Marketing Website — Domain Setup, SSL, and SEO

Last Updated: 2026-08-18
Production: https://arcos.corgicy.com (HTTPS live). This page is the operational checklist for DNS, certificates, and Search Console.

---

Overview

This guide covers the operational tasks required to launch the marketing website:

1. Domain Setup - Configure DNS and domain pointing
2. SSL/TLS Configuration - Set up HTTPS with Let's Encrypt
3. SEO Testing - Verify SEO setup with Google Search Console

Prerequisites:

• Server deployed and accessible
• Domain name registered
• Nginx installed and configured (see docs/developer/deployment/DOCKER_DEPLOYMENT.md)

---

1. Domain Setup

1.1 DNS Configuration

Configure DNS records to point to your server:

A Record (Main Domain):

Type: A
Name: @ (or yourdomain.com)
Value: <your-server-ip>
TTL: 3600 (or default)

A Record (WWW Subdomain):

Type: A
Name: www
Value: <your-server-ip>
TTL: 3600 (or default)

A Record (API Subdomain - if using separate subdomain):

Type: A
Name: api
Value: <your-server-ip>
TTL: 3600 (or default)

CNAME Record (Alternative - redirect www to main):

Type: CNAME
Name: www
Value: yourdomain.com
TTL: 3600 (or default)

1.2 Verify DNS Propagation

Check DNS propagation:

# Check A record
dig yourdomain.com +short
nslookup yourdomain.com

# Check www subdomain
dig www.yourdomain.com +short
nslookup www.yourdomain.com

# Check API subdomain (if configured)
dig api.yourdomain.com +short
nslookup api.yourdomain.com

Online Tools:

• https://dnschecker.org/ - Check DNS propagation globally
• https://www.whatsmydns.net/ - DNS lookup tool

Wait Time:

• DNS changes typically propagate within 24-48 hours
• Some DNS providers update faster (Cloudflare: ~5 minutes)
• Verify propagation before proceeding with SSL setup

1.3 Update Application Configuration

Update environment variables:

Backend (server/.env):

# Update CORS origin to your domain
CORS_ORIGIN=https://yourdomain.com

# Update any domain-specific settings

Frontend (web/.env):

# Update API URL if using subdomain
VITE_API_URL=https://api.yourdomain.com
# OR if using same domain
VITE_API_URL=https://yourdomain.com/api

Marketing Site Build:

# Update domain in marketing site build
cd web
# Domain replacement happens automatically in build script
# See web/src/marketing/DEPLOYMENT.md for details
pnpm build:marketing

---

2. SSL/TLS Setup

2.1 Prerequisites

Before setting up SSL:

• ✅ Domain DNS records configured and propagated
• ✅ Port 80 (HTTP) open in firewall (required for Let's Encrypt validation)
• ✅ Port 443 (HTTPS) open in firewall
• ✅ Nginx installed on host (not in container)
• ✅ Nginx configured with basic HTTP server block

2.2 Let's Encrypt Setup (Recommended)

Step 1: Install Certbot

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install certbot python3-certbot-nginx

# CentOS/RHEL
sudo yum install certbot python3-certbot-nginx

# Verify installation
certbot --version

Step 2: Configure Nginx (Basic HTTP - Required for Let's Encrypt)

Create or update /etc/nginx/sites-available/arcos:

# HTTP server (for Let's Encrypt validation)
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;

    # Let's Encrypt validation
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    # Temporary: serve basic page or redirect
    location / {
        return 301 https://$server_name$request_uri;
    }
}

Enable site:

sudo ln -s /etc/nginx/sites-available/arcos /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Step 3: Obtain SSL Certificate

# Single domain
sudo certbot --nginx -d yourdomain.com

# Multiple domains (main + www)
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

# API subdomain (if using separate subdomain)
sudo certbot --nginx -d api.yourdomain.com

Certbot will:

• Automatically configure Nginx with SSL
• Set up automatic HTTP to HTTPS redirect
• Configure certificate auto-renewal

Step 4: Verify Certificate

# Check certificate
sudo certbot certificates

# Test SSL configuration
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com

# Online SSL checker
# https://www.ssllabs.com/ssltest/analyze.html?d=yourdomain.com

Step 5: Test Auto-Renewal

# Test renewal (dry run)
sudo certbot renew --dry-run

# Check renewal status
sudo systemctl status certbot.timer

Auto-renewal is configured automatically by Certbot. Certificates renew 30 days before expiration.

2.3 Manual Certificate Setup (Alternative)

If not using Let's Encrypt:

Step 1: Obtain Certificate

• Purchase from certificate authority (CA)
• Or use self-signed certificate (testing only)

Step 2: Install Certificate

# Copy certificate files
sudo cp yourdomain.crt /etc/ssl/certs/
sudo cp yourdomain.key /etc/ssl/private/
sudo chmod 600 /etc/ssl/private/yourdomain.key

Step 3: Configure Nginx

server {
    listen 443 ssl http2;
    server_name yourdomain.com www.yourdomain.com;

    # SSL certificates
    ssl_certificate /etc/ssl/certs/yourdomain.crt;
    ssl_certificate_key /etc/ssl/private/yourdomain.key;

    # SSL configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # ... rest of configuration
}

2.4 SSL Configuration Best Practices

Recommended SSL Settings:

# Modern SSL configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;

# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/yourdomain.com/chain.pem;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

Security Headers:

# HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# Other security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

2.5 Verify SSL Setup

Checklist:

• HTTPS accessible: https://yourdomain.com
• HTTP redirects to HTTPS: http://yourdomain.com → https://yourdomain.com
• Certificate valid (not expired, trusted)
• SSL Labs grade A or A+ (https://www.ssllabs.com/ssltest/)
• All subdomains have valid certificates
• Auto-renewal configured and tested

---

3. SEO Testing

3.1 Pre-Submission Checklist

Before submitting to Google Search Console:

• Domain configured and accessible via HTTPS
• SSL certificate valid and trusted
• Sitemap.xml accessible: https://yourdomain.com/sitemap.xml
• Robots.txt accessible: https://yourdomain.com/robots.txt
• Meta tags configured (title, description, Open Graph)
• Structured data (JSON-LD) present on pages
• Mobile-friendly design (responsive)
• Fast page load times
• All pages accessible (no 404 errors)
• Internal linking structure in place

3.2 Google Search Console Setup

Step 1: Create Google Search Console Account

1. Go to https://search.google.com/search-console
2. Sign in with Google account
3. Click "Add Property"
4. Select property type: URL prefix (recommended) or Domain

Step 2: Verify Ownership

Option A: HTML File Upload (Recommended)

1. Download verification HTML file from Search Console
2. Upload to web/public/ directory
3. Rebuild and deploy marketing site
4. Verify file is accessible: https://yourdomain.com/google<random>.html
5. Click "Verify" in Search Console

Option B: HTML Tag

1. Copy meta tag from Search Console
2. Add to web/index.html in <head> section:

<meta name="google-site-verification" content="<verification-code>" />

3. Rebuild and deploy
4. Click "Verify" in Search Console

Option C: DNS Record

1. Add TXT record to DNS:

Type: TXT
Name: @ (or yourdomain.com)
Value: google-site-verification=<verification-code>

2. Wait for DNS propagation
3. Click "Verify" in Search Console

Option D: Google Analytics (if using)

• If Google Analytics is already set up, can verify via Analytics account

3.3 Submit Sitemap

Step 1: Locate Sitemap

Sitemap should be at: https://yourdomain.com/sitemap.xml

Verify sitemap is accessible:

curl https://yourdomain.com/sitemap.xml

Step 2: Submit to Google Search Console

1. In Search Console, go to Sitemaps (left sidebar)
2. Enter sitemap URL: https://yourdomain.com/sitemap.xml
3. Click Submit
4. Wait for processing (may take a few days)

Step 3: Verify Sitemap

• Check sitemap status in Search Console
• Ensure all pages are discovered
• Fix any errors reported

3.4 SEO Verification Tests

Step 1: Test Mobile-Friendliness

Google Mobile-Friendly Test:

• https://search.google.com/test/mobile-friendly
• Enter your domain URL
• Verify all pages pass mobile-friendly test

Step 2: Test Page Speed

Google PageSpeed Insights:

• https://pagespeed.web.dev/
• Enter your domain URL
• Check Core Web Vitals scores
• Aim for:
  • LCP (Largest Contentful Paint): < 2.5s
  • FID (First Input Delay): < 100ms
  • CLS (Cumulative Layout Shift): < 0.1

Step 3: Test Structured Data

Google Rich Results Test:

• https://search.google.com/test/rich-results
• Enter page URL
• Verify structured data (JSON-LD) is detected
• Check for errors or warnings

Step 4: Test Robots.txt

Google Robots.txt Tester:

• In Search Console, go to Settings → robots.txt Tester
• Verify robots.txt is accessible
• Test URL blocking/allowing rules
• Ensure sitemap is allowed

3.5 Monitor SEO Performance

Key Metrics to Monitor:

1. Coverage Report (Search Console)

   • Pages indexed vs. submitted
   • Indexing errors
   • Page experience issues

2. Performance Report (Search Console)

   • Impressions
   • Clicks
   • Average position
   • CTR (Click-Through Rate)

3. Core Web Vitals (Search Console)

   • LCP, FID, CLS scores
   • Mobile and desktop metrics

4. Search Analytics

   • Top queries
   • Top pages
   • Geographic data

Regular Checks:

• Weekly: Review Search Console for errors
• Monthly: Analyze performance metrics
• Quarterly: Review and update sitemap
• After major updates: Re-submit sitemap

3.6 Common SEO Issues and Fixes

Issue: Pages not indexed

• Check: Coverage report in Search Console
• Fix: Ensure pages are linked from sitemap, check robots.txt, verify pages are accessible

Issue: Mobile usability errors

• Check: Mobile-Friendly Test
• Fix: Ensure responsive design, fix viewport meta tag, optimize images

Issue: Page speed issues

• Check: PageSpeed Insights
• Fix: Optimize images, enable compression, minimize JavaScript/CSS, use CDN

Issue: Structured data errors

• Check: Rich Results Test
• Fix: Validate JSON-LD syntax, ensure required fields present, fix schema errors

Issue: SSL certificate errors

• Check: SSL Labs test
• Fix: Renew certificate, fix certificate chain, update SSL configuration

---

4. Post-Setup Verification

4.1 Domain Verification Checklist

• Domain resolves to correct IP address
• www subdomain works (redirects or serves content)
• API subdomain works (if configured)
• DNS propagation complete globally

4.2 SSL Verification Checklist

• HTTPS accessible on all domains
• HTTP redirects to HTTPS
• Certificate valid and trusted
• SSL Labs grade A or A+
• Auto-renewal configured
• Security headers present
• Mixed content warnings resolved

4.3 SEO Verification Checklist

• Google Search Console verified
• Sitemap submitted and processed
• Robots.txt accessible and correct
• Mobile-friendly test passed
• PageSpeed Insights scores acceptable
• Structured data validated
• All pages accessible (no 404s)
• Meta tags present on all pages

---

5. Maintenance

5.1 SSL Certificate Renewal

Let's Encrypt certificates auto-renew. Monitor renewal:

# Check renewal status
sudo systemctl status certbot.timer

# View renewal logs
sudo journalctl -u certbot.timer

# Manual renewal (if needed)
sudo certbot renew
sudo systemctl reload nginx

Certificate Expiration:

• Let's Encrypt certificates expire after 90 days
• Auto-renewal runs 30 days before expiration
• Monitor renewal logs for errors

5.2 SEO Monitoring

Weekly Tasks:

• Check Search Console for new errors
• Review coverage report
• Monitor indexing status

Monthly Tasks:

• Analyze performance metrics
• Review top queries and pages
• Check Core Web Vitals scores
• Update content as needed

Quarterly Tasks:

• Review and update sitemap
• Analyze SEO trends
• Update meta descriptions
• Review and improve page speed

---

6. Troubleshooting

6.1 DNS Issues

Problem: Domain not resolving

• Check: DNS propagation status
• Fix: Wait for propagation, verify DNS records, check TTL settings

Problem: Subdomain not working

• Check: DNS records for subdomain
• Fix: Add/update A or CNAME record, wait for propagation

6.2 SSL Issues

Problem: Certificate not issued

• Check: Port 80 accessible, domain resolves correctly
• Fix: Ensure HTTP server block allows Let's Encrypt validation, verify DNS

Problem: Certificate expired

• Check: Renewal logs
• Fix: Manually renew certificate, check auto-renewal configuration

Problem: Mixed content warnings

• Check: Browser console for HTTP resources
• Fix: Update all URLs to HTTPS, ensure all assets use HTTPS

6.3 SEO Issues

Problem: Pages not indexed

• Check: Coverage report, robots.txt, sitemap
• Fix: Submit sitemap, fix robots.txt, ensure pages are linked

Problem: Low search rankings

• Check: Content quality, page speed, mobile-friendliness
• Fix: Improve content, optimize performance, ensure mobile-friendly

Problem: Structured data errors

• Check: Rich Results Test
• Fix: Validate JSON-LD syntax, fix schema errors

---

7. Resources

SSL/TLS:

• Let's Encrypt: https://letsencrypt.org/
• SSL Labs: https://www.ssllabs.com/ssltest/
• Certbot Documentation: https://certbot.eff.org/

SEO:

• Google Search Console: https://search.google.com/search-console
• Google PageSpeed Insights: https://pagespeed.web.dev/
• Google Mobile-Friendly Test: https://search.google.com/test/mobile-friendly
• Google Rich Results Test: https://search.google.com/test/rich-results
• Schema.org: https://schema.org/

DNS:

• DNS Checker: https://dnschecker.org/
• What's My DNS: https://www.whatsmydns.net/

---

Note: Domain setup, SSL configuration, and SEO testing are operational tasks that require actual deployment. This guide provides procedures and checklists. Actual implementation requires:

• Domain registration
• Server deployment
• DNS access
• Server root/admin access

All procedures are documented and ready for use when deploying to production.