[nofutur3]

Firebase reported 8 of 10 GB used on the Spark plan this month, and Umami shows 5 human visitors. Almost all of that transfer is bots: vulnerability scanners probing /wp-login.php, /.env and similar paths, each getting the full 660 KB 404 page.

Changes

• Static 404 page. src/pages/404.js is replaced by static/404.html, a plain 763 B page with no fonts and no JS.
• Stylesheet linked, not inlined. A new onPreRenderHTML in gatsby-ssr.js swaps the inlined <style data-href> block for a <link> in production builds.
• Latin font subsets only. gatsby-browser.js imports only the latin subsets of Inter and JetBrains Mono, at the same weights as before. There is no Czech text in the content. The remaining font files are over webpack's inline limit, so they ship as separate /static/*.woff2 files and no webpack override was needed.
• Cache headers. firebase.json now marks static/** and *.js/*.css as immutable for a year, while HTML and page-data revalidate on every request. There is no sw.js rule because gatsby-plugin-offline is disabled.
• robots.txt. GPTBot, CCBot, ClaudeBot, anthropic-ai, Bytespider, PerplexityBot, Amazonbot and meta-externalagent are disallowed. * is still allowed.

Build output (clean gatsby build, Node 24, Docker)

File	Before	After
404.html	663 KB	0.8 KB
index.html	677 KB	21 KB (7 KB gzip)
styles.<hash>.css	656 KB, 51 inlined fonts	237 KB (34 KB gzip), 0 inlined fonts

The CSS is still 237 KB raw, which is mostly Bootstrap. It's now cached as immutable and downloaded once per visitor rather than with every page, so trimming it is left for a follow-up.

Verification after deploy

for p in / /does-not-exist /wp-login.php; do
  curl -s --compressed -o /dev/null -w "%{http_code} %{size_download}B $p\n" "https://www.happyphpdev.com$p"
done

🤖 Generated with Claude Code