diff --git a/deploy/nginx/host/sparkmessenger.conf b/deploy/nginx/host/sparkmessenger.conf
index be3dba3..75a9074 100644
--- a/deploy/nginx/host/sparkmessenger.conf
+++ b/deploy/nginx/host/sparkmessenger.conf
@@ -31,6 +31,9 @@ server {
     add_header X-Content-Type-Options nosniff always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 
+    # Mainland CN except Shanghai → Chinese deny page (overseas + Shanghai allow)
+    include /etc/nginx/snippets/wyrs-cn-geo-access.conf;
+
     root /var/www/sparkmessenger.wyrs365.com;
     index index.html;
 
@@ -47,6 +50,11 @@ server {
         try_files $uri =404;
     }
 
+    # Marketing site only — never expose API / OpenAPI / architecture docs here.
+    location ~* ^/(docs|openapi|swagger|architecture)(/|\.|$) {
+        return 404;
+    }
+
     location / {
         try_files $uri $uri/ /index.html;
     }
diff --git a/website/index.html b/website/index.html
index 33f2429..7102e83 100644
--- a/website/index.html
+++ b/website/index.html
@@ -36,7 +36,6 @@
         <p class="lede">把对话、群聊与朋友圈收进同一束火花——安静、可靠、随处可达。</p>
         <div class="cta">
           <a class="btn btn-primary" href="#download">获取应用</a>
-          <a class="btn btn-ghost" href="https://sparkapi.wyrs365.com/docs" rel="noopener">开发者文档</a>
         </div>
       </div>