Action plan

Items in each group are in priority order. Host names: www (the main site), etfs (the ETF site), research (the research site), Institute (the education site) and ZCSH (the Zcash ETF site, www.thezcashetf.com). "Review" says whether the work needs legal, compliance or security sign-off. Redirects, sitemaps and template markup need no review of the visible page text. Titles, descriptions and H1s appear in search results, so compliance reviews them on fund pages.

Now: trust and compliance

1. Make etfs tags obey a declined cookie choice

Fixes A-1, A-11

1. Load every analytics and ad tag in the etfs tag manager only when the visitor accepts its matching category in Cookiebot, the cookie banner tool (Part H.1).
2. Turn on Google Consent Mode, with consent set to denied by default, on www and etfs.
3. Show Deny on the first banner layer.

Review: legal. Done when: after a decline and a reload of etfs.grayscale.com/gbtc, a browser network log shows 0 requests to google-analytics.com, clarity.ms, connect.facebook.net, reddit.com, ads-twitter.com and hubspot.com, or to the LinkedIn, Bing, Floodlight and Google Ads tag hosts, and no _fbp, _clck, __hstc, _gcl_au or IDE cookie is set, in 3 of 3 runs. In advanced Consent Mode, Google tags still send requests without cookies; legal decides whether basic mode is required (Part H.1).

2. Clean up the Institute test, placeholder and privacy text

Fixes A-3, C-1, C-2

1. Security reviews how the GSSPWN entries (text that matches security test markers) were created.
2. Delete the GSSPWN entries and tags, and rebuild the tag sitemap (all 12 of its rows return 404, meaning page not found).
3. Legal replaces the privacy text "We sell personal identification information to our sponsors." with Grayscale's own privacy policy text.
4. Remove or fill /course-summary/, /the-stack-subscription-test/ and the 2 pages with "Essentials go here!" or "Content goes here!" (Institute /in-practice-how-to-integrate-digital-assets-into-traditional-portfolios/ and /understanding-crypto-sectors-smart-contract-platforms/). Replace the XX placeholder values on the 2 research pages (/market-commentary/september-2025-cycles-dont-die-of-old-age and /reports/polymarket) with the real figures.

Review: legal and security. Done when: a search of the Institute server HTML for "GSSPWN", "go here!", "goes here!", "Invalid Class ID" and "We sell personal" returns 0 matches; every row of the tag sitemap answers 200 (the page loads); the 2 research pages show no XX placeholder.

3. Correct the wrong asset names on fund pages

Fixes C-3

1. Fix "TAO holdings" on the Walrus, Basic Attention Token and DeepBook trust pages and replace it with that fund's own asset name. On the GAVA document page, change "the value of Solana" to "the value of Avalanche".
2. Search every trust page and document page for a ticker or asset name that does not match the fund.

Review: compliance. Done when: each trust and document page names only its own asset, checked by a script that compares the asset names on each page with the fund name.

4. Status notes on out-of-date posts

Fixes C-4

1. Add a dated note to the top of the 27 pages that describe spot ETF approval or the GBTC conversion as pending. The note states the current status and links to the fund page.

Review: compliance. Done when: each of the 27 pages shows the note above the first paragraph.

5. Webinar marked confidential but public

Fixes C-5

Review: compliance. Done when: compliance confirms the page may be public, or its URL answers 301 or 410. The page is research /videos-and-webinars/grayscales-deeper-dive-into-basic-attention-token.

Next: technical fixes

6. Crawlable pagination on the hub list pages

Fixes A-2

1. Give each list page its own URL and link page numbers with <a href> (Part H.2).
2. Apply both changes to /the-stack, the blog hub, research /reports and research /market-commentary.

Done when: the server HTML of /the-stack?page=27 contains links to the oldest Stack articles. With JavaScript off, a crawl from the home page reaches all 108 Stack articles, 26 blog posts, 59 reports and 76 commentary pages.

7. Redirect the dead URLs

Fixes A-4, A-17

1. Add the 45 usable rows of the redirect map as single-hop 301 redirects (permanent, one redirect step to the final page; Part H.4). Set targets for the other 15: 11 have no target, and 4 point to pages that return 404. Start with the assets-under-consideration post (231 referring domains, meaning other websites that link to it). Its target still needs to be confirmed.
2. Redirect the 270 dead historic page paths to the closest live page, and the /globalassets/ PDFs to their current documents (dead-urls-to-redirect.csv).
3. Send apex variants (the bare grayscale.com domain) and trailing-slash variants (addresses ending in /) to the final URL in one hop. Change the 11 Institute 302 redirects (temporary) to 301 (permanent).

Done when: every URL in dead-urls-to-redirect.csv and the redirect map answers 301 or 308 (permanent redirects) to a page that answers 200, in at most 1 hop.

8. Canonical tags on every page

Fixes A-6

1. Print a self-referencing canonical tag on every indexable page. An indexable page answers 200 with no redirect, no noindex (a tag that keeps a page out of search results) and no query string (the part of an address after ?). Each canonical names the address without its query string (Part H.3), except paginated hub pages (Part H.2). Each paginated hub page points to its own URL (Part H.2).

Done when: 0 indexable pages lack a canonical in a fresh crawl, and the 236 parameter URLs (addresses with extra text after a ?) in the deck list carry a canonical to their clean URL.

9. Rebuild the sitemaps

Fixes A-8

1. Generate each sitemap from the published list, with only URLs that answer 200 with no redirect and no noindex, and with real lastmod dates (the date each page last changed; Part H.5).

Done when: every sitemap URL answers 200 with no redirect; every indexable page is in a sitemap; the www sitemap lists all Stack articles; the etfs sitemap lists GDLC, ETCO, BPI and BTCC; no lastmod equals the build time (when the site is built).

10. Return 404 for unknown research slugs

Fixes A-7

Return status 404 when no published entry matches the slug (the last part of the address; Part H.6). Done when: /reports/zz-test-123 and /market-commentary/zz-test-123 on research answer 404.

11. Remove the invisible zero-width characters

Fixes A-10

Turn off the visual-editing "stega" option in production builds of the content management system, or strip the characters from rendered text (Part H.7). Done when: the count of U+200B, U+200C, U+200D and U+FEFF in the server HTML of every indexable www page (including /the-stack) and research page, and in the rendered page (the page after scripts run) of every indexable etfs page, is 0.

12. Fix the footer link and internal campaign tags

Fixes A-15, A-16

Fix the footer link and remove campaign tags (utm_*) and partnerref parameters from internal links (Part H.8). Done when: a fresh crawl finds 0 hthttps links and 0 internal links with utm_ parameters.

13. Allow verified crawlers (bots that read pages) through the firewall

Fixes A-5

1. Share 30 days of firewall logs for GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot, Googlebot and Bingbot.
2. Allow the verified IP address ranges of those crawlers.

Done when: the logs show status 200 (page loaded), not 403 (forbidden) or 429 (too many requests), for verified requests from each crawler.

14. Template headings, titles and descriptions

Fixes A-12, A-13, A-18, A-19

1. Give each page one H1 (the main page heading) that names its topic. Fund page H1s give the fund name and ticker. The home page H1 states what Grayscale offers.
2. Write a title (the page name in search results) and a description (the short summary under it) for each of the 482 rows in titles-and-descriptions-to-write.csv.

Review: compliance, for fund page titles, descriptions and H1s. Done when: a fresh crawl finds 0 duplicate titles, 0 empty descriptions, 0 pages with the generic description ("A Leading Crypto Asset Manager"), and exactly 1 H1 on every indexable page.

15. Structured data, the markup that describes pages to search engines

Fixes A-14, A-26

1. Institute: set the Yoast SEO plugin's organization name, logo and social profiles to Grayscale's own.
2. www, etfs, research and the ZCSH site: add Organization, WebSite, Article and BreadcrumbList markup (Part H.8).

Done when: a search of the Institute server HTML for "Calamos" returns 0 matches; every indexable page on www, etfs, research and the ZCSH site carries Organization and WebSite JSON-LD (structured data code) that parses without error; and every article and report carries Article with author and dates.

16. Speed on mobile

Fixes A-9

1. Load chart scripts and third-party tags after the page first shows content; size the largest image for phones.

Done when: the median of 3 Lighthouse (Google's speed test) mobile runs on the www home page, etfs /gbtc and a www Stack article shows LCP (time until the main content shows) under 4.0 s and Total Blocking Time (how long the page cannot respond to input) under 600 ms.

Within 30 days

17. Accessibility basics

Fixes A-20, A-21

Done when: axe-core (an automated accessibility checker) reports 0 critical or serious violations on the 15 templates at 390 px (phone) and 1440 px (desktop).

18. Remove and merge pages

Fixes C-6, C-7

1. Remove or redirect the 10 pages marked Remove, and merge the 38 pages marked Merge into their named targets (Part G.1). Hide the email fields in the author template (C-6).

Done when: each Remove and Merge URL answers 301 to its target or 410 (page gone), and no author page shows an email address.

Optional

19. Clean the Institute robots.txt (the crawl rules file), add security headers, and tighten the ZCSH email policy

Fixes A-22, A-23, A-25

Done when: the Institute robots.txt holds no draft notes; the Vercel hosts send X-Content-Type-Options, Referrer-Policy and Permissions-Policy; thezcashetf.com publishes a DMARC email policy (the rule for mail that fails sender checks) of p=quarantine or stricter.

20. Copy edits and claims that need a source

Fixes C-8, C-10, C-11

Done when: the pages flagged in page-verdicts.csv for CONTRADICTION (C-8), UNSUPPORTED_CLAIM (C-10) and BROKEN_FORMAT (C-11) have been edited or marked as reviewed.

21. Openings that AI tools can quote, and FAQ blocks

Fixes C-9

1. Open research and blog pages with a one-paragraph answer.
2. Add a short FAQ section (questions and answers) and plain, short sentences to fund pages.

Review: compliance. Done when: the GEO citability score (Part D.1 names the scorer) (how easily AI tools can quote a page) of etfs /gbtc, etfs /btc and one research report rises above 60, and each of the 3 pages scores above 0 on FAQ content and on answer-first openings (a direct answer near the top).

22. Fix dead links to other sites and links to test sites

Fixes A-24

1. Replace or remove the 62 dead links in Part G.5.
2. Remove grayscale-etf-site.vercel.app and grayscale.verndale-local.com from the cookie banner's domain list. Remove the 2 Institute links to dev.grayscaleinstitute.com.

Done when: the 62 links answer 200 or are gone, and no page HTML (server or rendered) contains vercel.app, verndale-local.com or dev.grayscaleinstitute.com.

Engineering changes, by topic

Each change sits next to its findings. This list links to all eight.

• H.1 Consent gating (tags load only after consent) on etfs (A-1, A-11)
• H.2 Crawlable pagination (A-2)
• H.3 Canonical tags (A-6)
• H.4 Redirects (A-4, A-17)
• H.5 Sitemaps (A-8)
• H.6 Soft 404s (pages that say not found but return 200) on research (A-7)
• H.7 Invisible zero-width characters (A-10)
• H.8 Other template fixes

Work lists