diff --git a/.env.example b/.env.example
index a12311fe4..5de05b8f0 100644
--- a/.env.example
+++ b/.env.example
@@ -1,3 +1,18 @@
+# Meilisearch Configuration
 VITE_MEILISEARCH_HOST=https://search.bettergov.ph
 VITE_MEILISEARCH_PORT=443
-VITE_MEILISEARCH_SEARCH_API_KEY= # Meilisearch Search API Key
\ No newline at end of file
+VITE_MEILISEARCH_SEARCH_API_KEY= # Meilisearch Search API Key
+
+# Cloudflare Configuration
+BETTERGOV_ACCOUNT_ID= # Cloudflare Account ID
+BETTERGOV_BROWSER_KV_ID= # Browser KV Namespace ID
+BETTERGOV_FOREX_KV_ID= # Forex KV Namespace ID  
+BETTERGOV_WEATHER_KV_ID= # Weather KV Namespace ID
+
+# API Keys
+WEATHER_API_KEY= # Weather API key
+OPENWEATHERMAP_API_KEY= # OpenWeatherMap API key
+FOREX_API_KEY= # Forex API key
+JINA_API_KEY= # Jina.ai API key
+CF_ACCOUNT_ID= # Cloudflare Account ID (for Browser API)
+CF_API_TOKEN= # Cloudflare API Token (for Browser API)
\ No newline at end of file
diff --git a/functions/api/crawl.ts b/functions/api/crawl.ts
index 76bedcf4e..02c1e55cc 100644
--- a/functions/api/crawl.ts
+++ b/functions/api/crawl.ts
@@ -1,6 +1,104 @@
 import { Env } from '../types';
 import { fetchAndSaveContent, setDefaultCrawler } from '../lib/crawler';
 
+/**
+ * Validate URL to prevent SSRF and other attacks
+ * @param url The URL to validate
+ * @returns Whether the URL is valid
+ */
+function isValidUrl(url: string): boolean {
+  try {
+    const parsedUrl = new URL(url);
+
+    // Only allow HTTP/HTTPS protocols
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+      return false;
+    }
+
+    // Prevent localhost and private networks
+    const hostname = parsedUrl.hostname;
+    if (
+      hostname === 'localhost' ||
+      hostname === '127.0.0.1' ||
+      hostname === '0.0.0.0'
+    ) {
+      return false;
+    }
+
+    // Prevent IP addresses (only allow domain names)
+    if (/^(\d{1,3}\.){3}\d{1,3}$/.test(hostname)) {
+      return false;
+    }
+
+    // Only allow .gov.ph domains for government services
+    if (!hostname.endsWith('.gov.ph')) {
+      return false;
+    }
+
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Simple rate limiting using KV storage
+ * @param env Environment variables
+ * @param clientIP Client IP address
+ * @returns Whether request is allowed
+ */
+async function checkRateLimit(env: Env, clientIP: string): Promise<boolean> {
+  const rateLimitKey = `rate_limit:${clientIP}`;
+  const now = Date.now();
+  const windowMs = 60 * 1000; // 1 minute window
+  const maxRequests = 10; // Max 10 requests per minute
+
+  try {
+    const kv = env.BROWSER_KV;
+    const existing = await kv.get(rateLimitKey);
+
+    if (!existing) {
+      // First request from this IP
+      await kv.put(
+        rateLimitKey,
+        JSON.stringify({
+          count: 1,
+          resetTime: now + windowMs,
+        }),
+        { expirationTtl: Math.ceil(windowMs / 1000) }
+      );
+      return true;
+    }
+
+    const data = JSON.parse(existing);
+
+    if (now > data.resetTime) {
+      // Window expired, reset
+      await kv.put(
+        rateLimitKey,
+        JSON.stringify({
+          count: 1,
+          resetTime: now + windowMs,
+        }),
+        { expirationTtl: Math.ceil(windowMs / 1000) }
+      );
+      return true;
+    }
+
+    if (data.count >= maxRequests) {
+      return false; // Rate limited
+    }
+
+    // Increment count
+    data.count++;
+    await kv.put(rateLimitKey, JSON.stringify(data));
+    return true;
+  } catch (error) {
+    console.error('Rate limit check failed:', error);
+    return true; // Allow request if rate limit fails
+  }
+}
+
 /**
  * Handler for HTTP requests to the web crawling endpoint
  * This is a generic interface for crawling web content, currently using Jina.ai
@@ -15,6 +113,7 @@ export async function onRequest(context: {
   // Handle CORS preflight requests
   if (request.method === 'OPTIONS') {
     return new Response(null, {
+      status: 204,
       headers: {
         'Access-Control-Allow-Origin': '*',
         'Access-Control-Allow-Methods': 'GET, OPTIONS',
@@ -60,19 +159,90 @@ export async function onRequest(context: {
       );
     }
 
+    // Validate URL before processing
+    if (!isValidUrl(targetUrl)) {
+      return new Response(
+        JSON.stringify({
+          error: 'Invalid URL',
+          message: 'Only .gov.ph domains are allowed for crawling',
+        }),
+        {
+          status: 400,
+          headers: {
+            'Content-Type': 'application/json',
+            'Access-Control-Allow-Origin': '*',
+          },
+        }
+      );
+    }
+
+    // Check rate limit
+    const clientIP = request.headers.get('CF-Connecting-IP') || 'unknown';
+    const rateLimitAllowed = await checkRateLimit(env, clientIP);
+
+    if (!rateLimitAllowed) {
+      return new Response(
+        JSON.stringify({
+          error: 'Rate limit exceeded',
+          message: 'Maximum 10 requests per minute per IP address',
+        }),
+        {
+          status: 429,
+          headers: {
+            'Content-Type': 'application/json',
+            'Access-Control-Allow-Origin': '*',
+            'Retry-After': '60', // Retry after 60 seconds
+          },
+        }
+      );
+    }
+
     // If force update is requested, fetch it
     if (forceUpdate) {
-      const result = await fetchAndSaveContent(env, targetUrl, crawler);
+      try {
+        const result = await fetchAndSaveContent(env, targetUrl, crawler);
+
+        if (!result.success) {
+          // Return the response with CORS headers
+          return new Response(
+            JSON.stringify({
+              ...result,
+              crawler: crawler || 'default',
+            }),
+            {
+              status: 500,
+              headers: {
+                'Content-Type': 'application/json',
+                'Access-Control-Allow-Origin': '*',
+              },
+            }
+          );
+        }
 
-      if (!result.success) {
-        // Return the response with CORS headers
         return new Response(
           JSON.stringify({
-            ...result,
+            ...result.data,
+            source: 'crawler',
             crawler: crawler || 'default',
           }),
           {
-            status: 500,
+            headers: {
+              'Content-Type': 'application/json',
+              'Access-Control-Allow-Origin': '*',
+            },
+          }
+        );
+      } catch (error) {
+        console.error('Crawl error:', error);
+        return new Response(
+          JSON.stringify({
+            error: 'Crawl operation failed',
+            message: error instanceof Error ? error.message : 'Unknown error',
+            details:
+              'The crawl service may be temporarily unavailable or misconfigured. Please try again later.',
+          }),
+          {
+            status: 503,
             headers: {
               'Content-Type': 'application/json',
               'Access-Control-Allow-Origin': '*',
@@ -80,29 +250,70 @@ export async function onRequest(context: {
           }
         );
       }
+    } else {
+      // Try to get existing content from database
+      try {
+        const existingContent = await getContentByUrl(env, targetUrl, crawler);
 
-      return new Response(
-        JSON.stringify({
-          ...result.data,
-          source: 'crawler',
-          crawler: crawler || 'default',
-        }),
-        {
-          headers: {
-            'Content-Type': 'application/json',
-            'Access-Control-Allow-Origin': '*',
-          },
+        if (existingContent) {
+          return new Response(
+            JSON.stringify({
+              ...existingContent,
+              source: 'database',
+              crawler: crawler || 'default',
+            }),
+            {
+              headers: {
+                'Content-Type': 'application/json',
+                'Access-Control-Allow-Origin': '*',
+              },
+            }
+          );
+        } else {
+          return new Response(
+            JSON.stringify({
+              error: 'Content not found',
+              message:
+                'No cached content available for this URL. Use ?force=true to crawl the content.',
+              url: targetUrl,
+            }),
+            {
+              status: 404,
+              headers: {
+                'Content-Type': 'application/json',
+                'Access-Control-Allow-Origin': '*',
+              },
+            }
+          );
         }
-      );
+      } catch (error) {
+        console.error('Database error:', error);
+        return new Response(
+          JSON.stringify({
+            error: 'Database operation failed',
+            message: error instanceof Error ? error.message : 'Unknown error',
+            details: 'The database service may be temporarily unavailable.',
+          }),
+          {
+            status: 503,
+            headers: {
+              'Content-Type': 'application/json',
+              'Access-Control-Allow-Origin': '*',
+            },
+          }
+        );
+      }
     }
   } catch (error) {
+    console.error('Crawl endpoint error:', error);
     return new Response(
       JSON.stringify({
-        error: (error as Error).message,
-        status: 'error',
+        error: 'Request processing failed',
+        message: error instanceof Error ? error.message : 'Unknown error',
+        details: 'Please check the URL parameter and try again.',
       }),
       {
-        status: 500,
+        status: 400,
         headers: {
           'Content-Type': 'application/json',
           'Access-Control-Allow-Origin': '*',
diff --git a/functions/index.ts b/functions/index.ts
index f8b41876d..7989a29bc 100644
--- a/functions/index.ts
+++ b/functions/index.ts
@@ -46,6 +46,7 @@ export default {
     // Handle OPTIONS requests for CORS
     if (request.method === 'OPTIONS') {
       return new Response(null, {
+        status: 204,
         headers: corsHeaders,
       });
     }
diff --git a/manual-security-test.cjs b/manual-security-test.cjs
new file mode 100644
index 000000000..9303e96df
--- /dev/null
+++ b/manual-security-test.cjs
@@ -0,0 +1,156 @@
+#!/usr/bin/env node
+
+/**
+ * Simple manual security test for BetterGov.ph crawl endpoint
+ * This tests individual scenarios manually without overwhelming the server
+ */
+
+const BASE_URL = process.env.BASE_URL || 'http://localhost:8787';
+
+async function testUrlValidation() {
+  console.log('=== Manual URL Validation Test ===');
+
+  const testCases = [
+    {
+      name: 'Valid .gov.ph domain',
+      url: 'https://www.dof.gov.ph',
+      expectedStatus: 200,
+    },
+    {
+      name: 'Invalid domain',
+      url: 'https://www.example.com',
+      expectedStatus: 400,
+    },
+    {
+      name: 'Localhost (should be blocked)',
+      url: 'http://localhost',
+      expectedStatus: 400,
+    },
+    {
+      name: 'IP address (should be blocked)',
+      url: 'https://127.0.0.1',
+      expectedStatus: 400,
+    },
+  ];
+
+  for (const testCase of testCases) {
+    console.log(`\nTesting: ${testCase.name}`);
+    try {
+      const response = await fetch(
+        `${BASE_URL}/api/crawl?url=${encodeURIComponent(testCase.url)}`
+      );
+      console.log(`Status: ${response.status}`);
+
+      if (response.status === testCase.expectedStatus) {
+        console.log('✅ PASS');
+      } else {
+        const data = await response.text();
+        console.log(
+          `❌ FAIL - Expected ${testCase.expectedStatus}, got ${response.status}`
+        );
+        console.log(`Response: ${data.substring(0, 200)}...`);
+      }
+    } catch (error) {
+      console.log(`❌ ERROR - ${error.message}`);
+    }
+
+    // Wait between tests to avoid rate limiting
+    await new Promise(resolve => setTimeout(resolve, 2000));
+  }
+}
+
+async function testCORS() {
+  console.log('\n=== Manual CORS Test ===');
+
+  try {
+    const response = await fetch(
+      `${BASE_URL}/api/crawl?url=https://www.dof.gov.ph`,
+      {
+        method: 'OPTIONS',
+        headers: {
+          Origin: 'https://example.com',
+          'Access-Control-Request-Method': 'GET',
+          'Access-Control-Request-Headers': 'Content-Type',
+        },
+      }
+    );
+
+    console.log(`OPTIONS Status: ${response.status}`);
+    const corsHeaders = {
+      'Access-Control-Allow-Origin': response.headers.get(
+        'Access-Control-Allow-Origin'
+      ),
+      'Access-Control-Allow-Methods': response.headers.get(
+        'Access-Control-Allow-Methods'
+      ),
+      'Access-Control-Allow-Headers': response.headers.get(
+        'Access-Control-Allow-Headers'
+      ),
+    };
+
+    console.log('CORS Headers:', corsHeaders);
+
+    if (
+      response.status === 204 &&
+      corsHeaders['Access-Control-Allow-Origin'] === '*'
+    ) {
+      console.log('✅ CORS properly configured');
+    } else {
+      console.log('❌ CORS misconfigured');
+    }
+  } catch (error) {
+    console.log(`❌ CORS test error - ${error.message}`);
+  }
+}
+
+async function testMethodValidation() {
+  console.log('\n=== Manual HTTP Method Validation Test ===');
+
+  const methods = ['POST', 'PUT', 'DELETE'];
+
+  for (const method of methods) {
+    console.log(`\nTesting ${method} method`);
+    try {
+      const response = await fetch(
+        `${BASE_URL}/api/crawl?url=https://www.dof.gov.ph`,
+        {
+          method: method,
+        }
+      );
+
+      console.log(`${method} Status: ${response.status}`);
+
+      if (response.status === 405) {
+        console.log('✅ PASS - Method correctly blocked');
+      } else {
+        console.log(`❌ FAIL - Expected 405, got ${response.status}`);
+      }
+    } catch (error) {
+      console.log(`❌ ERROR - ${error.message}`);
+    }
+
+    await new Promise(resolve => setTimeout(resolve, 1000));
+  }
+}
+
+async function main() {
+  console.log('🔒 BetterGov.ph Manual Security Test');
+  console.log('=====================================');
+  console.log(`Base URL: ${BASE_URL}\n`);
+
+  try {
+    await testUrlValidation();
+    await testCORS();
+    await testMethodValidation();
+
+    console.log('\n✅ Manual testing completed!');
+  } catch (error) {
+    console.error('\n💥 Test suite failed:', error);
+  }
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { main, testUrlValidation, testCORS, testMethodValidation };
diff --git a/security-test.cjs b/security-test.cjs
new file mode 100755
index 000000000..8df5d431c
--- /dev/null
+++ b/security-test.cjs
@@ -0,0 +1,548 @@
+#!/usr/bin/env node
+
+/**
+ * Comprehensive Security Test Suite for BetterGov.ph
+ * Tests all critical security measures implemented in the crawl endpoint
+ */
+
+const BASE_URL = process.env.BASE_URL || 'http://localhost:8787';
+const TEST_TIMEOUT = 10000; // 10 seconds timeout for each test
+
+// Test URLs for different scenarios
+const TEST_URLS = {
+  // Valid .gov.ph domains
+  validGovPh: [
+    'https://www.dof.gov.ph',
+    'https://www.dbm.gov.ph',
+    'https://www.gov.ph',
+    'https://subdomain.dof.gov.ph', // Test subdomains
+    'https://www.region3.gov.ph',
+  ],
+  // Invalid domains (should be blocked)
+  invalidDomains: [
+    'https://www.example.com',
+    'https://google.com',
+    'https://facebook.com',
+    'https://malicious-site.com',
+  ],
+  // Edge cases (should be blocked)
+  edgeCases: [
+    'http://localhost', // HTTP localhost
+    'https://localhost', // HTTPS localhost
+    'http://127.0.0.1', // IP address
+    'https://192.168.1.1', // Private IP
+    'https://10.0.0.1', // Private IP
+    'https://172.16.0.1', // Private IP
+    'https://169.254.1.1', // Link-local IP
+    'ftp://example.com', // Non-HTTP protocol
+    'file:///etc/passwd', // File protocol
+    'javascript:alert(1)', // JavaScript protocol
+  ],
+};
+
+// Test results storage
+const testResults = {
+  passed: 0,
+  failed: 0,
+  details: [],
+};
+
+/**
+ * Helper function to make HTTP requests with timeout
+ */
+async function fetchWithTimeout(url, options = {}, timeout = TEST_TIMEOUT) {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeout);
+
+  try {
+    const response = await fetch(url, {
+      ...options,
+      signal: controller.signal,
+    });
+    clearTimeout(timeoutId);
+    return response;
+  } catch (error) {
+    clearTimeout(timeoutId);
+    throw error;
+  }
+}
+
+/**
+ * Log test result
+ */
+function logTest(testName, passed, details = '') {
+  const status = passed ? 'PASS' : 'FAIL';
+  const color = passed ? '\x1b[32m' : '\x1b[31m'; // Green for pass, red for fail
+  const reset = '\x1b[0m';
+
+  console.log(`${color}[${status}]${reset} ${testName}`);
+  if (details) {
+    console.log(`    Details: ${details}`);
+  }
+
+  if (passed) {
+    testResults.passed++;
+  } else {
+    testResults.failed++;
+  }
+
+  testResults.details.push({
+    name: testName,
+    passed,
+    details,
+  });
+}
+
+/**
+ * Test 1: Crawl Endpoint URL Validation Test
+ */
+async function testUrlValidation() {
+  console.log('\n=== Testing URL Validation ===');
+
+  // Test valid .gov.ph domains
+  for (const url of TEST_URLS.validGovPh) {
+    const testName = `Valid .gov.ph domain: ${url}`;
+    try {
+      const response = await fetchWithTimeout(
+        `${BASE_URL}/api/crawl?url=${encodeURIComponent(url)}`,
+        { method: 'GET' }
+      );
+
+      if (response.ok) {
+        logTest(testName, true);
+      } else {
+        const data = await response.text();
+        logTest(
+          testName,
+          false,
+          `Unexpected status: ${response.status}, body: ${data}`
+        );
+      }
+    } catch (error) {
+      logTest(testName, false, `Error: ${error.message}`);
+    }
+  }
+
+  // Test invalid domains
+  for (const url of TEST_URLS.invalidDomains) {
+    const testName = `Invalid domain blocked: ${url}`;
+    try {
+      const response = await fetchWithTimeout(
+        `${BASE_URL}/api/crawl?url=${encodeURIComponent(url)}`,
+        { method: 'GET' }
+      );
+
+      if (response.status === 400) {
+        const data = await response.json();
+        if (
+          data.error === 'Invalid URL' &&
+          data.message.includes('.gov.ph domains')
+        ) {
+          logTest(testName, true);
+        } else {
+          logTest(
+            testName,
+            false,
+            `Wrong error message: ${JSON.stringify(data)}`
+          );
+        }
+      } else {
+        logTest(testName, false, `Expected 400 but got ${response.status}`);
+      }
+    } catch (error) {
+      logTest(testName, false, `Error: ${error.message}`);
+    }
+  }
+
+  // Test edge cases
+  for (const url of TEST_URLS.edgeCases) {
+    const testName = `Edge case blocked: ${url}`;
+    try {
+      const response = await fetchWithTimeout(
+        `${BASE_URL}/api/crawl?url=${encodeURIComponent(url)}`,
+        { method: 'GET' }
+      );
+
+      if (response.status === 400) {
+        const data = await response.json();
+        if (data.error === 'Invalid URL') {
+          logTest(testName, true);
+        } else {
+          logTest(
+            testName,
+            false,
+            `Wrong error message: ${JSON.stringify(data)}`
+          );
+        }
+      } else {
+        logTest(testName, false, `Expected 400 but got ${response.status}`);
+      }
+    } catch (error) {
+      logTest(testName, false, `Error: ${error.message}`);
+    }
+  }
+}
+
+/**
+ * Test 2: Rate Limiting Test
+ */
+async function testRateLimiting() {
+  console.log('\n=== Testing Rate Limiting ===');
+
+  const testUrl = TEST_URLS.validGovPh[0]; // Use a valid URL for rate limiting test
+  const rapidRequests = 15; // More than the 10 per minute limit
+
+  // Test rapid requests to trigger rate limiting
+  let rateLimitedCount = 0;
+  let successfulRequests = 0;
+
+  for (let i = 0; i < rapidRequests; i++) {
+    try {
+      const response = await fetchWithTimeout(
+        `${BASE_URL}/api/crawl?url=${encodeURIComponent(testUrl)}`,
+        { method: 'GET' }
+      );
+
+      if (response.status === 429) {
+        rateLimitedCount++;
+        const data = await response.json();
+        if (data.error === 'Rate limit exceeded') {
+          logTest(`Request ${i + 1} correctly rate limited`, true);
+        } else {
+          logTest(
+            `Request ${i + 1} rate limited but wrong message`,
+            false,
+            `Message: ${JSON.stringify(data)}`
+          );
+        }
+      } else if (response.ok) {
+        successfulRequests++;
+        logTest(`Request ${i + 1} successful`, true);
+      } else {
+        logTest(
+          `Request ${i + 1} unexpected status`,
+          false,
+          `Status: ${response.status}`
+        );
+      }
+    } catch (error) {
+      logTest(`Request ${i + 1} error`, false, `Error: ${error.message}`);
+    }
+
+    // Small delay between requests
+    await new Promise(resolve => setTimeout(resolve, 100));
+  }
+
+  // Test that rate limiting resets after window
+  logTest(
+    'Rate limiting resets after window',
+    true,
+    `Made ${rapidRequests} requests, ${rateLimitedCount} rate limited, ${successfulRequests} successful`
+  );
+}
+
+/**
+ * Test 3: Configuration Security Test
+ */
+async function testConfigurationSecurity() {
+  console.log('\n=== Testing Configuration Security ===');
+
+  // Test that no hardcoded Cloudflare IDs exist in the code
+  const fs = require('fs');
+  const path = require('path');
+
+  const checkForHardcodedIds = directory => {
+    let foundHardcodedIds = false;
+    const files = fs.readdirSync(directory);
+
+    for (const file of files) {
+      const filePath = path.join(directory, file);
+      const stat = fs.statSync(filePath);
+
+      if (stat.isDirectory() && !filePath.includes('node_modules')) {
+        foundHardcodedIds = checkForHardcodedIds(filePath) || foundHardcodedIds;
+      } else if (file.endsWith('.ts') || file.endsWith('.js')) {
+        const content = fs.readFileSync(filePath, 'utf8');
+
+        // Check for hardcoded Cloudflare IDs
+        if (
+          content.includes('cloudflare.com') &&
+          !content.includes('env.CF_ACCOUNT_ID')
+        ) {
+          logTest(`Hardcoded Cloudflare ID in ${filePath}`, false);
+          foundHardcodedIds = true;
+        }
+
+        // Check for hardcoded API keys
+        if (content.includes('Bearer ') && !content.includes('env.')) {
+          logTest(`Potential hardcoded API key in ${filePath}`, false);
+          foundHardcodedIds = true;
+        }
+      }
+    }
+
+    return foundHardcodedIds;
+  };
+
+  const hardcodedIdsFound = checkForHardcodedIds('./functions');
+  if (!hardcodedIdsFound) {
+    logTest('No hardcoded Cloudflare IDs found', true);
+  }
+
+  // Test that environment variables are properly referenced
+  const envFile = fs.existsSync('.env.example')
+    ? fs.readFileSync('.env.example', 'utf8')
+    : '';
+  if (
+    envFile.includes('CF_ACCOUNT_ID') &&
+    envFile.includes('CF_API_TOKEN') &&
+    envFile.includes('JINA_API_KEY')
+  ) {
+    logTest('Environment variables properly defined in .env.example', true);
+  } else {
+    logTest('Environment variables missing in .env.example', false);
+  }
+}
+
+/**
+ * Test 4: CORS Security Test
+ */
+async function testCorsSecurity() {
+  console.log('\n=== Testing CORS Security ===');
+
+  const testUrl = TEST_URLS.validGovPh[0];
+
+  // Test preflight request
+  try {
+    const response = await fetchWithTimeout(
+      `${BASE_URL}/api/crawl?url=${encodeURIComponent(testUrl)}`,
+      {
+        method: 'OPTIONS',
+        headers: {
+          Origin: 'https://example.com',
+          'Access-Control-Request-Method': 'GET',
+          'Access-Control-Request-Headers': 'Content-Type',
+        },
+      }
+    );
+
+    if (response.status === 204) {
+      const corsHeaders = response.headers;
+      const allowOrigin = corsHeaders.get('Access-Control-Allow-Origin');
+      const allowMethods = corsHeaders.get('Access-Control-Allow-Methods');
+      const allowHeaders = corsHeaders.get('Access-Control-Allow-Headers');
+
+      if (
+        allowOrigin === '*' &&
+        allowMethods === 'GET, OPTIONS' &&
+        allowHeaders === 'Content-Type'
+      ) {
+        logTest('CORS preflight request properly configured', true);
+      } else {
+        logTest(
+          'CORS preflight request misconfigured',
+          false,
+          `Headers: Origin=${allowOrigin}, Methods=${allowMethods}, Headers=${allowHeaders}`
+        );
+      }
+    } else {
+      logTest(
+        'CORS preflight request failed',
+        false,
+        `Status: ${response.status}`
+      );
+    }
+  } catch (error) {
+    logTest('CORS preflight request error', false, `Error: ${error.message}`);
+  }
+
+  // Test actual GET request CORS headers
+  try {
+    const response = await fetchWithTimeout(
+      `${BASE_URL}/api/crawl?url=${encodeURIComponent(testUrl)}`,
+      { method: 'GET' }
+    );
+
+    if (response.ok) {
+      const corsHeaders = response.headers;
+      const allowOrigin = corsHeaders.get('Access-Control-Allow-Origin');
+
+      if (allowOrigin === '*') {
+        logTest('CORS headers present in GET response', true);
+      } else {
+        logTest(
+          'CORS headers missing or incorrect in GET response',
+          false,
+          `Origin: ${allowOrigin}`
+        );
+      }
+    } else {
+      logTest('GET request failed', false, `Status: ${response.status}`);
+    }
+  } catch (error) {
+    logTest('GET request CORS error', false, `Error: ${error.message}`);
+  }
+
+  // Test that no sensitive information is exposed
+  try {
+    const response = await fetchWithTimeout(
+      `${BASE_URL}/api/crawl?url=${encodeURIComponent(testUrl)}&force=true`,
+      { method: 'GET' }
+    );
+
+    if (response.ok) {
+      const data = await response.json();
+
+      // Check for sensitive information in response
+      const sensitiveKeys = ['password', 'token', 'key', 'secret', 'api_key'];
+      let foundSensitive = false;
+
+      for (const key of sensitiveKeys) {
+        if (JSON.stringify(data).toLowerCase().includes(key)) {
+          foundSensitive = true;
+          break;
+        }
+      }
+
+      if (!foundSensitive) {
+        logTest('No sensitive information exposed in response', true);
+      } else {
+        logTest(
+          'Sensitive information potentially exposed',
+          false,
+          'Response contains sensitive keywords'
+        );
+      }
+    }
+  } catch (error) {
+    logTest(
+      'Sensitive information test error',
+      false,
+      `Error: ${error.message}`
+    );
+  }
+}
+
+/**
+ * Test 5: HTTP Method Validation Test
+ */
+async function testHttpMethodValidation() {
+  console.log('\n=== Testing HTTP Method Validation ===');
+
+  const testUrl = TEST_URLS.validGovPh[0];
+
+  // Test POST method (should be blocked)
+  try {
+    const response = await fetchWithTimeout(
+      `${BASE_URL}/api/crawl?url=${encodeURIComponent(testUrl)}`,
+      { method: 'POST' }
+    );
+
+    if (response.status === 405) {
+      logTest('POST method correctly blocked', true);
+    } else {
+      logTest(
+        'POST method not properly blocked',
+        false,
+        `Status: ${response.status}`
+      );
+    }
+  } catch (error) {
+    logTest('POST method test error', false, `Error: ${error.message}`);
+  }
+
+  // Test PUT method (should be blocked)
+  try {
+    const response = await fetchWithTimeout(
+      `${BASE_URL}/api/crawl?url=${encodeURIComponent(testUrl)}`,
+      { method: 'PUT' }
+    );
+
+    if (response.status === 405) {
+      logTest('PUT method correctly blocked', true);
+    } else {
+      logTest(
+        'PUT method not properly blocked',
+        false,
+        `Status: ${response.status}`
+      );
+    }
+  } catch (error) {
+    logTest('PUT method test error', false, `Error: ${error.message}`);
+  }
+
+  // Test DELETE method (should be blocked)
+  try {
+    const response = await fetchWithTimeout(
+      `${BASE_URL}/api/crawl?url=${encodeURIComponent(testUrl)}`,
+      { method: 'DELETE' }
+    );
+
+    if (response.status === 405) {
+      logTest('DELETE method correctly blocked', true);
+    } else {
+      logTest(
+        'DELETE method not properly blocked',
+        false,
+        `Status: ${response.status}`
+      );
+    }
+  } catch (error) {
+    logTest('DELETE method test error', false, `Error: ${error.message}`);
+  }
+}
+
+/**
+ * Main test runner
+ */
+async function runTests() {
+  console.log('🔒 BetterGov.ph Security Test Suite');
+  console.log('=====================================');
+  console.log(`Base URL: ${BASE_URL}`);
+  console.log(`Timeout: ${TEST_TIMEOUT}ms per test`);
+
+  try {
+    // Run all tests
+    await testUrlValidation();
+    await testRateLimiting();
+    await testConfigurationSecurity();
+    await testCorsSecurity();
+    await testHttpMethodValidation();
+
+    // Print summary
+    console.log('\n=== Test Summary ===');
+    console.log(`✅ Passed: ${testResults.passed}`);
+    console.log(`❌ Failed: ${testResults.failed}`);
+    console.log(`📊 Total: ${testResults.passed + testResults.failed}`);
+
+    if (testResults.failed === 0) {
+      console.log('\n🎉 All security tests passed!');
+    } else {
+      console.log(
+        '\n⚠️  Some security tests failed. Please review the failures above.'
+      );
+    }
+
+    // Print detailed results
+    console.log('\n=== Detailed Results ===');
+    testResults.details.forEach(result => {
+      const status = result.passed ? '✅' : '❌';
+      console.log(`${status} ${result.name}`);
+      if (result.details) {
+        console.log(`   ${result.details}`);
+      }
+    });
+
+    process.exit(testResults.failed === 0 ? 0 : 1);
+  } catch (error) {
+    console.error('\n💥 Test suite failed with error:', error);
+    process.exit(1);
+  }
+}
+
+// Run tests if this file is executed directly
+if (require.main === module) {
+  runTests();
+}
+
+module.exports = { runTests, TEST_URLS, logTest };
diff --git a/wrangler.jsonc b/wrangler.jsonc
index a74f3eb0d..688eb622f 100644
--- a/wrangler.jsonc
+++ b/wrangler.jsonc
@@ -1,6 +1,6 @@
 {
   "name": "bettergovph",
-  "account_id": "cd41784b73cc20f93b3137292f818ff6",
+  "account_id": "{{BETTERGOV_ACCOUNT_ID}}",
   "compatibility_date": "2025-11-17",
   "assets": {
     "directory": "./dist",
@@ -8,15 +8,15 @@
   },
   "kv_namespaces": [
     {
-      "id": "124001eaebfb4815b32db5344fc59251",
+      "id": "{{BETTERGOV_BROWSER_KV_ID}}",
       "binding": "BROWSER_KV",
     },
     {
-      "id": "a1151781bef24f3092aa3ddefe86aac5",
+      "id": "{{BETTERGOV_FOREX_KV_ID}}",
       "binding": "FOREX_KV",
     },
     {
-      "id": "7e1c950bb42d4282b13e3e9524ce5335",
+      "id": "{{BETTERGOV_WEATHER_KV_ID}}",
       "binding": "WEATHER_KV",
     },
   ],