Master Prompt: Complete Blog Website Code Review, Security Audit & Production Readiness

Role

Act as a Principal Software Engineer, Senior Web Architect, Application Security Engineer, Performance Engineer, SEO Specialist, and QA Lead.

Conduct a complete end-to-end audit of the existing blog website. Review the actual codebase, identify weaknesses, and improve the application so it is secure, fast, SEO-friendly, reliable, maintainable, accessible, and ready for production.

This is a full blog website, so prioritize article discovery, reading experience, content management, search engine visibility, page speed, content integrity, and publishing workflows.

Do not limit the review to a few files or provide recommendations without implementation. First audit the entire application, create a prioritized improvement checklist, and then fix issues systematically without breaking existing functionality.

1. Blog Architecture & Code Quality

Review the complete repository, folder structure, routes, layouts, components, hooks, utilities, APIs, and data access.
Identify duplicated code, unused files, dead code, unnecessary dependencies, and inconsistent implementations.
Ensure shared components such as blog cards, article images, author details, category badges, and related-post sections are reusable.
Verify that feature-specific logic stays within its appropriate module.
Review the theme system, global styles, typography, spacing, and design tokens.
Identify circular dependencies, incorrect imports, poor abstractions, and unnecessary complexity.
Keep the architecture clean, modular, and easy to extend.

2. Blog Pages & User Experience

Inspect every existing page and route, including applicable:

Homepage and blog landing page.
Blog listing and category pages.
Individual article pages.
Author profile pages.
Search results and tag pages.
Related articles and recommended content.
About, contact, privacy, terms, and other informational pages.
Custom 404 and error pages.
Admin dashboard, editor, and publishing screens, if present.

Review navigation hierarchy, page structure, responsive behavior, typography, readability, and consistency.

Improve the reading experience with appropriate line lengths, heading hierarchy, spacing, images, captions, quotes, tables, code blocks, and table of contents where useful.

Verify that navigation, pagination, filters, search, related links, and article actions work correctly.

Do not invent new pages or redesign working features without a clear reason.

3. Blog Content & Publishing Workflows

Review the complete content lifecycle:

Creating, editing, previewing, publishing, scheduling, unpublishing, and deleting articles.
Draft, published, scheduled, and archived content states, where supported.
Article slugs, titles, excerpts, authors, categories, tags, and featured images.
Rich-text or Markdown rendering and content sanitization.
Image uploads, captions, alternative text, and media management.
Duplicate slug prevention and validation.
Draft preservation and accidental data-loss prevention.
Scheduled publishing behavior and time-zone handling.
Permissions for authors, editors, and administrators, if applicable.
Safe handling of deleted articles and existing inbound links.

Ensure unpublished drafts are not publicly accessible through page routes, APIs, search results, sitemaps, or related-post queries.

Preserve the existing CMS or content-management architecture unless a change is necessary.

4. Blog SEO & Search Engine Indexing

Treat SEO as a core requirement for a public blog.

Review:

Unique titles and meta descriptions for every indexable page.
Canonical URLs and duplicate-content prevention.
Clean, stable, human-readable article slugs.
XML sitemap generation and correct sitemap contents.
robots.txt and indexing directives.
Open Graph and social-sharing metadata.
Structured data, especially Article or BlogPosting, BreadcrumbList, and Organization where appropriate.
Author information, publication dates, and modification dates.
Internal linking between articles, categories, and relevant pages.
Heading hierarchy and semantic HTML.
Image alt text and descriptive filenames where appropriate.
Pagination and category-page indexing.
Redirects when article slugs change.
Correct handling of 404 and 5xx responses.
Crawlability of article content and rendering behavior.
Broken links, duplicate metadata, and orphaned articles.

Do not invent structured-data values, authors, dates, ratings, or other metadata. Keep private and unpublished content out of public search indexes.

5. Blog Performance & Page Speed

Inspect and optimize the entire website.

Initial page load and navigation speed.
Core Web Vitals: LCP, INP, and CLS.
Image optimization, responsive image sizes, and lazy loading.
Fonts, CSS, JavaScript bundles, and third-party scripts.
Server-side rendering, static generation, and incremental regeneration where supported.
Caching of article pages, metadata, and appropriate API responses.
Unnecessary client-side rendering and re-renders.
Duplicate requests and excessive data fetching.
Database query performance and N+1 queries.
Pagination and limits on large content collections.
Related-post queries and search performance.
Build size and unused dependencies.

Preserve correct content freshness when articles are updated or published. Make sure caches and generated pages are invalidated appropriately.

Measure performance before and after optimization when the necessary tools are available. Never invent performance scores or claim improvements without evidence.

6. API, Database & Content Integrity

Review every relevant API, database query, content source, and integration.

Validate requests and responses.
Check authentication and authorization.
Prevent SQL or NoSQL injection.
Review query efficiency, indexes, pagination, and connection handling.
Verify article-to-author, article-to-category, and article-to-tag relationships.
Prevent duplicate records and conflicting slugs.
Check concurrent edits, publishing operations, and data consistency.
Review database migrations and rollback safety.
Ensure public APIs expose only published, authorized content.
Check error handling, timeouts, rate limits, and caching.
Validate external content, image providers, analytics, and other integrations where applicable.

Do not execute destructive queries or modify production data during the audit.

7. Security & Privacy

Perform a defensive security review of the blog and any administrative interface.

Check:

Authentication, authorization, and session handling.
Broken access control and privilege escalation.
XSS in article content, Markdown, HTML, comments, and rich-text rendering.
CSRF, injection, SSRF, and unsafe URL handling where applicable.
File upload validation and unsafe media processing.
Exposed API keys, tokens, credentials, and environment variables.
Admin route protection and server-side permission enforcement.
Rate limiting and abuse prevention.
Security headers, CORS, cookies, and browser storage.
Dependency vulnerabilities and insecure configurations.
Privacy and consent controls for analytics, forms, and tracking.
Exposure of drafts, private content, user data, or internal errors.

Verify findings against the actual implementation. Use authorized, non-destructive testing only, and redact secrets in reports.

Review the blog's content-discovery experience.

Search accuracy and relevant results.
Category and tag filtering.
Pagination and sorting.
Related and recommended article logic.
Empty search results and no-content states.
Duplicate results and incorrect article metadata.
Search performance with large content collections.
Mobile navigation and discoverability.
Internal links and breadcrumbs.

If search is not implemented, recommend it only when it fits the blog's needs and architecture.

9. Accessibility & Responsive Design

Semantic HTML and proper heading order.
Keyboard navigation and visible focus indicators.
Screen-reader labels and accessible interactive controls.
Color contrast and readable typography.
Accessible forms, menus, dialogs, and search.
Reduced-motion preferences.
Responsive layouts across desktop, tablet, and mobile.
Usable code blocks, tables, images, and article navigation.
Accessible error messages and validation feedback.

Verify that performance or design changes do not introduce accessibility regressions.

10. Reliability, Infrastructure & Deployment

Review:

Environment configuration and secret management.
Production build and deployment configuration.
Logging, error reporting, monitoring, and alerts.
Health checks and external service failures.
Cache invalidation and content update propagation.
Scheduled publishing jobs, if applicable.
Backup and restoration procedures for content and media.
Deployment rollback and database migration safety.
Broken image or external content handling.
Resource limits and behavior under increased traffic.
Third-party integration timeouts and recovery.

Document infrastructure checks that cannot be verified from source code alone.

11. Testing & Quality Assurance

Run the available checks and identify missing coverage:

Formatting, linting, and type checking.
Unit and integration tests.
Article rendering and content-sanitization tests.
API and database tests.
Draft and published-content access tests.
SEO metadata and sitemap validation.
Route, pagination, search, and navigation tests.
Responsive and accessibility checks.
Performance checks and production build.
End-to-end publishing and editing workflows.
Regression tests for existing functionality.

Prioritize tests according to security risk, content integrity, business impact, and likelihood of failure.

12. Audit Methodology

Phase 1 — Discover: Map the repository, technologies, routes, components, APIs, content sources, and integrations.

Phase 2 — Baseline: Run existing checks and record pre-existing failures and available performance measurements.

Phase 3 — Audit: Review the entire blog from the perspectives of architecture, content, SEO, performance, security, UX, and reliability.

Phase 4 — Prioritize: Classify findings as Critical, High, Medium, Low, or Informational, with evidence and confidence.

Phase 5 — Report: Produce a prioritized pre-release checklist before substantial changes.

Phase 6 — Fix: Resolve critical security issues, content exposure risks, data integrity defects, and major performance problems first. Then address maintainability, SEO, UX, and lower-priority improvements.

Phase 7 — Validate: Run relevant checks and tests after each meaningful group of changes.

Phase 8 — Final review: Verify the fixes, document remaining issues, and assess release readiness.

Do not rewrite working features unnecessarily or introduce new dependencies without justification.

13. Required Final Deliverables

Provide:

Executive summary of the blog's overall health.
Inventory of all pages, routes, APIs, and publishing workflows inspected.
Findings register with severity, evidence, affected files, impact, fix, effort, and validation.
SEO, security, accessibility, performance, and reliability assessments.
Prioritized improvement roadmap.
A pre-release checklist marked Pass, Fail, Blocked, or Not Applicable.
Actual lint, type-check, test, build, and performance results.
List of files changed, removed, or created.
Remaining issues and manual verification requirements.
Final release recommendation: Ready for Release, Ready with Accepted Risks, or Not Ready for Release.

Final Instruction

Act as the Principal Engineer accountable for this blog's production quality.

First, audit the actual codebase and prepare the prioritized checklist without modifying files. Then implement approved improvements in small, verifiable steps, preserve existing functionality, and validate every important change.

Do not claim the blog is fully secure, optimized, or production-ready unless the relevant checks have actually been performed.

The goal is to deliver a fast, secure, SEO-friendly, accessible, maintainable, reliable, and production-ready blog with an excellent content-reading and publishing experience.