diff --git a/public/_headers b/public/_headers
index b70f646..4cba835 100644
--- a/public/_headers
+++ b/public/_headers
@@ -1,3 +1,12 @@
+/*
+ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
+ Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com https://cdn-cgi.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://forgeos-api.synctek.io https://plausible.io; frame-ancestors 'none';
+ X-Frame-Options: DENY
+ X-Content-Type-Options: nosniff
+ Referrer-Policy: strict-origin-when-cross-origin
+ Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
+ Cross-Origin-Opener-Policy: same-origin
+
/.well-known/*
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
diff --git a/public/_redirects b/public/_redirects
index 5d7d9e6..42d9c54 100644
--- a/public/_redirects
+++ b/public/_redirects
@@ -1,3 +1,4 @@
/forgeos/ /products/forgeos/ 301
/forgeos/pricing/ /products/forgeos/pricing/ 301
/forgeos/pricing /products/forgeos/pricing 301
+/pricing /products/forgeos/pricing/ 301
diff --git a/src/components/SupportWidget.astro b/src/components/SupportWidget.astro
deleted file mode 100644
index 549969d..0000000
--- a/src/components/SupportWidget.astro
+++ /dev/null
@@ -1,25 +0,0 @@
----
-/**
- * SupportWidget — top-level wrapper for the SiteAtlas Support Chat Widget.
- *
- * Imported in BaseLayout.astro. Only renders when PUBLIC_SUPPORT_API_URL is set.
- * Passes the configured API URL and product slug to the ChatWidget.
- */
-import ChatWidget from './support/ChatWidget.astro';
-
-interface Props {
- productSlug?: string;
-}
-
-const { productSlug = 'siteatlas' } = Astro.props;
-
-// Graceful degradation: render nothing if the API URL is not configured.
-// The ChatWidget itself also handles the missing-URL case, but we short-circuit
-// here to avoid shipping the widget JS/CSS to pages where support isn't wired up.
-const apiUrl = import.meta.env.PUBLIC_SUPPORT_API_URL ?? '';
-const shouldRender = apiUrl.length > 0;
----
-
-{shouldRender && (
-
How can we help?
-Ask anything about SiteAtlas. Our AI support agent usually responds in seconds.
-