Sitemap/robots.txt, custom 404, redirects, per-page SEO, and CSP — deployment questions

[tblackmon-create]

Hi team — really enjoying working with Instatic so far. A few questions as we get close to launching a client site, some of which might be missing features and one might be a bug:

1. Sitemap.xml / robots.txt — Both return 404 on our deployment. Is there a way to have these auto-generated, or a place to supply static files at the domain root?

2. Custom 404 page — Unknown URLs return a bare JSON body ({"error":"Not found"}) instead of an HTML page. Is there a setting for a custom 404, or is this on the roadmap?

3. Server-level redirects — We're migrating an old site with a couple hundred URLs that need to map to new ones. We checked Data, Settings, and Plugins in the admin and did not find a redirects feature. Is this possible at the hosting layer (e.g. on Railway), or planned?

4. Per-page/per-post SEO fields do not appear to affect output — This might be a bug: individual Posts have seoTitle/seoDescription fields in the editor, and we have filled them in, but every page on the published site (including individual post pages) renders the identical site-wide default <title>/meta description instead. Is there a step we're missing to wire these up, or is this not yet implemented?

5. CSP and third-party scripts — The default script-src 'self' policy blocks things like Google Analytics. Is there a supported way to allow-list specific third-party scripts per-project?

Any pointers appreciated — trying to figure out what's possible before our launch date, and what we should plan to build around instead. Thanks for the great tool!

[NotAFlightRisk]

Checked against v0.0.20, the current release:

1. Neither is generated and there's nowhere to put root files, so they'd need serving from a proxy or CDN in front.

2. Yes - in the Site editor add a New template, set Applies to --> Not found (404), design it and publish. Unknown URLs then get it with a real 404 status. Docs.

3. No redirects feature. The only automatic 301s are for changed post slugs, so old URLs need doing at the proxy.

4. That was a bug in v0.0.16 and older, fixed in v0.0.17 (#419). Check your image tag, update and republish the posts. Pages have no SEO fields, but Settings --> General --> Meta Title takes tokens, so {page.title} | Acme gives each page its own title.

5. No per-project allow-list. The CSP is a <meta> tag with no setting, and plugins can only add inline scripts or files they ship, so gtag.js from Google stays blocked. A proxy CSP header can't loosen it, the browser enforces both.