https://www.icsi.edu/

1<!doctype html>
2<html lang="en">
3  <head>
4    <meta charset="UTF-8" />
5    <!--
6      Self-hosted. This used to point at https://www.icsi.edu/…/favicon.ico,
7      so every page load on every environment fetched an asset from the live
8      public site — including a load test, which would have aimed its whole
9      run at a site that was not under test. Same file, served from here.
10      (type was also declared image/svg+xml for what is a PNG.)
11    -->
12    <link rel="icon" type="image/png" href="/favicon.png" />
13    <!--
14      No preconnects. The API is served from this same origin now (see
15      VITE_API_BASE_URL in env.prod), so there is no second handshake to warm -
16      the connection that fetched this document is the one the API calls use.
17
18      They were not free: preconnect opens a TLS connection eagerly, whether or
19      not the page turns out to need it. Three origins x every visitor is three
20      handshakes and three held sockets, which is the right trade for latency and
21      the wrong one against an ingress that is failing to accept connections at
22      all. Uploaded media still comes from the object store, but it is fetched
23      well after first paint and does not justify a socket held from parse time.
24    -->
25    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
26    <meta name="robots" content="index, follow" />
27    <title>ICSI — The Institute of Company Secretaries of India</title>
28    <meta
29      name="description"
30      content="Official website of The Institute of Company Secretaries of India (ICSI), a statutory body under the Ministry of Corporate Affairs, Government of India."
31    />
32    <!--
33      Open Sans is self-hosted now — the @font-face rules live in src/index.css
34      and the files in public/fonts/. The two preconnects and the stylesheet
35      link that stood here made fonts.googleapis.com a render-blocking third
36      party on every first visit.
37    -->
38
39    <!--
40      No analytics tag here any more, and that is the point.
41
42      It used to be a hardcoded Google snippet, which meant the measurement ID —
43      and the decision to measure at all — were a code change and a deploy away.
44      Tracking is now CMS-managed: editors add snippets under
45      System > Analytics & Tracking in the CMS, activate or deactivate them
46      there, and src/analytics.js injects whatever /api/analytics-scripts/
47      returns at boot.
48
49      Trade-off, stated plainly: a tag fetched at runtime fires later than one
50      parsed from this file, so a visitor who leaves within the first moment is
51      not counted. That is the price of switching tags without a deploy, and it
52      is the trade this feature was asked for.
53
54      nginx must still allow each vendor's host in script-src — see
55      security-headers.conf. The CMS screen warns when an active snippet names a
56      host the policy does not permit.
57    -->
58    

58<script type="module" crossorigin src="/assets/index-CMfIf9m3.js"></script>

58
59    <link rel="stylesheet" crossorigin href="/assets/index-DKFIKKzy.css">
60  </head>
61  <body>
62    <div id="root"></div>
63  </body>
64</html>