And another one I just noticed. The login page is missing "Remember me" checkbox. Have to constantly relogin.

Another useful thing to do for the forum is Instead of a post # on top right corner you can do is link like so:

Change this

<div class="post-header-right">
                    <span class="post-number">#<?= $post_number ?></span>
                </div>

To this:

<div class="post-header-right">
    <a href="#post-<?= $post['id'] ?>" class="post-number-link" style="text-decoration:none; color:inherit;">
        <span class="post-number">#<?= $post_number ?></span>
    </a>
</div>

This is good if you want to share a link to a specific reply in the post. It will be like so:

You must log in to view this link

Custom browse button for user profile avatar: optional for visual

<form method="post" enctype="multipart/form-data" id="avatarForm">
    <h3><i class="fas fa-image"></i> <?= __('change_avatar') ?></h3>
    <?= getCSRFField() ?>

    <input type="file" name="avatar" accept="image/jpeg,image/png" id="avatarInput" class="hidden-input">
    <label for="avatarInput" class="btn-primary" style="cursor: pointer; margin-bottom: 10px;">
        <i class="fas fa-upload"></i> <?= __('choose_file') ?>
    </label>

    <p class="hint"><?= __('avatar_hint_new') ?></p>
    <button type="submit" name="update_avatar" class="btn-primary"><?= __('upload') ?></button>
</form>

And profile.css:

.hidden-input {
    width: 0.1px;
    height: 0.1px;
    opacity: 0;
    overflow: hidden;
    position: absolute;
    z-index: -1;
}

label[for="avatarInput"].btn-primary:hover {
    filter: brightness(0.95);
    transform: translateY(-2px);
}

Proper security/Core.php settings to fetch domains via Admin panel:

if (!function_exists('setSecurityHeaders')) {
    function setSecurityHeaders($force_renew = false) {
        static $headers_set = false;

        if ($headers_set && !$force_renew) {
            return;
        }
        if (headers_sent()) {
            return;
        }

       $whitelisted_raw = Settings::get('whitelist_domains', '');
$domains = !empty($whitelisted_raw) ? explode(',', $whitelisted_raw) : [];

$domain_list = [];
foreach ($domains as $d) {
    $d = trim($d);

    $domain_list[] = ' You must log in to view this link  . $d;
    // Wildcard my friend
    if (strpos($d, '*.') === false) {
        $domain_list[] = ' You must log in to view this link  . $d;
    }
}
$domain_string = implode(' ', $domain_list);

$csp = "default-src 'self'; "
         . "script-src 'self' 'unsafe-inline' 'unsafe-eval'  You must log in to view this link   You must log in to view this link  {$domain_string}; "
         . "style-src 'self' 'unsafe-inline'  You must log in to view this link   You must log in to view this link  {$domain_string}; "
         . "img-src 'self' data: https: http: {$domain_string}; "
         . "media-src 'self' {$domain_string}; " 
         . "font-src 'self'  You must log in to view this link   You must log in to view this link  data:; "
         . "connect-src 'self' https:; "
         . "frame-src 'self'  You must log in to view this link   You must log in to view this link   You must log in to view this link   You must log in to view this link  {$domain_string}; "
         . "frame-ancestors 'none'; "
         . "base-uri 'self'";

        header("Content-Security-Policy: " . $csp);

        $headers_set = true;
    }
}

In the main page of the forum each topic has a last poster with avatar and name. Good.

Since clicking on the topic it self will bring us to the topic (1st post) it only makes sense to make that "Last Poster" block clickable that would bring us to that last comment. Therefore saving us time to go through pagination.