc": "1.2.6",
-                "@rolldown/binding-win32-x64-msvc": "1.2.6"
+                "@rolldown/binding-android-arm-eabi": "1.2.15",
+                "@rolldown/binding-android-arm64": "1.2.15",
+                "@rolldown/binding-darwin-arm64": "1.2.15",
+                "@rolldown/binding-darwin-x64": "1.2.15",
+                "@rolldown/binding-freebsd-x64": "1.2.15",
+                "@rolldown/binding-linux-arm-gnueabihf": "1.2.15",
+                "@rolldown/binding-linux-arm64-gnu": "1.2.15",
+                "@rolldown/binding-linux-arm64-musl": "1.2.15",
+                "@rolldown/binding-linux-ppc64-gnu": "1.2.15",
+                "@rolldown/binding-linux-s390x-gnu": "1.2.15",
+                "@rolldown/binding-linux-x64-gnu": "1.2.15",
+                "@rolldown/binding-linux-x64-musl": "1.2.15",
+                "@rolldown/binding-openharmony-arm64": "1.2.15",
+                "@rolldown/binding-win32-arm64-msvc": "1.2.15",
+                "@rolldown/binding-win32-x64-msvc": "1.2.15"
             }
         },
         "node_modules/rxjs": {
@@ -1613,9 +1614,9 @@
             "optional": true
         },
         "node_modules/shell-quote": {
-            "version": "1.9.0",
-            "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
-            "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
+            "version": "1.12.0",
+            "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.12.0.tgz",
+            "integrity": "sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -1650,9 +1651,9 @@
             }
         },
         "node_modules/source-map-js": {
-            "version": "1.2.1",
-            "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-            "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+            "version": "1.2.2",
+            "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+            "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
             "dev": true,
             "license": "BSD-3-Clause",
             "engines": {
@@ -1816,16 +1817,16 @@
             }
         },
         "node_modules/vite": {
-            "version": "8.2.2",
-            "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.2.tgz",
-            "integrity": "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q==",
+            "version": "8.3.5",
+            "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.5.tgz",
+            "integrity": "sha512-z1YpjieJ9g0ebTmQpLBv/oq9E3F9EIlOe+7LahW8SrE3LTiG3udBRUXQOlYXP9b+IC2q2phHeVxj9xGlw34OEQ==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "lightningcss": "^1.33.0",
-                "picomatch": "^4.0.5",
-                "postcss": "^8.5.26",
-                "rolldown": "~1.2.4",
+                "picomatch": "^4.0.7",
+                "postcss": "^8.5.30",
+                "rolldown": "~1.2.14",
                 "tinyglobby": "^0.2.17"
             },
             "bin": {
@@ -1842,7 +1843,7 @@
             },
             "peerDependencies": {
                 "@types/node": "^20.19.0 || >=22.12.0",
-                "@vitejs/devtools": "^0.4.0 || ^0.5.0",
+                "@vitejs/devtools": "^0.7.1 || ^0.8.0",
                 "esbuild": "^0.27.0 || ^0.28.0",
                 "jiti": ">=1.21.0",
                 "less": "^4.0.0",
diff --git a/phpunit.xml b/phpunit.xml
index e7f0a48df..18a589695 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -32,5 +32,6 @@
         <env name="PULSE_ENABLED" value="false"/>
         <env name="TELESCOPE_ENABLED" value="false"/>
         <env name="NIGHTWATCH_ENABLED" value="false"/>
+        <env name="PHP_RELEASE_CHECK" value="false"/>
     </php>
 </phpunit>
diff --git a/public/.htaccess b/public/.htaccess
index 0e5ee3e06..9a102ca04 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -12,6 +12,52 @@
     </IfModule>
 </FilesMatch>
 
+# Only index.php may ever run as PHP. Anything else that looks like code —
+# a web shell dropped after an attack such as PHP2Shell, or a file someone
+# managed to upload — is refused instead of executed.
+<FilesMatch "\.(php[0-9]?|phtml|pht|phar|phps|pgif|shtml|cgi|pl|py|sh|inc)$">
+    <IfModule mod_authz_core.c>
+        Require all denied
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order allow,deny
+        Deny from all
+    </IfModule>
+</FilesMatch>
+<Files "index.php">
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order allow,deny
+        Allow from all
+    </IfModule>
+</Files>
+
+# Release packages and backups are never downloadable, even for the
+# moment one sits here during a deploy.
+<FilesMatch "\.(zip|tar|tgz|gz|sql|bak|log)$">
+    <IfModule mod_authz_core.c>
+        Require all denied
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order allow,deny
+        Deny from all
+    </IfModule>
+</FilesMatch>
+
+# Feature demo videos: some servers send WebM as plain text, which
+# browsers refuse to play with nosniff on.
+<IfModule mod_mime.c>
+    AddType video/webm .webm
+    AddType video/mp4 .mp4
+</IfModule>
+
+# Requests over 40 MB are refused by the web server before PHP reads them
+# (AffilStack's biggest form is about 25 MB) — keeps oversized multipart
+# bodies, PHP2Shell's memory-exhaustion path, away from PHP.
+LimitRequestBody 41943040
+
 # Static files (built CSS/JS, robots.txt, images) are served by Apache
 # directly and never reach App\Http\Middleware\SecurityHeaders, so the one
 # header HawkScan flagged as missing on them is set here instead.
@@ -41,6 +87,11 @@
     RewriteCond %{HTTP:x-xsrf-token} .
     RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]
 
+    # Same rule for servers that skip <Files> sections: any address ending
+    # in a code extension, other than /index.php itself, is refused.
+    RewriteCond %{REQUEST_URI} !^/index\.php$ [NC]
+    RewriteRule \.(php[0-9]?|phtml|pht|phar|phps|pgif|shtml|cgi|pl|py|sh|inc)$ - [F,L,NC]
+
     # Redirect Trailing Slashes If Not A Folder...
     RewriteCond %{REQUEST_FILENAME} !-d
     RewriteCond %{REQUEST_URI} (.+)/$
diff --git a/public/.user.ini b/public/.user.ini
new file mode 100644
index 000000000..21aa7bccc
--- /dev/null
+++ b/public/.user.ini
@@ -0,0 +1,17 @@
+; PHP2Shell hardening (CVE-2026-109618 / CVE-2026-109619), read by PHP-FPM,
+; CGI and LiteSpeed for this website. Only settings PHP accepts here, so it
+; never produces the start-up warnings PHP2Shell abuses. Updating PHP to
+; 8.4.27 / 8.5.12 or newer is the real fix — these narrow the attack paths
+; for any future bug of the same kind.
+
+; AffilStack doesn't use upload progress; PHP2Shell is reached through it.
+session.upload_progress.enabled = 0
+
+; Deeply nested form fields only exist to exhaust memory.
+max_input_nesting_level = 16
+
+; Request size: the largest upload AffilStack accepts is 12 MB (one file) and
+; about 25 MB in one form, so anything bigger is refused before PHP parses it
+; (PHP2Shell's memory-exhaustion path needs large multipart requests).
+upload_max_filesize = 16M
+post_max_size = 40M
diff --git a/public/images/features/add-on-marketplace.webp b/public/images/features/add-on-marketplace.webp
new file mode 100644
index 000000000..f4412e5b7
Binary files /dev/null and b/public/images/features/add-on-marketplace.webp differ
diff --git a/public/images/features/affiliate-networks.webp b/public/images/features/affiliate-networks.webp
new file mode 100644
index 000000000..e03e9b122
Binary files /dev/null and b/public/images/features/affiliate-networks.webp differ
diff --git a/public/images/features/multi-language.webp b/public/images/features/multi-language.webp
new file mode 100644
index 000000000..1f44e7fbf
Binary files /dev/null and b/public/images/features/multi-language.webp differ
diff --git a/public/images/features/network-programs.webp b/public/images/features/network-programs.webp
new file mode 100644
index 000000000..c42da8de2
Binary files /dev/null and b/public/images/features/network-programs.webp differ
diff --git a/public/images/features/template-library.webp b/public/images/features/template-library.webp
new file mode 100644
index 000000000..39291b04c
Binary files /dev/null and b/public/images/features/template-library.webp differ
diff --git a/public/images/features/wordpress-publishing.webp b/public/images/features/wordpress-publishing.webp
new file mode 100644
index 000000000..a42b91abc
Binary files /dev/null and b/public/images/features/wordpress-publishing.webp differ
diff --git a/resources/views/billing/index.blade.php b/resources/views/billing/index.blade.php
index 84c1e3385..bc5dc41d4 100644
--- a/resources/views/billing/index.blade.php
+++ b/resources/views/billing/index.blade.php
@@ -57,6 +57,12 @@
                     <li>{{ number_format($plan->credits_per_month) }} AI credits / month</li>
                     <li>{{ $plan->contact_limit === 0 ? 'Unlimited' : number_format($plan->contact_limit) }} CRM contacts</li>
                     <li>{{ $plan->team_seats }} team seat{{ $plan->team_seats > 1 ? 's' : '' }}</li>
+                    @if ((int) $plan->wordpress_sites_limit !== 0)
+                        <li>@if ((int) $plan->wordpress_sites_limit < 0) Unlimited WordPress sites @elseif ((int) $plan->wordpress_sites_limit === 1) 1 WordPress site @else {{ $plan->wordpress_sites_limit }} WordPress sites @endif</li>
+                    @endif
+                    @if ((int) $plan->network_connections_limit !== 0)
+                        <li>@if ((int) $plan->network_connections_limit < 0) Unlimited affiliate network connections @elseif ((int) $plan->network_connections_limit === 1) 1 affiliate network connection @else {{ $plan->network_connections_limit }} affiliate network connections @endif</li>
+                    @endif
                 </ul>
                 <form method="POST" action="{{ route('billing.checkout', $plan) }}" class="space-y-2">
                     @csrf
diff --git a/resources/views/dashboard/networks/index.blade.php b/resources/views/dashboard/networks/index.blade.php
index ef3985e57..9e35354f4 100644
--- a/resources/views/dashboard/networks/index.blade.php
+++ b/resources/views/dashboard/networks/index.blade.php
@@ -77,7 +77,7 @@
                             <dd class="font-medium text-navy-900">{{ $connection->last_synced_at ? $connection->last_synced_at->diffForHumans() : ($connection->status === 'error' ? 'Not yet' : 'Running now…') }}</dd>
                         </div>
                         @if ($connection->last_synced_at && ($connection->last_sync_new || $connection->last_sync_updated))
-                            <div class="col-span-2 text-ink-600">{{ $connection->last_sync_new }} new and {{ $connection->last_sync_updated }} updated {{ \Illuminate\Support\Str::plural('commission', $connection->last_sync_new + $connection->last_sync_updated) }} in that sync.</div>
+                            <div class="col-span-2 text-ink-600">@if ($connection->last_sync_new + $connection->last_sync_updated === 1) {{ $connection->last_sync_new }} new and {{ $connection->last_sync_updated }} updated commission in that sync. @else {{ $connection->last_sync_new }} new and {{ $connection->last_sync_updated }} updated commissions in that sync. @endif</div>
                         @endif
                     </dl>
 
@@ -122,7 +122,7 @@
     <div class="mt-8 grid gap-4 md:grid-cols-3">
         <div class="rounded-2xl border border-line bg-surface p-5">
             <p class="flex items-center gap-2 text-sm font-semibold text-navy-900"><x-heroicon-o-banknotes class="h-4 w-4 text-brand-600" /> Earnings, every day</p>
-            <p class="mt-1.5 text-xs leading-relaxed text-ink-600">Commissions and their status (pending, approved, paid, reversed) sync daily into <a href="{{ route('earnings.index') }}" class="font-medium text-brand-600 hover:text-brand-700">Earnings</a>.{{ $earningsCount ? ' '.number_format($earningsCount).' imported so far.' : '' }}</p>
+            <p class="mt-1.5 text-xs leading-relaxed text-ink-600">Commissions and their status (pending, approved, paid, reversed) sync daily into <a href="{{ route('earnings.index') }}" class="font-medium text-brand-600 hover:text-brand-700">Earnings</a>.@if ($earningsCount) {{ number_format($earningsCount) }} imported so far.@endif</p>
         </div>
         <div class="rounded-2xl border border-line bg-surface p-5">
             <p class="flex items-center gap-2 text-sm font-semibold text-navy-900"><x-heroicon-o-link class="h-4 w-4 text-brand-600" /> Network tracked links</p>
diff --git a/resources/views/filament/pages/documentation/guides/site-analytics.blade.php b/resources/views/filament/pages/documentation/guides/site-analytics.blade.php
index 14115cc1d..692cbd53a 100644
--- a/resources/views/filament/pages/documentation/guides/site-analytics.blade.php
+++ b/resources/views/filament/pages/documentation/guides/site-analytics.blade.php
@@ -26,7 +26,7 @@
             </ul>
         </x-docs.step>
         <x-docs.step title="Add the scopes to Data Access">
-            <p><x-docs.ui>Google Auth Platform</x-docs.ui> → <x-docs.ui>Data Access</x-docs.ui> → <x-docs.ui>Add or remove scopes</x-docs.ui> → add <code>.../auth/analytics.edit</code>, <code>.../auth/webmasters</code>, <code>.../auth/tagmanager.edit.containers</code>, <code>.../auth/tagmanager.publish</code> → <x-docs.ui>Update</x-docs.ui> → <x-docs.ui>Save</x-docs.ui>.</p>
+            <p><x-docs.ui>Google Auth Platform</x-docs.ui> → <x-docs.ui>Data Access</x-docs.ui> → <x-docs.ui>Add or remove scopes</x-docs.ui> → add <code>.../auth/analytics.edit</code>, <code>.../auth/webmasters</code>, <code>.../auth/siteverification.verify_only</code>, <code>.../auth/tagmanager.edit.containers</code>, <code>.../auth/tagmanager.publish</code> → <x-docs.ui>Update</x-docs.ui> → <x-docs.ui>Save</x-docs.ui>.</p>
             <x-docs.callout type="info" title="Only you use this connection">
                 These are "sensitive" scopes, but only the admin connects them, once. Until Google verifies them (you'll do that anyway for Gmail/YouTube), Google shows "Google hasn't verified this app" — click <x-docs.ui>Advanced</x-docs.ui> → <x-docs.ui>Go to AffilStack (unsafe)</x-docs.ui>. It's your own app, so that's safe.
             </x-docs.callout>
diff --git a/resources/views/filament/security/php-runtime-banner.blade.php b/resources/views/filament/security/php-runtime-banner.blade.php
new file mode 100644
index 000000000..9bef55983
--- /dev/null
+++ b/resources/views/filament/security/php-runtime-banner.blade.php
@@ -0,0 +1,10 @@
+@php
+    $problem = collect(\App\Support\Security\PhpRuntime::problemsFor($web['version'], false, $web['build_date'] ?? null))->firstWhere('severity', 'critical');
+@endphp
+@if ($problem)
+    <div role="alert" style="margin-bottom:1rem;border-radius:.75rem;border:1px solid #fecaca;background:#fef2f2;padding:.875rem 1rem;color:#7f1d1d;font-size:.875rem;line-height:1.5">
+        <strong style="display:block;font-size:.9375rem">{{ $problem['title'] }}</strong>
+        <span>{{ $problem['detail'] }}</span>
+        <a href="{{ route('filament.admin.resources.security-findings.index') }}" style="margin-left:.25rem;font-weight:600;text-decoration:underline;color:#991b1b">Security Center</a>
+    </div>
+@endif
diff --git a/resources/views/marketing/about.blade.php b/resources/views/marketing/about.blade.php
index 3d3512115..0d38e4fe7 100644
--- a/resources/views/marketing/about.blade.php
+++ b/resources/views/marketing/about.blade.php
@@ -30,6 +30,7 @@
         ['icon' => 'video-camera', 'title' => 'UGC video', 'description' => 'Turn a script into a human-avatar video without a camera, an actor, or an editor.'],
         ['icon' => 'user-group', 'title' => 'Built-in CRM & tracking', 'description' => 'Every lead, click, and sale tracked automatically in one place.'],
         ['icon' => 'credit-card', 'title' => 'Payments & payouts', 'description' => 'Multi-gateway checkout for your customers, and a real payout workflow for your own affiliates.'],
+        ['icon' => 'puzzle-piece', 'title' => 'An open platform', 'description' => 'Connections to your affiliate networks and WordPress site, an API, and a marketplace where developers build and sell add-ons.'],
     ];
     $whatWeDo = $decode(\App\Models\SiteSetting::get('about_what_we_do', '[]'));
     $whatWeDo = ! empty($whatWeDo) ? $whatWeDo : $defaultWhatWeDo;
diff --git a/resources/views/marketing/home.blade.php b/resources/views/marketing/home.blade.php
index 2f5e14ee9..653dd3dc0 100644
--- a/resources/views/marketing/home.blade.php
+++ b/resources/views/marketing/home.blade.php
@@ -34,9 +34,12 @@
         ['icon' => 'pencil-square', 'title' => 'AI content engine', 'description' => 'Blog articles, LinkedIn posts, YouTube scripts, X threads and Pinterest pins, written from your product and ready to publish.'],
         ['icon' => 'video-camera', 'title' => 'UGC & TikTok video', 'description' => 'Turn a script into a human-avatar video your audience actually watches — no camera, actor or editing needed.'],
         ['icon' => 'chart-bar', 'title' => 'Link tracking & earnings', 'description' => 'Branded tracking links show every click, lead and commission, so you double down on what is paying.'],
+        ['icon' => 'arrows-right-left', 'title' => 'Affiliate network connections', 'description' => 'Connect Impact, PartnerStack, Awin, CJ, ClickBank or Digistore24 and import programs, tracked links and commissions.'],
+        ['icon' => 'globe-alt', 'title' => 'WordPress publishing', 'description' => 'Send every article to your WordPress site as a draft, with images, SEO fields and tracked links in place.'],
+        ['icon' => 'puzzle-piece', 'title' => 'Add-on marketplace', 'description' => 'Apps, template packs and automation recipes from independent developers, reviewed before they go live.'],
     ];
 
-    $metaDescriptionDefault = $siteName.' is the all-in-one AI platform for affiliate marketers: research any product, find buyers on Google Maps and LinkedIn, run AI email campaigns and content, and track every click and commission.';
+    $metaDescriptionDefault = $siteName.' is the all-in-one AI platform for affiliate marketers: research any product, find buyers on Google Maps and LinkedIn, run AI email campaigns and content, publish to WordPress, connect your affiliate networks and track every click and commission.';
 
     $jsonLd = [
         '@context' => 'https://schema.org',
diff --git a/resources/views/marketing/home/hero.blade.php b/resources/views/marketing/home/hero.blade.php
index ccb452c58..e09f54ddf 100644
--- a/resources/views/marketing/home/hero.blade.php
+++ b/resources/views/marketing/home/hero.blade.php
@@ -6,7 +6,7 @@
     $heroImageAlt = trim((string) \App\Models\SiteSetting::get('hero_image_alt', '')) ?: HomepageContent::plain(HomepageContent::text('hero_headline'));
     $primaryUrl = HomepageContent::url('home_hero_primary_url', route('registration.pricing'));
     $secondaryUrl = HomepageContent::url('home_hero_secondary_url', '#how-it-works');
-    $worksWith = ['googlemaps' => 'Google Maps', 'linkedin' => 'LinkedIn', 'gmail' => 'Gmail', 'youtube' => 'YouTube', 'tiktok' => 'TikTok', 'x' => 'X', 'pinterest' => 'Pinterest', 'wordpress' => 'WordPress'];
+    $worksWith = ['googlemaps' => 'Google Maps', 'linkedin' => 'LinkedIn', 'gmail' => 'Gmail', 'youtube' => 'YouTube', 'tiktok' => 'TikTok', 'x' => 'X', 'pinterest' => 'Pinterest', 'wordpress' => 'WordPress', 'zapier' => 'Zapier', 'make' => 'Make'];
 @endphp
 
 <section id="hero" class="relative isolate overflow-hidden bg-navy-950 text-white" aria-labelledby="hero-heading">
diff --git a/resources/views/partials/seo/head.blade.php b/resources/views/partials/seo/head.blade.php
index 9005648b3..60408ad77 100644
--- a/resources/views/partials/seo/head.blade.php
+++ b/resources/views/partials/seo/head.blade.php
@@ -17,8 +17,8 @@
         'robots' => $sectionText('robots'),
         'body' => $__env->yieldContent('content').$__env->yieldPushContent('head'),
     ]);
-    $gscVerification = \App\Models\SiteSetting::get('seo_gsc_verification');
-    $bingVerification = \App\Models\BingWebmasterSetting::cachedVerificationCode();
+    $gscVerification = \App\Support\Seo\SiteVerificationCode::normalize(\App\Models\SiteSetting::get('seo_gsc_verification'));
+    $bingVerification = \App\Support\Seo\SiteVerificationCode::normalize(\App\Models\BingWebmasterSetting::cachedVerificationCode());
 ?>
 <title>{{ $seo['title'] }}</title>
 @if ($seo['description'])
diff --git a/resources/views/registration/pricing.blade.php b/resources/views/registration/pricing.blade.php
index ded943ba8..4a82960d2 100644
--- a/resources/views/registration/pricing.blade.php
+++ b/resources/views/registration/pricing.blade.php
@@ -42,6 +42,12 @@
                                 <x-heroicon-m-check-circle class="mt-0.5 h-4 w-4 shrink-0 text-emerald-500" aria-hidden="true" />
                                 <span>{{ $plan->team_seats }} team seat{{ $plan->team_seats > 1 ? 's' : '' }}@if ($plan->isSharedTeamPlan()) — shared across your whole offer list @endif</span>
                             </li>
+                            @if ((int) $plan->wordpress_sites_limit !== 0)
+                                <li class="flex items-start gap-2"><x-heroicon-m-check-circle class="mt-0.5 h-4 w-4 shrink-0 text-emerald-500" aria-hidden="true" /> @if ((int) $plan->wordpress_sites_limit < 0) Unlimited WordPress sites @elseif ((int) $plan->wordpress_sites_limit === 1) 1 WordPress site @else {{ $plan->wordpress_sites_limit }} WordPress sites @endif</li>
+                            @endif
+                            @if ((int) $plan->network_connections_limit !== 0)
+                                <li class="flex items-start gap-2"><x-heroicon-m-check-circle class="mt-0.5 h-4 w-4 shrink-0 text-emerald-500" aria-hidden="true" /> @if ((int) $plan->network_connections_limit < 0) Unlimited affiliate network connections @elseif ((int) $plan->network_connections_limit === 1) 1 affiliate network connection @else {{ $plan->network_connections_limit }} affiliate network connections @endif</li>
+                            @endif
                         </ul>
 
                         <a href="{{ route('registration.form', $plan) }}" class="mt-2 w-full rounded-full py-3 text-center text-sm font-semibold transition {{ $plan->is_featured ? 'bg-gold-400 text-navy-950 hover:bg-gold-300' : 'bg-navy-900 text-white hover:bg-navy-800' }}">
@@ -59,6 +65,8 @@
                                     <ul class="space-y-1">
                                         <li class="flex items-start gap-1.5"><span class="text-emerald-500" aria-hidden="true">✓</span> {{ $plan->active_products_limit === 0 ? 'Unlimited active offers' : $plan->active_products_limit.' active offer'.($plan->active_products_limit > 1 ? 's' : '') }}</li>
                                         <li class="flex items-start gap-1.5"><span class="text-emerald-500" aria-hidden="true">✓</span> Built-in referral / affiliate program</li>
+                                        <li class="flex items-start gap-1.5"><span class="text-emerald-500" aria-hidden="true">✓</span> Add-on marketplace access</li>
+                                        <li class="flex items-start gap-1.5"><span class="text-emerald-500" aria-hidden="true">✓</span> AffilStack in your language</li>
                                         <li class="flex items-start gap-1.5"><span class="text-emerald-500" aria-hidden="true">✓</span> Email support</li>
                                     </ul>
 
diff --git a/storage/app/public/.htaccess b/storage/app/public/.htaccess
index 62ac5ed53..8a7ddb20b 100644
--- a/storage/app/public/.htaccess
+++ b/storage/app/public/.htaccess
@@ -1,6 +1,6 @@
 # Public uploads are served as files only — never executed as code, whatever
 # their name.
-<FilesMatch "\.(php[0-9]?|phtml|phar|pht|shtml|cgi|pl|py|sh)$">
+<FilesMatch "\.(php[0-9]?|phtml|pht|phar|phps|pgif|shtml|cgi|pl|py|sh|inc)$">
     <IfModule mod_authz_core.c>
         Require all denied
     </IfModule>
diff --git a/storage/framework/.gitignore b/storage/framework/.gitignore
index 2b5f9a42c..b612dab93 100644
--- a/storage/framework/.gitignore
+++ b/storage/framework/.gitignore
@@ -9,3 +9,4 @@ routes.scanned.php
 schedule-*
 services.json
 translation-catalog-*.php
+php-runtime.json
diff --git a/tests/Feature/AddonMarketplaceTest.php b/tests/Feature/AddonMarketplaceTest.php
index 97845d5da..14b11535f 100644
--- a/tests/Feature/AddonMarketplaceTest.php
+++ b/tests/Feature/AddonMarketplaceTest.php
@@ -47,6 +47,17 @@ public function test_only_approved_add_ons_from_active_developers_are_listed():
         $this->actingAs($customer)->get(route('marketplace.addon', $suspended))->assertNotFound();
     }
 
+    public function test_the_sitemap_lists_only_listed_add_ons(): void
+    {
+        $developer = $this->developer();
+        $live = $this->liveAddon($developer, 'app', ['name' => 'Rank Booster']);
+        $suspended = $this->liveAddon($developer, 'template_pack', ['name' => 'Banned Pack'], 'suspended');
+
+        $this->get(route('seo.sitemap'))->assertOk()
+            ->assertSee(route('marketplace.show', $live), false)
+            ->assertDontSee(route('marketplace.show', $suspended), false);
+    }
+
     public function test_the_marketplace_can_be_searched_and_filtered(): void
     {
         $developer = $this->developer();
diff --git a/tests/Feature/FeatureDemoTest.php b/tests/Feature/FeatureDemoTest.php
index d46a410f2..8da14c46d 100644
--- a/tests/Feature/FeatureDemoTest.php
+++ b/tests/Feature/FeatureDemoTest.php
@@ -7,6 +7,7 @@
 use App\Models\User;
 use App\Support\Features\FeatureMedia;
 use Database\Seeders\RolesSeeder;
+use Filament\Actions\Testing\TestAction;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\Storage;
@@ -129,7 +130,7 @@ public function test_the_admin_page_switches_each_screenshot_and_everything_at_o
         Livewire::actingAs($admin)
             ->test(FeatureDemoSettings::class)
             ->assertSee('Offer research')
-            ->assertSee('0 of 31 animated demos are installed.')
+            ->assertSee('0 of 37 animated demos are installed.')
             ->fillForm(['choice_offer_research' => FeatureMedia::ANIMATION])
             ->call('save')
             ->assertHasNoFormErrors()
@@ -150,34 +151,73 @@ public function test_the_admin_page_switches_each_screenshot_and_everything_at_o
         $this->assertSame(FeatureMedia::SCREENSHOT, FeatureMedia::choiceFor('offer-research'));
     }
 
-    public function test_the_admin_can_upload_their_own_video(): void
+    public function test_the_admin_can_upload_and_remove_their_own_video(): void
     {
         $admin = User::factory()->create();
         $admin->assignRole('admin');
 
         Livewire::actingAs($admin)
             ->test(FeatureDemoSettings::class)
-            ->fillForm([
-                'choice_crm_list' => FeatureMedia::ANIMATION,
-                'video_crm_list' => UploadedFile::fake()->create('demo.mp4', 500, 'video/mp4'),
+            ->callAction(TestAction::make('upload_crm_list')->schemaComponent('actions_crm_list'), [
+                'video' => UploadedFile::fake()->create('demo.mp4', 500, 'video/mp4'),
             ])
-            ->call('save')
-            ->assertHasNoFormErrors();
+            ->assertHasNoActionErrors()
+            ->assertNotified('Video uploaded');
 
         $path = FeatureMedia::uploadedVideos()['crm-list'];
         Storage::disk('public')->assertExists($path);
+
+        FeatureMedia::save(['crm-list' => FeatureMedia::ANIMATION], FeatureMedia::uploadedVideos());
         $this->assertStringEndsWith($path, FeatureMedia::videoFor(asset('images/features/crm-list.webp'))[0]['url']);
+
+        Livewire::actingAs($admin)
+            ->test(FeatureDemoSettings::class)
+            ->callAction(TestAction::make('remove_crm_list')->schemaComponent('actions_crm_list'))
+            ->assertNotified('Video removed');
+
+        $this->assertArrayNotHasKey('crm-list', FeatureMedia::uploadedVideos());
+        $this->assertSame(FeatureMedia::ANIMATION, FeatureMedia::choiceFor('crm-list'));
+        Storage::disk('public')->assertMissing($path);
     }
 
-    public function test_a_non_video_upload_is_refused(): void
+    public function test_saving_the_choices_keeps_an_uploaded_video(): void
     {
         $admin = User::factory()->create();
         $admin->assignRole('admin');
+        FeatureMedia::save([], ['crm-list' => FeatureMedia::DIRECTORY.'/uploads/mine.mp4']);
 
         Livewire::actingAs($admin)
             ->test(FeatureDemoSettings::class)
-            ->fillForm(['video_crm_list' => UploadedFile::fake()->create('evil.html', 5, 'text/html')])
+            ->fillForm(['choice_crm_list' => FeatureMedia::ANIMATION])
             ->call('save')
-            ->assertHasFormErrors(['video_crm_list']);
+            ->assertHasNoFormErrors();
+
+        $this->assertSame(FeatureMedia::DIRECTORY.'/uploads/mine.mp4', FeatureMedia::uploadedVideos()['crm-list']);
+    }
+
+    public function test_a_non_video_upload_is_refused(): void
+    {
+        $admin = User::factory()->create();
+        $admin->assignRole('admin');
+
+        Livewire::actingAs($admin)
+            ->test(FeatureDemoSettings::class)
+            ->callAction(TestAction::make('upload_crm_list')->schemaComponent('actions_crm_list'), [
+                'video' => UploadedFile::fake()->create('evil.html', 5, 'text/html'),
+            ])
+            ->assertHasActionErrors(['video']);
+
+        $this->assertSame([], FeatureMedia::uploadedVideos());
+    }
+
+    public function test_the_page_has_no_upload_fields_that_load_on_open(): void
+    {
+        $admin = User::factory()->create();
+        $admin->assignRole('admin');
+
+        Livewire::actingAs($admin)
+            ->test(FeatureDemoSettings::class)
+            ->assertDontSeeHtml('fi-fo-file-upload')
+            ->assertSee('Upload my own video');
     }
 }
diff --git a/tests/Feature/GitHubSyncSettingsPageTest.php b/tests/Feature/GitHubSyncSettingsPageTest.php
index f3204ae88..a17054e34 100644
--- a/tests/Feature/GitHubSyncSettingsPageTest.php
+++ b/tests/Feature/GitHubSyncSettingsPageTest.php
@@ -158,7 +158,7 @@ public function test_sync_now_action_runs_a_sync_and_shows_its_result(): void
 
         Livewire::actingAs($this->superAdmin)
             ->test(GitHubSyncSettings::class)
-            ->call('syncNow', app(GitHubSyncService::class));
+            ->call('syncNow');
 
         // The mock never persisted anything itself (it's a mock) — this
         // just confirms the page called through to the service exactly
diff --git a/tests/Feature/GoogleSiteAnalyticsTest.php b/tests/Feature/GoogleSiteAnalyticsTest.php
index 522b65c76..3b6b27d68 100644
--- a/tests/Feature/GoogleSiteAnalyticsTest.php
+++ b/tests/Feature/GoogleSiteAnalyticsTest.php
@@ -55,7 +55,7 @@ public function test_is_available_requires_the_shared_google_oauth_client(): voi
         $this->assertTrue(app(GoogleSiteAnalyticsService::class)->isAvailable());
     }
 
-    public function test_authorization_url_requests_offline_access_and_all_three_scopes(): void
+    public function test_authorization_url_requests_offline_access_and_every_scope(): void
     {
         $this->enableGoogleOauth();
 
@@ -65,6 +65,7 @@ public function test_authorization_url_requests_offline_access_and_all_three_sco
         $this->assertStringContainsString('prompt=consent', $url);
         $this->assertStringContainsString(urlencode('https://www.googleapis.com/auth/analytics.edit'), $url);
         $this->assertStringContainsString(urlencode('https://www.googleapis.com/auth/webmasters'), $url);
+        $this->assertStringContainsString(urlencode('https://www.googleapis.com/auth/siteverification.verify_only'), $url);
         $this->assertStringContainsString(urlencode('https://www.googleapis.com/auth/tagmanager.edit.containers'), $url);
     }
 
@@ -160,6 +161,38 @@ public function test_verify_search_console_saves_the_verification_token_even_if_
         $this->assertSame('verify-token-123', SiteSetting::get('seo_gsc_verification'));
     }
 
+    public function test_only_the_code_is_stored_when_google_returns_the_whole_meta_tag(): void
+    {
+        $this->connectedSettings();
+        Http::fake([
+            'www.googleapis.com/siteVerification/v1/token' => Http::response([
+                'method' => 'META',
+                'token' => '<meta name="google-site-verification" content="verify-token-123" />',
+            ]),
+            'www.googleapis.com/siteVerification/v1/webResource*' => Http::response(['id' => 'site-id']),
+            'searchconsole.googleapis.com/*' => Http::response(['ok' => true]),
+        ]);
+
+        $this->assertTrue(app(GoogleSiteAnalyticsService::class)->verifySearchConsole()['success']);
+        $this->assertSame('verify-token-123', SiteSetting::get('seo_gsc_verification'));
+    }
+
+    public function test_a_connection_missing_the_verification_scope_is_told_to_reconnect(): void
+    {
+        $this->connectedSettings();
+        Http::fake([
+            'www.googleapis.com/siteVerification/v1/token' => Http::response([
+                'error' => ['code' => 403, 'status' => 'PERMISSION_DENIED', 'details' => [['reason' => 'ACCESS_TOKEN_SCOPE_INSUFFICIENT']]],
+            ], 403),
+        ]);
+
+        $result = app(GoogleSiteAnalyticsService::class)->verifySearchConsole();
+
+        $this->assertFalse($result['success']);
+        $this->assertSame(GoogleSiteAnalyticsService::RECONNECT_MESSAGE, $result['message']);
+        $this->assertNull(SiteSetting::get('seo_gsc_verification'));
+    }
+
     public function test_verify_search_console_succeeds_end_to_end_and_submits_the_sitemap(): void
     {
         $this->connectedSettings();
@@ -175,6 +208,25 @@ public function test_verify_search_console_succeeds_end_to_end_and_submits_the_s
         $this->assertTrue(GoogleSiteAnalyticsSetting::current()->hasSearchConsole());
 
         Http::assertSent(fn ($request) => str_contains($request->url(), 'searchconsole.googleapis.com') && str_contains($request->url(), 'sitemaps'));
+        // Google rejects Laravel's default "[]" body on these PUTs.
+        Http::assertNotSent(fn ($request) => str_contains($request->url(), 'searchconsole.googleapis.com') && $request->body() !== '{}');
+    }
+
+    public function test_a_refused_sitemap_still_counts_as_verified_and_says_so(): void
+    {
+        $this->connectedSettings();
+        Http::fake([
+            'www.googleapis.com/siteVerification/v1/token' => Http::response(['token' => 'verify-token-123']),
+            'www.googleapis.com/siteVerification/v1/webResource*' => Http::response(['id' => 'site-id']),
+            'searchconsole.googleapis.com/*/sitemaps/*' => Http::response(['error' => ['message' => 'Sitemap could not be read']], 400),
+            'searchconsole.googleapis.com/*' => Http::response([]),
+        ]);
+
+        $result = app(GoogleSiteAnalyticsService::class)->verifySearchConsole();
+
+        $this->assertTrue($result['success']);
+        $this->assertStringContainsString('Sitemap could not be read', $result['message']);
+        $this->assertTrue(GoogleSiteAnalyticsSetting::current()->hasSearchConsole());
     }
 
     public function test_set_up_tag_manager_creates_a_container_and_stores_the_public_id(): void
diff --git a/tests/Feature/NewFeaturesMarketingTest.php b/tests/Feature/NewFeaturesMarketingTest.php
new file mode 100644
index 000000000..2658a8cc1
--- /dev/null
+++ b/tests/Feature/NewFeaturesMarketingTest.php
@@ -0,0 +1,101 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\FaqItem;
+use App\Models\HomepageFeature;
+use App\Models\Plan;
+use Database\Seeders\FaqItemsSeeder;
+use Database\Seeders\HomepageFeaturesSeeder;
+use Database\Seeders\PlansSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+/**
+ * WordPress publishing, affiliate networks, the dashboard in your language
+ * and the add-on marketplace are on the marketing site: feature pages,
+ * homepage cards, help answers, menus and the plan limits on Pricing.
+ */
+class NewFeaturesMarketingTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function runContentMigration(): void
+    {
+        (require database_path('migrations/2026_10_22_202615_ship_marketing_content_for_new_features.php'))->up();
+    }
+
+    public function test_the_new_feature_pages_are_published_in_the_tools_menu(): void
+    {
+        $response = $this->get(route('home'))->assertOk();
+
+        foreach (['affiliate-networks', 'wordpress-publishing', 'multi-language', 'add-on-marketplace'] as $slug) {
+            $response->assertSee('/features/'.$slug, false);
+            $this->get('/features/'.$slug)->assertOk();
+        }
+    }
+
+    public function test_a_new_site_gets_the_new_homepage_cards_and_help_answers_from_the_seeders(): void
+    {
+        $this->seed([HomepageFeaturesSeeder::class, FaqItemsSeeder::class]);
+
+        $titles = HomepageFeature::orderBy('sort_order')->pluck('title')->all();
+        $this->assertCount(12, $titles);
+        $this->assertSame('An add-on marketplace', $titles[10]);
+        $this->assertSame('Earn by sharing it, too', $titles[11]);
+        $this->assertTrue(FaqItem::where('question', 'Which affiliate networks can I connect?')->exists());
+
+        $this->get(route('home'))->assertOk()
+            ->assertSee('Your affiliate networks, connected')
+            ->assertSee('Straight to your WordPress site')
+            ->assertSee('/images/features/add-on-marketplace.webp', false);
+    }
+
+    public function test_an_existing_site_gets_the_new_cards_before_the_closing_card_without_touching_its_edits(): void
+    {
+        HomepageFeature::create(['icon' => 'star', 'title' => 'My own card', 'description' => 'Written by the admin.', 'media_type' => 'none', 'sort_order' => 0, 'is_active' => true]);
+        HomepageFeature::create(['icon' => 'banknotes', 'title' => 'Earn by sharing it, too', 'description' => 'Edited.', 'media_type' => 'none', 'sort_order' => 1, 'is_active' => true]);
+        FaqItem::create(['question' => 'Can I build and sell add-ons?', 'answer' => 'The admin\'s own answer.', 'category' => 'general', 'sort_order' => 3]);
+
+        $this->runContentMigration();
+        $this->runContentMigration();
+
+        $this->assertSame(
+            ['My own card', 'Your affiliate networks, connected', 'Straight to your WordPress site', 'An add-on marketplace', 'Earn by sharing it, too'],
+            HomepageFeature::orderBy('sort_order')->pluck('title')->all(),
+        );
+        $this->assertSame('Edited.', HomepageFeature::where('title', 'Earn by sharing it, too')->value('description'));
+        $this->assertSame(1, FaqItem::where('question', 'Can I build and sell add-ons?')->count());
+        $this->assertSame('The admin\'s own answer.', FaqItem::where('question', 'Can I build and sell add-ons?')->value('answer'));
+        $this->assertSame(count(FaqItemsSeeder::NEW_FEATURE_FAQS), FaqItem::count());
+    }
+
+    public function test_an_empty_site_is_left_to_the_seeders(): void
+    {
+        $this->runContentMigration();
+
+        $this->assertSame(0, HomepageFeature::count());
+        $this->assertSame(0, FaqItem::count());
+    }
+
+    public function test_pricing_shows_each_plans_wordpress_and_network_allowance(): void
+    {
+        $this->seed(PlansSeeder::class);
+        Plan::where('slug', 'starter')->update(['wordpress_sites_limit' => 0]);
+
+        $html = $this->get(route('registration.pricing'))->assertOk()->getContent();
+
+        $this->assertStringContainsString('3 WordPress sites', $html);
+        $this->assertStringContainsString('Unlimited WordPress sites', $html);
+        $this->assertStringContainsString('1 affiliate network connection', $html);
+        $this->assertStringContainsString('Unlimited affiliate network connections', $html);
+        $this->assertStringNotContainsString('1 WordPress site<', $html);
+    }
+
+    public function test_the_marketplace_and_developer_portal_are_in_the_default_menus(): void
+    {
+        $this->get(route('home'))->assertOk()
+            ->assertSee(route('marketplace.index'), false)
+            ->assertSee(route('developer.home'), false);
+    }
+}
diff --git a/tests/Feature/PayPalPaymentFlowTest.php b/tests/Feature/PayPalPaymentFlowTest.php
index d5fe98c3f..fc47134be 100644
--- a/tests/Feature/PayPalPaymentFlowTest.php
+++ b/tests/Feature/PayPalPaymentFlowTest.php
@@ -158,6 +158,9 @@ public function test_signup_creates_account_only_after_verified_paypal_payment()
         $transaction->refresh();
         $this->assertSame('successful', $transaction->status);
         $this->assertSame('CAP998877', $transaction->gateway_tx_id);
+
+        Http::assertSent(fn ($request) => str_ends_with($request->url(), '/v2/checkout/orders/ORDER123/capture')
+            && $request->body() === '{}');
     }
 
     public function test_paypal_webhook_requires_a_valid_signature(): void
diff --git a/tests/Feature/Php2ShellProtectionTest.php b/tests/Feature/Php2ShellProtectionTest.php
new file mode 100644
index 000000000..74bfd3abb
--- /dev/null
+++ b/tests/Feature/Php2ShellProtectionTest.php
@@ -0,0 +1,301 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Http\Middleware\RejectExecutableUploads;
+use App\Models\SecurityFinding;
+use App\Models\User;
+use App\Notifications\SecurityAlert;
+use App\Services\Agents\SecurityScanService;
+use App\Services\AI\AIProvider;
+use App\Support\Security\PhpRuntime;
+use Database\Seeders\RolesSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Route;
+use Tests\TestCase;
+
+/**
+ * PHP2Shell (CVE-2026-109618 / CVE-2026-109619) and attacks like it: the
+ * server's PHP is checked against known fixes and php.net, admins are
+ * alerted, uploads can't carry code, PHP can't run outside index.php, and
+ * web shells are found.
+ */
+class Php2ShellProtectionTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected string $record;
+
+    protected string $shellDirectory;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->record = storage_path('framework/php-runtime.json');
+        $this->shellDirectory = storage_path('app/public/php2shell-test');
+        File::delete($this->record);
+
+        Route::middleware('web')->post('/_test/upload', fn () => 'stored');
+        Route::middleware('api')->post('/_test/api-upload', fn () => response()->json(['stored' => true]));
+    }
+
+    protected function tearDown(): void
+    {
+        File::delete($this->record);
+        File::deleteDirectory($this->shellDirectory);
+
+        parent::tearDown();
+    }
+
+    // --- Uploads ---------------------------------------------------------------
+
+    public function test_php_files_and_server_config_files_cannot_be_uploaded(): void
+    {
+        foreach (['shell.php', 'shell.PHTML', 'photo.php.jpg', 'archive.phar', '.htaccess', '.user.ini', 'script.php7'] as $name) {
+            $this->post('/_test/upload', ['file' => UploadedFile::fake()->createWithContent($name, 'hello')])
+                ->assertRedirect()
+                ->assertSessionHasErrors('file');
+        }
+
+        $this->postJson('/_test/api-upload', ['file' => UploadedFile::fake()->createWithContent('x.php', 'hello')])->assertStatus(422);
+    }
+
+    public function test_php_code_hidden_in_an_image_is_refused(): void
+    {
+        $polyglot = "\x89PNG\r\n\x1a\n".str_repeat("\0", 64)."<?php system(\$_GET['c']); ?>";
+        $this->post('/_test/upload', ['logo' => UploadedFile::fake()->createWithContent('logo.png', $polyglot)])->assertSessionHasErrors('file');
+
+        $nested = ['items' => [['image' => UploadedFile::fake()->createWithContent('a.gif', 'GIF89a<?= `id` ?>')]]];
+        $this->post('/_test/upload', $nested)->assertSessionHasErrors('file');
+    }
+
+    public function test_ordinary_files_upload_normally(): void
+    {
+        $this->post('/_test/upload', ['file' => UploadedFile::fake()->image('photo.jpg', 40, 40)])->assertOk()->assertSee('stored');
+        $this->post('/_test/upload', ['file' => UploadedFile::fake()->createWithContent('logo.svg', '<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg"></svg>')])->assertOk();
+        $this->post('/_test/upload', ['file' => UploadedFile::fake()->createWithContent('contacts.csv', "email,name\nada@example.com,Ada")])->assertOk();
+        $this->post('/_test/upload', ['file' => UploadedFile::fake()->createWithContent('zap.json', '{"steps":[]}')])->assertOk();
+
+        // "<?=" in binary data is chance, not code.
+        $this->post('/_test/upload', ['file' => UploadedFile::fake()->createWithContent('pic.png', "\x89PNG\0\0<?=\0\0")])->assertOk();
+    }
+
+    public function test_the_upload_guard_reads_large_files_in_chunks(): void
+    {
+        $content = str_repeat('a', 1048576 - 3).'<?php echo 1;';
+        $file = UploadedFile::fake()->createWithContent('notes.txt', $content);
+
+        $this->assertTrue(app(RejectExecutableUploads::class)->isExecutable($file));
+    }
+
+    // --- The PHP version ---------------------------------------------------------
+
+    public function test_php_versions_before_the_php2shell_fix_are_critical(): void
+    {
+        foreach (['8.4.26', '8.4.0', '8.5.11'] as $version) {
+            $problems = PhpRuntime::problemsFor($version, false);
+            $this->assertSame('critical', $problems[0]['severity'], $version);
+            $this->assertStringContainsString('PHP2Shell', $problems[0]['title']);
+        }
+
+        $this->assertSame([], PhpRuntime::problemsFor('8.4.27', false));
+        $this->assertSame([], PhpRuntime::problemsFor('8.5.12', false));
+        $this->assertStringContainsString('not a supported version', PhpRuntime::problemsFor('8.3.40', false)[0]['title']);
+    }
+
+    public function test_a_host_backported_fix_is_accepted_from_the_build_date(): void
+    {
+        // Hostinger: PHP 8.5.11 rebuilt with the fix on the release day.
+        $problems = PhpRuntime::problemsFor('8.5.11', false, '2026-10-21');
+        $this->assertCount(1, $problems);
+        $this->assertSame('low', $problems[0]['severity']);
+        $this->assertStringContainsString('backport', $problems[0]['title']);
+
+        // Built before the fix: still critical.
+        $this->assertSame('critical', PhpRuntime::problemsFor('8.5.11', false, '2026-10-20')[0]['severity']);
+
+        $this->writeWebRuntime('8.5.11', [], '2026-10-21');
+        $this->assertFalse(PhpRuntime::webIsCriticallyVulnerable());
+        $this->artisan('security:check-php')->assertSuccessful();
+
+        $this->writeWebRuntime('8.5.11', [], '2026-09-30');
+        $this->assertTrue(PhpRuntime::webIsCriticallyVulnerable());
+    }
+
+    public function test_the_php_build_date_is_read_from_php_itself(): void
+    {
+        $this->assertMatchesRegularExpression('/^\d{4}-\d{2}-\d{2}$/', (string) PhpRuntime::buildDate());
+
+        PhpRuntime::recordCurrent();
+        $this->assertSame(PhpRuntime::buildDate(), PhpRuntime::webRuntime()['build_date']);
+    }
+
+    public function test_a_later_php_net_security_release_is_judged_by_build_date_on_backporting_hosts(): void
+    {
+        config(['security.php_release_check' => true]);
+        Http::fake(['www.php.net/*' => Http::response(['version' => '8.5.13', 'tags' => ['security'], 'date' => '01 Dec 2026'])]);
+
+        $this->assertSame('high', collect(PhpRuntime::problemsFor('8.5.11', true, '2026-10-21'))->firstWhere('severity', 'high')['severity']);
+        $this->assertNull(collect(PhpRuntime::problemsFor('8.5.11', true, '2026-12-02'))->firstWhere('severity', 'high'));
+    }
+
+    public function test_a_newer_security_release_on_php_net_is_reported_even_without_a_code_update(): void
+    {
+        config(['security.php_release_check' => true]);
+        Http::fake(['www.php.net/*' => Http::sequence()
+            ->push(['version' => '8.4.31', 'tags' => ['security'], 'supported_versions' => ['8.4', '8.5']])
+            ->push('down', 500)]);
+
+        $problems = PhpRuntime::problemsFor('8.4.27');
+
+        $this->assertCount(1, $problems);
+        $this->assertSame('high', $problems[0]['severity']);
+        $this->assertStringContainsString('8.4.31 is a security release', $problems[0]['title']);
+
+        // php.net unreachable: only the known fixes are checked.
+        Cache::flush();
+        $this->assertSame([], PhpRuntime::problemsFor('8.4.27'));
+    }
+
+    public function test_the_website_php_version_is_recorded_and_risky_settings_are_reported(): void
+    {
+        PhpRuntime::recordCurrent();
+        $web = PhpRuntime::webRuntime();
+
+        $this->assertSame(PHP_VERSION, $web['version']);
+        $this->assertArrayHasKey('session.upload_progress.enabled', $web['ini']);
+
+        $this->assertCount(1, PhpRuntime::riskyIniProblems(['session.upload_progress.enabled' => '1']));
+        $this->assertSame([], PhpRuntime::riskyIniProblems(['session.upload_progress.enabled' => 'Off', 'post_max_size' => '40M']));
+        $this->assertStringContainsString('2048M', PhpRuntime::riskyIniProblems(['post_max_size' => '2048M'])[0]['title']);
+        $this->assertCount(1, PhpRuntime::riskyIniProblems(['post_max_size' => '0']));
+
+        // Hostinger's website settings with proc_open switched back on.
+        $open = PhpRuntime::riskyIniProblems(['disable_functions' => 'system, exec, shell_exec, passthru, popen, symlink']);
+        $this->assertStringContainsString('proc_open', $open[0]['title']);
+        $this->assertSame([], PhpRuntime::riskyIniProblems(['disable_functions' => 'system,exec,shell_exec,passthru,popen,proc_open']));
+    }
+
+    public function test_the_shipped_user_ini_only_uses_settings_php_accepts_there(): void
+    {
+        $settings = parse_ini_file(public_path('.user.ini'));
+        $all = ini_get_all(null, true);
+
+        $this->assertSame('0', (string) $settings['session.upload_progress.enabled']);
+
+        foreach (array_keys($settings) as $key) {
+            $this->assertArrayHasKey($key, $all, "{$key} is not a PHP setting");
+            $this->assertTrue(($all[$key]['access'] & INI_PERDIR) === INI_PERDIR, "{$key} can't be set in .user.ini");
+        }
+    }
+
+    public function test_only_index_php_may_run_as_php_on_the_web_server(): void
+    {
+        foreach ([public_path('.htaccess'), storage_path('app/public/.htaccess')] as $htaccess) {
+            $this->assertStringContainsString('phtml|pht|phar|phps', (string) file_get_contents($htaccess), $htaccess);
+        }
+
+        $this->assertStringContainsString('RewriteRule \.(php[0-9]?|', (string) file_get_contents(public_path('.htaccess')));
+    }
+
+    public function test_the_deploy_check_fails_on_an_unpatched_website_php(): void
+    {
+        $this->writeWebRuntime('8.4.26');
+
+        $this->artisan('security:check-php')->assertFailed();
+
+        $this->writeWebRuntime('8.4.27');
+        $this->artisan('security:check-php')->assertSuccessful();
+    }
+
+    // --- Tom, the Security Agent ----------------------------------------------
+
+    public function test_tom_reports_an_unpatched_website_php_alerts_the_admins_and_closes_it_once_updated(): void
+    {
+        $this->prepareScan();
+        Notification::fake();
+        $admin = User::factory()->create();
+        $admin->assignRole('admin');
+
+        $this->writeWebRuntime('8.4.26', ['session.upload_progress.enabled' => '1']);
+        app(SecurityScanService::class)->scan();
+
+        $finding = SecurityFinding::where('category', 'php_runtime')->where('severity', 'critical')->sole();
+        $this->assertStringContainsString('PHP2Shell', $finding->title);
+        $this->assertSame(['website'], $finding->evidence['where']);
+        $this->assertTrue(SecurityFinding::where('category', 'php_runtime')->where('title', 'like', '%upload_progress%')->exists());
+        Notification::assertSentTo($admin, SecurityAlert::class, fn (SecurityAlert $alert) => collect($alert->findings)->contains('id', $finding->id));
+
+        $this->assertTrue(PhpRuntime::webIsCriticallyVulnerable());
+        $this->assertStringContainsString('PHP2Shell', view('filament.security.php-runtime-banner', ['web' => PhpRuntime::webRuntime()])->render());
+
+        // The host updates PHP: the next scan closes the finding.
+        $this->writeWebRuntime('8.4.27', ['session.upload_progress.enabled' => '0']);
+        app(SecurityScanService::class)->scan();
+
+        $this->assertSame(SecurityFinding::STATUS_FIXED, $finding->fresh()->status);
+        $this->assertSame(0, SecurityFinding::where('category', 'php_runtime')->where('status', 'open')->count());
+        $this->assertFalse(PhpRuntime::webIsCriticallyVulnerable());
+    }
+
+    public function test_tom_finds_web_shells_in_upload_folders(): void
+    {
+        $this->prepareScan();
+        File::ensureDirectoryExists($this->shellDirectory);
+        file_put_contents($this->shellDirectory.'/cache.php', '<?php eval($_POST["x"]);');
+        file_put_contents($this->shellDirectory.'/avatar.jpg', "\xFF\xD8\xFF<?php system(\$_GET['c']);");
+        file_put_contents($this->shellDirectory.'/photo.webp', 'RIFF....WEBP');
+
+        app(SecurityScanService::class)->scan();
+
+        $finding = SecurityFinding::where('category', 'web_shell')->sole();
+        $this->assertSame('critical', $finding->severity);
+        $this->assertContains('storage/app/public/php2shell-test/cache.php', $finding->evidence['files']);
+        $this->assertContains('storage/app/public/php2shell-test/avatar.jpg (PHP code inside)', $finding->evidence['files']);
+        $this->assertNotContains('storage/app/public/php2shell-test/photo.webp', $finding->evidence['files']);
+        $this->assertNotContains('public/index.php', $finding->evidence['files']);
+
+        File::deleteDirectory($this->shellDirectory);
+        app(SecurityScanService::class)->scan();
+        $this->assertSame(SecurityFinding::STATUS_FIXED, $finding->fresh()->status);
+    }
+
+    /**
+     * @param  array<string, string>  $ini
+     */
+    protected function writeWebRuntime(string $version, array $ini = [], ?string $buildDate = null): void
+    {
+        file_put_contents($this->record, json_encode(['version' => $version, 'sapi' => 'litespeed', 'build_date' => $buildDate, 'ini' => $ini, 'recorded_at' => time()]));
+    }
+
+    protected function prepareScan(): void
+    {
+        $this->seed(RolesSeeder::class);
+        Process::fake(['composer audit*' => Process::result(output: json_encode(['advisories' => [], 'abandoned' => []]))]);
+
+        $this->app->instance(AIProvider::class, new class implements AIProvider
+        {
+            public function generateText(string $systemPrompt, string $userPrompt, array $options = []): string
+            {
+                return '';
+            }
+
+            public function generateJson(string $systemPrompt, string $userPrompt, array $options = []): array
+            {
+                return ['summary' => 'Summary.', 'suggested_fix' => 'Fix.'];
+            }
+
+            public function generateImage(string $prompt, array $options = []): string
+            {
+                return '';
+            }
+        });
+    }
+}
diff --git a/tests/Feature/SiteVerificationCodeTest.php b/tests/Feature/SiteVerificationCodeTest.php
new file mode 100644
index 000000000..30dda629d
--- /dev/null
+++ b/tests/Feature/SiteVerificationCodeTest.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\SiteSetting;
+use App\Support\Seo\SiteVerificationCode;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class SiteVerificationCodeTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_a_whole_meta_tag_is_reduced_to_its_code(): void
+    {
+        $this->assertSame('-3dH9WIVUsEBJVKO1', SiteVerificationCode::normalize('<meta name="google-site-verification" content="-3dH9WIVUsEBJVKO1" />'));
+        $this->assertSame('ABC123', SiteVerificationCode::normalize("<meta name='msvalidate.01' content='ABC123'>"));
+        $this->assertSame('-3dH9WIVUsEBJVKO1', SiteVerificationCode::normalize('&lt;meta name=&quot;google-site-verification&quot; content=&quot;-3dH9WIVUsEBJVKO1&quot; /&gt;'));
+    }
+
+    public function test_a_plain_code_is_kept_and_blank_becomes_null(): void
+    {
+        $this->assertSame('ABC123', SiteVerificationCode::normalize('  "ABC123" '));
+        $this->assertNull(SiteVerificationCode::normalize('   '));
+        $this->assertNull(SiteVerificationCode::normalize(null));
+    }
+
+    public function test_the_homepage_prints_only_the_code_even_if_a_whole_tag_was_saved(): void
+    {
+        SiteSetting::set('seo_gsc_verification', '<meta name="google-site-verification" content="-3dH9WIVUsEBJVKO1" />');
+
+        $this->get(route('home'))
+            ->assertOk()
+            ->assertSee('<meta name="google-site-verification" content="-3dH9WIVUsEBJVKO1">', false);
+    }
+}