10  Settings

This section contains flags for enabling extra access or other functionality.

These are all turned off by default. Only turn on Accessibility if the majority of expected site visitors have the sensitivities that the changes cater for, otherwise those without them may find the changes downgrade their experience. The preferences for neurodiverse groups are often mutually exclusive.

This section covers site-wide values used by Smallsite Design.

Any of these values can be shown on a page by selecting the corresponding option for the Value attribute of a value element. If blank, – – is shown.

These settings are to specify an external search provider rather than using the internal facility.

The values are initially blank and the facility is disabled. If disabled, or any of the values are removed, use of an external provider is disabled and the internal search facility is used.

Do not use Google because unless a site is very popular, they will ignore 95% of the pages. Bing will list 100% of a site's pages, but they do not have a Site attribute to be able to restrict the search to the site. DuckDuckGo does, and it uses Bing results, so coverage matches Bings, though new pages may take several extra days to appear. Their advantage is that they do not leak site visitors' details to Bing. At this stage, their filtering is not really good enough, but may change in future.

Not all search providers have all the attributes suitable for this facility. Also, attributes have to be able to be submitted within the form, and not as part of the URL where the queries used may be leaked in browser histories.

MIME types define how the web server processes files so that they display properly in a browser page.

Working values have already been supplied. These settings have only been provided to cater for future changes that may be required, such as for new multimedia file formats. No entries are required for file types that will only be downloaded and not viewed in a browser or played.

csv=text/csvepub=application/epub+zipflac=audio/flacgif=image/gifico=image/x-iconjpg=image/jpegm4a=audio/mp4mp3=audio/mpegmp4=video/mp4oga=audio/ogg; codecs="vorbis"ogv=video/ogg; codecs="theora, vorbis"pdf=application/pdfpng=image/pngtxt=text/plainwebm=video/webm; codecs="vp8.0, vorbis"webp=image/webp

While technically a file with a specific extension can have multiple mime types associated with it and vice-versa, Smallsite Design is keeping it simple by allowing only one mime type to map to one extension. In those rare cases where a mime type extension is already used, an alternate extension will need to be specified here for the new mime type, and any files expected to use it need to be renamed to use the new extension before uploading them.

However, adding a MIME type here only allows it to played on a page if a suitable handler for the file, like a codec for a media file, is already installed on the device or in the browser.

These settings facilitate linking to other sites or web services.

Working values have already been supplied. These settings have only been provided to cater for future changes that may be required.

Disallowed agents lists those bots being requested to ignore the site. As a request, the bots may ignore it. Many search engines' bots and all malicious bots will ignore it. However, some bots for AI sites, like GPTBot, currently do respect the request, so that site content can be prevented from being plagiarised by the AI for use in response to their users' queries. However, if you have a substantial body of work and the AI does not rip off substantial content and lists references, like CoPilot does, then having occasional snippets of referenced content may widen your audience.

The insecure http scheme cannot be added to Additional schemes. For almost all likely external sites to be linked to, no schemes have to be added here as https is the fairly universal standard for websites. However, some sites' content may only be available using special protocols, so they would have to be added here to allow them to be used in links to such sites because URLs are validated against these schemes. Do not include the :// usually used after the protocol name in this list, but it must be included in full URLs.

These settings configure how user passwords are checked against those that have been leaked.

Working values have already been supplied. These settings have only been provided to cater for future changes that may be required.

The current settings are for a service provided by Troy Hunt and his Have I Been Pwned web site, using Cloudflare to timely service the huge number of daily requests at the edge servers of their cloud infrastructure. The database contains half a billion leaked passwords.

The process uses what is known as k-anonymity to allow secure password testing. It involves hashing the password, and sending off the first few characters. A list of several hundred remainders of hashes that match that prefix is returned. If the tail end of the hash of the actual password is on the list, it is compromised. The hashing makes it virtually impossible to determine the password, and so little of the hash is actually transmitted that it is made far less possible.

The password is checked at login if more than a day has elapsed since the previous check. If the check fails, a highlighted notice will be displayed, prompting the user to change to another though that does not have to be immediately. The master manager will be notified if a login check fails. New passwords are also checked, and if rejected, another will need to be provided.

If disabled, any of the fields are blank, or the target password checking site is not available, login will proceed as if the check had passed, so that access to the site is not prevented. If any of the values are removed, the facility will be disabled.