Changelog

A lot of new sites came in this past week, and most of them showed up on the homepage with a logo, a monogram, or nothing at all. So I ran the photo hunt again. The agents looked at all 155 live sites, found 32 cards that showed a logo or a soft, tiny photo, and went looking for a real picture of the person on their own homepage, about page, or a social profile their site links to.

29 of the 32 now show a real face. That includes 12 cards that already had a photo, but a 32px one that looked blurry, and now have a sharp one. The other three people only publish a drawing or a 3D avatar of themselves, so I left those alone. Same rules as before: only photos you already published yourself, cropped square, 128px.

If you use Cloudflare D1 and have a VPS, check where your database actually lives.

I found out that my Cloudflare databases were in Europe and I didn't know it. So two of my sites were doing trans-Atlantic round trips on every uncached page load, on accident. It slowed down the sites and made my crawl times worse.

Every new submission that doesn't link back to me now gets read by an AI before it goes live, not just the ones that looked suspicious. It also checks the site's homepage, not just the /friends page itself, and a nightly pass re-checks the ones that are already up. I also wrote the rule down plainly on the about page: personal websites only, no company pages.

Most pages on the site are now cached at Cloudflare's edge and only get regenerated the moment something actually changes — a new site added, a listing updated. I timed it just now: the homepage loads in about 470ms on a fresh, uncached hit, and about 75ms once it's cached. Roughly 6x faster. The about and submit pages are fully static now too.

The browse bar used to run off the edge of the screen on mobile — the tagline, the full site URL, and a redundant "Next" label were all fighting for space that isn't there on a 360px-wide phone. Trimmed it down to just what you need: a way back, a way forward, and where you are.

Every site in the directory now has a page of its own at slashfriends.org/site/yourdomain.com. It shows the card, the excerpt, a "who they link to" list pulled straight from their /friends page, and a few more pages worth clicking into. The homepage's date links and the browse page's "site info" link both point here now.

A few good ones to click through:

When a site blocks embedding, the browse page shows a card with a link instead of the page itself. The rotation used to put all of those card sites in one block at the end of the lap, so if you browsed far enough you hit around 20 cards in a row. I hit that streak myself today and it was a bad experience.

Now the card sites are spread evenly through the lap, about one card after every three or four embedded pages, and never two in a row. You still see every site exactly once per lap. Right now 82 of the 105 sites in the rotation embed, and 23 show cards.

Almost nobody finds the browse page, the StumbleUpon-style viewer that flips through everyone's /friends pages. But the few who do click through almost five pages each. Best engagement on the site, worst discovery.

So today the site got more doors into it:

• The homepage grid has a yellow card after every 12 sites that says "Take me to a random page" (the label rotates).
• The browse bar has little Prev // Next links, so you can walk backward too.
• The about page, the bottom of the homepage index, and the card you see when a site can't be embedded all link into browse now.
• When your site gets listed, the confirmation email shows you your own spot in the rotation.

I also removed the search box from the homepage. It only searched titles and short excerpts, so searching "Texas" found nobody, including me. Your browser's find-on-page works better.

When you browse, a site either shows up right on the page or, if it blocks embedding, you get a card with a link instead.

88 of the 113 listed sites embed now, up from 69. Most of the rest are on platforms like Substack and Squarespace that block embedding for everybody.

A bunch of /friends cards here showed a plain gray letter instead of a person, because the site has no favicon. Other sites had tiny default icons. (Even my own site had an American flag icon, which I think is cool.)

But this directory is about people, and faces are better!

So today I fired up some agents to go looking for real photos. I think we'll only share pictures you already published yourself, on your homepage, your about page, or a social profile your own site links to. The agents cropped each one square, ran some sort of face-center algo on the images, then emailed everyone to ask permission before posting. Here's the actual email:

Within a few hours, 15 of the 27 people I emailed had clicked yes, and nobody has said no. Here are a few of the swaps:

For nerds: we used OpenCV's Haar-cascade face detection to find and center each face, then saved 128px WebP icons. Approvals are one-click tokenized links on a Cloudflare Worker, with the decisions in a D1 database, replacement photos uploading to R2, and the permission emails going out through Cloudflare Email Service. An approved photo activates instantly, no redeploy.

It turns out /friends pages are not my idea. The IndieWeb community has been making personal websites that link to each other for years, and their wiki already lists /friends as a kind of page you can have. Lukas Rosenstock emailed me to point this out, and I think someone over there added slashfriends.org to the wiki. I have a profile there now too. Great community. Go look.

Lukas also pointed me at rel="friend", a small attribute you can put on a link to say this is a person I actually know. Nice idea, and you should add it if you like it. I am not going to require it. The only thing you need to get listed here is a real page at yourdomain.com/friends.

Two people updated their site's favicon and the directory kept showing the old one. Zach Ware's card showed a purple square when his site has an American flag, and K. Elizabeth Coggins's showed a generic gray cube instead of her photo.

Turns out I was getting every icon from Google's favicon service, and Google's copy can go stale for months. DuckDuckGo has an icon service too, and it fetches your site's actual current favicon. So now I ask DuckDuckGo first and only fall back to Google when DuckDuckGo comes up empty. I tested it by hammering their service with all 87 sites at once from my server, four times in a row, and it never once complained.

Nerdy detail: DuckDuckGo hands back your original favicon file, which is what makes it fresh, but originals can be huge. One site's icon is a 108KB PNG. Anything over 30KB still gets Google's tiny resized version instead, so the homepage stays fast.

A friend emailed me: he built a /friends page, submitted it here, and got rejected. News to me. When a submission failed, my system told the submitter and then forgot it ever happened. He only got listed because he happened to know me.

His page was real, and good. But his site builds itself entirely with JavaScript, so my crawler sees an empty page no matter what. I added him by hand, and now every rejected submission gets logged with the reason, and a nightly email shows me what bounced. If the system turns someone away by mistake, I'll actually know about it.

A 2012 blog post got listed as a /friends page this morning. Someone submitted a site whose WordPress guessed at the URL instead of 404ing, so /friends quietly redirected to an old post that happened to be titled "Friends". It was a real page with real links out, so every check I had passed it.

I was only checking that the redirect landed on a URL with "friends" somewhere in it, and /2012/07/friends.html clears that bar. Now the redirect has to land on an actual /friends page, and anything else gets held for me to look at. Redirecting to www still works fine, and so does Blogger and Substack putting their pages at /p/friends.

When a submission gets held and its page doesn't link back to me, I now have an AI read the page and decide whether it's genuinely a list of other people's websites or just an essay about friendship. If it's clearly not a /friends page, you get told right away instead of waiting on me. Nothing gets saved, so you can fix your page and resubmit immediately.

It only gets to say no, never yes. Anything it thinks is fine still comes to me to look at, because a wrong no just means you email me and I sort it out, while a wrong yes would sit on the homepage with nobody watching. It also has to actually be able to read your page. If your /friends page builds itself with JavaScript, my crawler sees an empty page, and "I can't read this" is not the same as "this is bad". Those still come to me.

If your page links back to me, none of this runs at all. You've already told me what the page is.

I wrote an article about /friends pages over on my other website, The Friendship Recession. It's about what a /friends page actually is, why I made one for myself, and why I liked the idea enough to go build this whole directory.

FThe Friendship RecessionWhy Every Personal Website Needs a /friends PageA /friends page is a list of the people you know and like, at yourdomain.com/friends. Here's why I built one, why I made a directory of them, and how to make yours.Read the article →

You don't have to read it. But I made a bunch of illustrations for it, and those I do want to show off.

I now check that your /friends page is actually a page. Some sites answer every URL with the same thing, so /friends looked real but was just a copy of their homepage. Now I also ask the site for a URL that can't possibly exist. If that comes back looking the same as /friends, then there's nothing there, and the submission doesn't get listed.

Nerdy detail: it compares the visible text of the two pages, not the raw HTML. Hashing the markup doesn't work, because one of the sites I caught this way hands back slightly different bytes on every single request. Strip the tags out and the two pages are word for word identical.

Long domain names were wrapping onto two lines, which made their card taller than everything around it. They now stay on one line and trail off with an ellipsis, like trevormckendrick…

I gave the cards on the homepage and the about page a new look. The old ones had a big yellow banner and a white frame around each favicon. The new ones lead with the domain in bold, show the favicon cleanly with no frame, and sit on a hard black drop shadow that pops when you hover over them. The FEATURED badge moved to a little ribbon stitched into the corner.

I told the first people who added a /friends page that I'd link back to them from my personal blog, and today I did. A fresh batch of you is now listed over on nickgray.net/friends.

The about page got a full redesign. A bigger hero, cards showing real /friends pages from the directory, a better AI prompt section, and a bunch of mobile fixes.

Every favicon on the site broke this morning. A caching bug in my icon proxy was corrupting the images, so every site showed a blank square. Fixed, and I wrote a postmortem.

Here's how favicons work here, because it's kind of neat. Every icon is proxied through this site at /fav/yourdomain.com and cached at the edge for a day, so your browser never talks to Google's favicon service directly. And when a site has no favicon at all, Google returns a tiny generic globe. I detect that and swap in a yellow monogram tile with the first letter of the domain instead. Here are some from the directory:

Sketchy submissions now get held as pending, and I approve or deny them from an email. I also turned on Cloudflare Turnstile on the submit form. Real people only, please.

The random page button got smarter. "Next page" now cycles through every site in order, so you see each one exactly once per lap. And sites that block iframes get a nice fallback card instead of an error. Nerdy detail: before embedding a site, my crawler reads its X-Frame-Options and Content-Security-Policy headers to see if the site allows being shown in an iframe. Sites that say no get the card instead, and the card even quotes the exact header that blocked it.

Canonical URLs, per-page descriptions, JSON-LD structured data, and 301 redirects to kill trailing slashes. Boring but important. Robots deserve clean URLs too.

Added a proper confirmation page after you submit your site. Put browse in the nav. Added privacy-friendly analytics from Plausible.

The homepage got brand new cards: a yellow banner, a stamp-framed favicon, and a hard black border. I call the design "Banner bold" and it took five rounds of mockups to get there.

Sites whose /friends page links back here (or to my site) now get a little FEATURED badge on their card. Linking out is generous. Linking back is friendly.

There's now a prompt you can copy and hand to an AI agent, and it will build your /friends page for you. It's at the bottom of the homepage and on the about page.

Added an RSS feed at /feed.xml, a public JSON dump at /sites.json, an llms.txt for the AI agents, a sitemap, a social share image, and a proper 404 page. The machines are well fed. Here's that share image:

This site has no JavaScript framework, and all the CSS gets inlined into the page at build time, so there are zero render-blocking requests. Combined with the same-origin favicon proxy, the whole thing loads in about one round trip. PageSpeed likes it a lot.

Some Substack-hosted /friends pages were failing verification because Substack blocks robot-looking requests. My checker now sends a browser-flavored request and retries politely on 429 and 403 errors. If your submission failed before, try again.

While I'm here, some detail on the crawler: it visits every listed site once a day to make sure the page is still live, pulls the title and a short excerpt for the directory card, decodes messy HTML entities, and notices when a /friends page links back here. Sites that link back get the FEATURED badge on the homepage.