Five hotfixes, before and after.

1 · Non-production hosts send a noindex header

The property hub (and the whole site) is publicly indexable on the raw staging address. Any host that is not the production domain now gets an explicit noindex header; production is allowlisted and completely unaffected.

$ curl -sI http://137.184.119.153:8180/buying-property-abroad
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
(no X-Robots-Tag: Google may index staging)

$ curl -sI http://137.184.119.153:8180/buying-property-abroad
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
X-Robots-Tag: noindex, nofollow

$ curl -sI https://www.currencytransfer.com/
(unchanged: host is allowlisted, no header sent)

Judge: the only behaviour change is on hosts that should never be indexed. Caveat: staging only picks this up when it pulls the branch; for instant containment the ops step is one nginx line (add_header X-Robots-Tag "noindex, nofollow" always;) on :8180/:8190.

2 · Wise affiliate CTAs replaced by the standard CT experience

On corridors CT historically did not serve, the live templates advertise a competitor with an affiliate link, on CT’s own URLs. The gate list is emptied so those pages render exactly what every other corridor already renders.

<a class="sf-button large green standard"
   href="https://prf.hn/click/camref:1101l7M7Z"
   rel="nofollow">
  <span class="text">Get Started With TransferWise</span>
</a>

<a class="sf-button large green standard"
   href="#modal-1" role="button" data-toggle="modal">
  <span class="text">Get Started</span>
</a>
(pair pages: the standard quote widget renders instead)

Judge: the fallback is the default branch that already serves every normal corridor, so nothing new is introduced. One business call folded in: this ends any residual TransferWise affiliate revenue from these pages. The audit’s view is that the SEO and positioning cost far outweighs it; the longer-term plan (audit item 3) is to 410 or redirect these pages entirely.

3 · Corridor schema stops lying to Google

Country pages fed country keys into currency fields, so all 1,890 corridor pages carry malformed, invisible structured data. Invisible FAQ markup that matches no on-page content is named Google spam-policy territory, which makes this a liability, not an asset.

{ "@type": "FAQPage",          invisible: no FAQ section
                                exists on corridor pages
  "mainEntity": [{
    "name": "How long does an AE to UK transfer take?", ...
}
{ "@type": "FinancialProduct",
  "offers": { "priceCurrency": "AE" }, ... }

No FAQPage markup on corridor pages (it only renders
where the visible FAQ section exists, on pair pages,
and only when those FAQs are non-empty).

{ "@type": "FinancialProduct",
  "name": "Money Transfer from United Arab Emirates
           to United Kingdom",
  "offers": { "priceCurrency": "AED" }, ... }

Judge: corridor pages lose only invalid markup that could never earn rich results and could earn a manual action. Pair pages keep their FAQ schema, now guaranteed to match the visible accordion. The generic invisible FAQ fallback (four boilerplate Q&As rendered nowhere) is deleted.

4 · Debug dumps out of the page source

<!--
$transfer: [send-money-from-uae-to-uk]
$default_send_amount: [10000]
$send: [ae]
$receive: [uk]
-->

(removed)

5 · The UAE has banked Monday to Friday since January 2022

Every corridor module still claimed the UAE works Sunday to Thursday, four years after the change, including all the derived advice (“four-day overlap”, “Thursday is the last UAE banking day”). 107 strings corrected. Saudi Arabia, Kuwait and Israel genuinely do bank Sunday to Thursday; a full-repo sweep confirmed those claims are untouched. This is the one change a visitor can see, which is the point: the current copy is factually wrong on live pages.

Judge: all replacements are factual corrections with the surrounding advice rewritten to match (edge day moves from Thursday to Friday where the weeks now align, and Gulf pairs now state the real Mon-Thu shared window). Full before/after list above, grouped by corridor.

Test evidence

The theme’s standalone corridor suites, run in the staging PHP 7.4.33 container, on pristine origin/main and on this branch. All changed PHP lints clean.

No new failures; two suites improve because the corrected copy satisfies assertions the old copy failed. The failures that remain all pre-date this branch (humanizer vocabulary, use-case counts, advisory-word checks) and are a separate clean-up.

Shipping and rollback

Deploy: merge to main, deploy as usual, then purge Cloudflare (purge-cache.sh): corridor and pair pages are edge-cached for days, so the fixes only reach crawlers after a purge. Staging picks up the noindex header when it pulls.

Rollback: one commit per change, so git revert <sha> undoes any single item without touching the rest: d234b00 noindex · bde0361 Wise CTAs · dfa2b35 schema · 29192db debug · 39d9c03 UAE week.

Not in this PR (not theme code): MoverDB’s false FCA claim (outreach), Daniel on live /about and /press plus the /security-regulation wording (WordPress page edits in the database), and the llms.txt link fixes (static file in the prod docroot).