say what was actually verified about the protected paths

The .htaccess file was checked against a live shared host, so the page no longer
claims it ships untested. The nginx snippet itself has not been tried and the
text says so.

The sentence about review says who did it, so the word audit is not borrowed for
work the project did on its own.

Author: plotbird

index.html

@@ -358,8 +358,8 @@ <h3>Against Matomo</h3>
             <h2>What it is not</h2>
             <ul>
                 <li>No funnels, no A/B tests, no e-commerce reports and no session recordings.</li>
-                <li>The Apache <code>.htaccess</code> and the nginx snippet ship untested, and the documentation says so.</li>
-                <li>No independent security review has been done yet.</li>
+                <li>The bundled <code>.htaccess</code> was checked against one shared host running nginx in front of Apache: <code>config/</code>, <code>logs/</code>, <code>templates/</code>, <code>locales/</code> and <code>migrations/</code> answer 403, and directory listing is off. The nginx snippet itself is still untested.</li>
+                <li>No independent security review has been done: the code was reviewed by the maintainer against the checklist in <code>SECURITY.md</code>.</li>
                 <li>One MySQL server by design: no ClickHouse cluster, no horizontal scaling.</li>
             </ul>
             <p class="caption" style="margin-top:14px">

llms.txt

@@ -51,7 +51,11 @@ tag has to be pasted by hand.
   open-source project at github.com/plotbird/analytics.
 - The comparison table is dated October 2026 and is based on the public
   documentation of each project.
-- There has been no independent security review, and the bundled Apache
-  .htaccess and nginx snippets have not been tested on a live server.
+- No independent security review has been done: the code was reviewed by the
+  maintainer against the checklist in SECURITY.md.
+- The bundled .htaccess was verified on one shared host running nginx in front of
+  Apache: config/, logs/, templates/, locales/ and migrations/ return 403 and
+  directory listing is disabled. The documented nginx snippet has not been tested
+  on a live server.
 - The plugin is not in the WordPress.org directory; it is installed from its
   GitHub repository or from a release archive.

ru/index.html

@@ -354,8 +354,8 @@ <h3>Против Matomo</h3>
             <h2>Чего здесь нет</h2>
             <ul>
                 <li>Нет воронок, A/B-тестов, отчётов по электронной коммерции и записей сессий.</li>
-                <li>Файлы <code>.htaccess</code> для Apache и сниппет для nginx не проверены на живом сервере, и документация это не скрывает.</li>
-                <li>Независимого аудита безопасности пока не было.</li>
+                <li>Файл <code>.htaccess</code> проверен на живом хостинге, где nginx стоит перед Apache: <code>config/</code>, <code>logs/</code>, <code>templates/</code>, <code>locales/</code> и <code>migrations/</code> отвечают 403, листинг каталогов выключен. Сам сниппет для nginx по-прежнему не проверен.</li>
+                <li>Независимого аудита безопасности не было: код проверен автором по чек-листу в <code>SECURITY.md</code>.</li>
                 <li>Один сервер MySQL по устройству: ни кластера ClickHouse, ни горизонтального масштабирования.</li>
             </ul>
             <p class="caption" style="margin-top:14px">