diff --git a/assets/sass/pages/_single.scss b/assets/sass/pages/_single.scss
index 5721a432..3163a12a 100644
--- a/assets/sass/pages/_single.scss
+++ b/assets/sass/pages/_single.scss
@@ -32,12 +32,9 @@ main#single {
         margin-bottom: 0.4em;
       }
 
-      // image captions -- two different markdown hacks
-      img + em,
+      // image captions
       figure figcaption {
-        display: block;
         font-size: 0.9em;
-        font-style: normal;
         color: $color-medium;
         text-align: center;
       }
diff --git a/content/notes/bernie-sanders-bern-app-data/index.md b/content/notes/bernie-sanders-bern-app-data/index.md
index 48732ed0..cc92bcae 100644
--- a/content/notes/bernie-sanders-bern-app-data/index.md
+++ b/content/notes/bernie-sanders-bern-app-data/index.md
@@ -14,7 +14,7 @@ draft: false
 
 The team behind Bernie Sanders' 2020 campaign [released a new web app](https://www.nbcnews.com/politics/2020-election/bernie-sanders-2020-campaign-unveils-app-increase-its-voter-database-n999206) last month named [BERN](https://app.berniesanders.com/). The goal of BERN is simple: to gather as much information as they can on as many voters in the United States as they can, and make their grassroots army of enthusiastic supporters do the work. It's undoubtedly a smart strategy, but also a concerning one for myself and other privacy advocates.
 
-{{< image src="images/sad-bernie.jpg" alt="Sad Bernie" >}}
+{{< image src="images/sad-bernie.jpg" alt="Sad Bernie" />}}
 
 BERN has two features: one called "Friend-to-Friend" (described as "add everyone in your network") and another called "Community Canvassing" (described as "talk to people around you every day, e.g. on the bus, outside the grocery store, at a park"). Both of these involve phoning home to Sanders HQ with the following information on anybody you know or meet:
 
@@ -46,33 +46,33 @@ Here's one of the instructional videos provided internally to volunteers:
 
 ...and a few privacy-related questions about the friend-to-friend feature were answered by campaign staff in a separate closed webinar for volunteers this week:
 
-{{< image src="images/webinar-qa-1.png" width="400" alt="Q&A 1" >}}
+{{< image src="images/webinar-qa-1.png" width="400" alt="Q&A 1" />}}
 
-{{< image src="images/webinar-qa-2.png" width="400" alt="Q&A 2" >}}
+{{< image src="images/webinar-qa-2.png" width="400" alt="Q&A 2" />}}
 
 Defenders of the BERN app have pointed out that the information used is already available from public voter rolls maintained independently by each state. This is true. But these public records have never been tied to a campaign's internal voter files through a tool that’s wide open to the entire internet, with incentives to add valuable data that benefits one candidate.
 
 There were even unverified claims that [BERN was leaking voter ID numbers](https://info.idagent.com/blog/bern-app-exposes-150m-voter-records), which are the same as one's driver's license ID numbers in some states, through JSON responses in the first few days after its release. There don't be appear to be strict rate limits on calls to the API either, potentially inviting malicious actors from around the world  — wink wink  — to scrape personal data on tens of millions of Americans en masse.
 
-{{< image src="images/json-response.jpg" alt="JSON Response" caption="BERN's API response in Chrome DevTools" >}}
+{{< image src="images/json-response.jpg" alt="JSON Response" >}}BERN's API response in Chrome DevTools{{< /image >}}
 
 Others have noted that web-based organizing tools like BERN have been used by campaigns at all levels since President Obama's well-oiled, futuristic machine in 2007. This is also true, and I'm a big fan of the trend they started.
 
 But the latter category of databases — like [NationBuilder](https://nationbuilder.com/) and, more notably, [NGP VAN's VoteBuilder](https://act.ngpvan.com/votebuilder) software based on the Obama campaign's inventions and now used by almost all Democratic campaigns across the United States — are secured and strictly guarded. Volunteer accounts need to be created and approved by paid campaign organizers and are locked down to provide the bare minimum amount of information necessary for one to canvass or phone bank a shortlist of voters. Every single click is also recorded in a [detailed log](sanders-campaign-audit.pdf) down to the millisecond. (This is how [Bernie's organizers got busted](http://time.com/4155185/bernie-sanders-hillary-clinton-data/) snooping around Hillary's VoteBuilder data last cycle, by the way.)
 
-{{< image src="images/votebuilder-audit.png" width="750" alt="NGP VAN's audit of the Sanders campaign's VoteBuilder activity" caption="NGP VAN's audit of the Sanders campaign's VoteBuilder activity" >}}
+{{< image src="images/votebuilder-audit.png" width="750" >}}NGP VAN's audit of the Sanders campaign's VoteBuilder activity{{< /image >}}
 
 BERN is taking this to an unprecedented level. Allowing anybody on the internet to sign up and add others' personal information to the campaign's database without their knowledge is troubling, especially when you consider the gamified "points" system they've added as an incentive to report as much information on as many people as possible.
 
-{{< image src="images/reddit-bros.png" width="600" alt="Reddit comments on BERN" >}}
+{{< image src="images/reddit-bros.png" width="600" alt="Reddit comments on BERN" />}}
 
 In addition to the points system, it was revealed in the webinar mentioned above that the campaign is planning on giving out shiny rewards based on how many friends one adds, setting expectations at 50+ contacts to reach the “Bernie Super Bundler” tier — whatever that means.
 
-{{< image src="images/webinar-slide-1.png" width="700" alt="Webinar Slide 1" >}}
+{{< image src="images/webinar-slide-1.png" width="700" alt="Webinar Slide 1" />}}
 
 In the middle of the webinar, the organizer also paused the presentation for *fifteen minutes * — complete with a countdown clock  —  and told volunteers to race to add as many of their friends as possible in that time. She announced afterwards that participants added 20 to 40 friends into the app on average, with some allegedly adding close to 100 in fifteen minutes.
 
-{{< image src="images/webinar-slide-2.png" width="700" alt="Webinar Slide 2" >}}
+{{< image src="images/webinar-slide-2.png" width="700" alt="Webinar Slide 2" />}}
 
 The [Privacy Policy link](https://berniesanders.com/privacy-policy/) at the bottom of the app links to a generic policy that looks like it's been copied from a default Wix website. There's no mention of the BERN app, no details of how they explicitly use our information, and no sign of an opt-out procedure.
 
diff --git a/content/notes/cloudflare-dns-archive-is-blocked/index.md b/content/notes/cloudflare-dns-archive-is-blocked/index.md
index 46756589..1416968e 100644
--- a/content/notes/cloudflare-dns-archive-is-blocked/index.md
+++ b/content/notes/cloudflare-dns-archive-is-blocked/index.md
@@ -14,7 +14,7 @@ draft: false
 
 **tl;dr:** No. Quite the opposite, actually -- [Archive.is](https://archive.is/)'s owner is intentionally blocking 1.1.1.1 users.
 
-{{< image src="images/archive-is.png" alt="Sad Bernie" >}}
+{{< image src="images/archive-is.png" alt="Archive.today screenshot" />}}
 
 A [recent post on Hacker News](https://news.ycombinator.com/item?id=19828317) pointed out something I've noticed myself over the past year -- the [Archive.is](https://archive.is/) website archiving tool (aka [Archive.today](https://archive.today/) and a few other TLDs) appears unresponsive when I'm on my home network, where I use Cloudflare's fantastic public DNS service, [1.1.1.1](https://1.1.1.1/). I didn't connect the two variables until I read this post, where somebody noticed that the Archive.is domain resolves for [Google's 8.8.8.8](https://developers.google.com/speed/public-dns/) DNS, but not 1.1.1.1. An interesting and timeless debate on [privacy versus convenience](https://www.adweek.com/digital/why-consumers-are-increasingly-willing-to-trade-privacy-for-convenience/) ensued.
 
diff --git a/content/notes/cool-bash-tricks-for-your-terminal-dotfiles/index.md b/content/notes/cool-bash-tricks-for-your-terminal-dotfiles/index.md
index 6f0be72c..205ca7ed 100644
--- a/content/notes/cool-bash-tricks-for-your-terminal-dotfiles/index.md
+++ b/content/notes/cool-bash-tricks-for-your-terminal-dotfiles/index.md
@@ -16,7 +16,7 @@ draft: false
 ---
 
 
-{{< image src="images/terminal_icon.jpg" width="500" alt="Terminal.app on macOS" >}}
+{{< image src="images/terminal_icon.jpg" width="500" alt="Terminal.app on macOS" />}}
 
 
 You may have noticed the recent trend of techies [posting their "dotfiles" on GitHub](https://github.com/topics/dotfiles) for the world to see. These usually contain shortcuts compatible with Bash terminals to automate convoluted commands that, I'll admit, I needed to Google every single time.
diff --git a/content/notes/css-waving-hand-emoji/index.md b/content/notes/css-waving-hand-emoji/index.md
index 19465deb..3fe3f318 100644
--- a/content/notes/css-waving-hand-emoji/index.md
+++ b/content/notes/css-waving-hand-emoji/index.md
@@ -19,7 +19,7 @@ If you examine [my homepage](https://jarv.is/) long enough, you might notice the
 Below are the code snippets you can grab and customize to make your own 
 ["waving hand" 👋](https://emojipedia.org/waving-hand-sign/) emojis ***actually wave***, and a [CodePen playground](https://codepen.io/jakejarvis/pen/pBZWZw) for live testing.
 
-{{<codepen username="jakejarvis" id="pBZWZw" left-tab="css" right-tab="result" height="400">}}
+{{< codepen username="jakejarvis" id="pBZWZw" left-tab="css" right-tab="result" height="400" >}}
 
 ### CSS:
 
diff --git a/content/notes/dropping-dropbox/index.md b/content/notes/dropping-dropbox/index.md
index 16d9d796..47ac9d7e 100644
--- a/content/notes/dropping-dropbox/index.md
+++ b/content/notes/dropping-dropbox/index.md
@@ -14,7 +14,7 @@ draft: false
 
 I've been a loyal Dropbox user since its inception as a [Y Combinator startup](https://www.ycombinator.com/apply/dropbox/) ten years ago. Having a folder on all of my devices that instantly synchronized with each other was a game-changer for me, and I grew dependent on it more and more as they gave out free storage like candy — 48 GB for having a Samsung Chromebook, 1 GB for "Posting <3 to Twitter," and so on — until I needed to upgrade to Dropbox Pro. But this month I canceled my Pro subscription after a few too many strikes.
 
-{{< image src="images/email.png" width="504" alt="Deleting 401,907 files from Dropbox" >}}
+{{< image src="images/email.png" width="504" >}}Deleting 401,907 files from Dropbox... 😬{{< /image >}}
 
 ---
 
@@ -39,11 +39,11 @@ Decisions made by the top folks at Dropbox gave me an increasingly sour taste in
 
 The infamous [Apple Ecosystem™](https://medium.com/swlh/the-irresistible-lure-of-the-apple-ecosystem-81bf8d66294a) has held me firmly in its grasp for over a decade now, and the main requirement of a replacement cloud storage service for me was smooth interoperability between my MacBook, iPhone, and iPad.
 
-{{< image src="images/icloud-storage.png" alt="iCloud Drive storage" >}}
+{{< image src="images/icloud-storage.png" alt="iCloud Drive storage" />}}
 
 I've never been a proponent of leaving all your eggs in one basket. But it's hard to ignore the convenience of Apple's streamlined (and [finally](https://www.imore.com/developers-encounter-major-icloud-issues-ios-13-beta) reliable) [**iCloud Drive**](https://www.apple.com/icloud/), which is already installed on all of my devices (and actually cheaper than Dropbox gigabyte-for-gigabyte, at $9.99/month for 2 TB). In fact, it's nearly invisible on macOS: I can simply save files in my Documents or Desktop folders as I always have and they're uploaded in the background. Git repositories now sync just fine and my files reappeared without a hitch after I recently formatted my Mac.
 
-{{< image src="images/icloud-drive.png" width="620" alt="iCloud Drive" >}}
+{{< image src="images/icloud-drive.png" width="620" alt="iCloud Drive" />}}
 
 I still use (and highly recommend) [**Backblaze**](https://www.backblaze.com/) ([referral link](https://secure.backblaze.com/r/00x84e)) to backup my home folder and add a second layer of redundancy to storing all of my most important files on ["someone else's computer."](https://www.zdnet.com/article/stop-saying-the-cloud-is-just-someone-elses-computer-because-its-not/) And as long as I remember to plug in my external SSD every so often, they're also backed up locally via [Time Machine](https://support.apple.com/en-us/HT201250).
 
diff --git a/content/notes/finding-candidates-subdomain-takeovers/index.md b/content/notes/finding-candidates-subdomain-takeovers/index.md
index 6ab14d1c..90a89e16 100644
--- a/content/notes/finding-candidates-subdomain-takeovers/index.md
+++ b/content/notes/finding-candidates-subdomain-takeovers/index.md
@@ -16,7 +16,7 @@ A **subdomain takeover** occurs when a subdomain (like *example*.jarv.is) points
 
 Not only are takeovers a fun way to dip your toes into [penetration testing](https://www.cloudflare.com/learning/security/glossary/what-is-penetration-testing/), but they can also be incredibly lucrative thanks to [bug bounty programs](https://en.wikipedia.org/wiki/Bug_bounty_program) on services like [HackerOne](https://hackerone.com/hacktivity?order_direction=DESC&order_field=popular&filter=type%3Aall&querystring=subdomain%20takeover) and [Bugcrowd](https://bugcrowd.com/programs), where corporations pay pentesters for their discoveries.
 
-{{< image src="images/hackerone-2.png" width="620" alt="Huge rewards for subdomain takeovers on HackerOne" caption="Huge rewards for subdomain takeovers on HackerOne" >}}
+{{< image src="images/hackerone-2.png" width="620" >}}<a href="https://hackerone.com/hacktivity?querystring=subdomain%20takeover">Huge rewards for subdomain takeovers on HackerOne.</a>{{< /image >}}
 
 For a deep dive on the implications of takeovers, which can be a pretty serious vector of attack for malicious actors to obtain information from users of the targeted company, [Patrik Hudak](https://twitter.com/0xpatrik) wrote a [great post here](https://0xpatrik.com/subdomain-takeover/). Definitely take some time to skim through it and come back here when you're ready to hunt for a potential takeover yourself.
 
diff --git a/content/notes/github-actions/index.md b/content/notes/github-actions/index.md
index 2cb59a00..32801c6b 100644
--- a/content/notes/github-actions/index.md
+++ b/content/notes/github-actions/index.md
@@ -13,13 +13,13 @@ draft: false
 ---
 
 
-{{< image src="images/actions-flow.png" width="780" alt="Example workflow for a GitHub Action" >}}
+{{< image src="images/actions-flow.png" width="780" alt="Example workflow for a GitHub Action" />}}
 
 Since being accepted into the beta for [GitHub Actions](https://github.com/features/actions) a few months ago, I've found a new side hobby of whipping up new (and ideally creative) actions for anybody to add to their CI pipeline. Actions are modular steps that interact with a GitHub repository and can be coded with [Docker](https://github.com/actions/hello-world-docker-action) or [JavaScript/Node](https://github.com/actions/hello-world-javascript-action) — and either way, they can be as [simple](https://github.com/jakejarvis/wait-action) or as [complex](https://github.com/jakejarvis/lighthouse-action) as you want. But in both cases, they're incredibly fun to make and the results always scratch my itch for instant gratification.
 
 My favorite so far is my [Lighthouse Audit action](https://github.com/jakejarvis/lighthouse-action), which spins up a headless Google Chrome instance in an Ubuntu container and runs [Google's Lighthouse tool](https://developers.google.com/web/tools/lighthouse), which scores webpages on performance, accessibility, SEO, etc. and provides actual suggestions to improve them. It's a perfect example of the power of combining containers with Git workflows.
 
-{{< image src="images/lighthouse-output.png" width="750" alt="The output of my Lighthouse Audit action." caption="The results of a Lighthouse audit on this website, after running tests in a headless Google Chrome." >}}
+{{< image src="images/lighthouse-output.png" width="750" >}}The results of a Lighthouse audit on this website, after running tests in a headless Google Chrome.{{< /image >}}
 
 It's also been a fantastic avenue to dip my feet into the collaborative nature of GitHub and the open-source community. I've made some small apps in the past but these are the first projects where I'm regularly receiving new issues to help out with and impressive pull requests to merge. It's a great feeling!
 
@@ -87,7 +87,7 @@ jobs:
 
 For a more complex example, when I forked [Hugo](https://github.com/gohugoio/hugo) (the static site generator used to build this website) to make some small personalized changes, I also translated [their `.travis.yml` file](https://github.com/gohugoio/hugo/blob/master/.travis.yml) into a [`workflow.yml` file](https://github.com/jakejarvis/hugo-custom/blob/master/.github/workflows/workflow.yml) for practice, which simultaneously runs comprehensive unit tests on **three operating systems** (Ubuntu 18.04, Windows 10, and macOS 10.14) with the latest two Go versions *each!* If the tests are all successful, it builds a Docker image and pushes it to both [Docker Hub](https://hub.docker.com/r/jakejarvis/hugo-custom) and the [GitHub Package Registry](https://github.com/jakejarvis/hugo-custom/packages) (also [in beta](https://github.com/features/package-registry)).
 
-{{< image src="images/hugo-logs.png" alt="Build logs for my Hugo fork" >}}
+{{< image src="images/hugo-logs.png" alt="Build logs for my Hugo fork" />}}
 
 Then another workflow, which [lives in this website's repository](https://github.com/jakejarvis/jarv.is/blob/master/.github/workflows/gh-pages.yml), pulls that Docker image, builds the Hugo site, and pushes it to GitHub Pages. All astoundingly fast. All for free.
 
diff --git a/content/notes/how-to-backup-linux-server/index.md b/content/notes/how-to-backup-linux-server/index.md
index eb3a47bf..6007af6c 100644
--- a/content/notes/how-to-backup-linux-server/index.md
+++ b/content/notes/how-to-backup-linux-server/index.md
@@ -14,7 +14,7 @@ draft: false
 ---
 
 
-{{< image src="images/apocalypse.png" alt="The Cloud-pocalypse: Coming soon(er than you think) to a server near you." caption="The Cloud-pocalypse: Coming soon(er than you think) to a server near you." >}}
+{{< image src="images/apocalypse.png" >}}The Cloud-pocalypse: Coming soon(er than you think) to a server near you.{{< /image >}}
 
 Last month, the founder of [a small startup](https://raisup.com/) got quite a bit of [attention on Twitter](https://twitter.com/w3Nicolas/status/1134529316904153089) (and [Hacker News](https://news.ycombinator.com/item?id=20064169)) when he called out [DigitalOcean](https://www.digitalocean.com/) who, in his words, "killed" his company. Long story short: DigitalOcean's automated abuse system flagged the startup's account after they spun up about ten powerful droplets for some CPU-intensive jobs and deleted them shortly after — which is literally **the biggest selling point** of a "servers by the hour" company like DigitalOcean, by the way — and, after replying to the support ticket, an unsympathetic customer support agent [declined to reactivate](https://twitter.com/w3Nicolas/status/1134529372172509184) the account without explanation. [Nicolas](https://twitter.com/w3Nicolas) had no way of even accessing his data, turning the inconvenient but trivial task of migrating servers into a potentially fatal situation for his company.
 
diff --git a/content/notes/how-to-pull-request-fork-github/index.md b/content/notes/how-to-pull-request-fork-github/index.md
index 97ed2f2e..40b74a32 100644
--- a/content/notes/how-to-pull-request-fork-github/index.md
+++ b/content/notes/how-to-pull-request-fork-github/index.md
@@ -14,7 +14,7 @@ draft: false
 ---
 
 
-{{< image src="images/forks.png" alt="Git Forks Visualization" >}}
+{{< image src="images/forks.png" alt="Git Forks Visualization" />}}
 
 
 Contributing to an open-source project can be intimidating at first. The convoluted process of submitting your improvements for approval via a [**pull request**](https://help.github.com/en/articles/about-pull-requests) certainly doesn't help.
@@ -29,7 +29,7 @@ Starting from the very beginning, we'll fork an existing repository to our accou
 
 Assuming you're using GitHub, this step is easy. Just find the repository you're contributing to and press the Fork button in the upper left. This will create an exact copy of the repository (and all of its branches) under your own username.
 
-{{< image src="images/step1.png" alt="Step 1" >}}
+{{< image src="images/step1.png" alt="Step 1" />}}
 
 
 ## 2. Clone your new fork locally
@@ -40,7 +40,7 @@ GitHub will automatically redirect you to the forked repository under your usern
 git clone git@github.com:jakejarvis/react-native.git
 ```
 
-{{< image src="images/step2.png" width="420" alt="Step 2" >}}
+{{< image src="images/step2.png" width="420" alt="Step 2" />}}
 
 
 ## 3. Track the original repository as a remote of the fork
@@ -91,9 +91,9 @@ git push -u origin fix-readme-typo
 
 You're now all ready to submit the improvement you've made to the project's maintainers for approval. Head over to the original repositories Pull Requests tab, and you should see an automatic suggestion from GitHub to create a pull request from your new branch.
 
-{{< image src="images/step7-1.png" alt="Step 7.1" >}}
+{{< image src="images/step7-1.png" alt="Step 7.1" />}}
 
-{{< image src="images/step7-2.png" width="700" alt="Step 7.2" >}}
+{{< image src="images/step7-2.png" width="700" alt="Step 7.2" />}}
 
 ---
 
diff --git a/content/notes/how-to-shrink-linux-virtual-disk-vmware/index.md b/content/notes/how-to-shrink-linux-virtual-disk-vmware/index.md
index 27bad63d..0d033147 100644
--- a/content/notes/how-to-shrink-linux-virtual-disk-vmware/index.md
+++ b/content/notes/how-to-shrink-linux-virtual-disk-vmware/index.md
@@ -15,7 +15,7 @@ draft: false
 ---
 
 
-{{< image src="images/screen-shot-2018-12-07-at-2-04-04-pm.png" width="620" alt="df -dh = WTF" >}}
+{{< image src="images/screen-shot-2018-12-07-at-2-04-04-pm.png" width="620" >}}df -dh = WTF{{< /image >}}
 
 
 **[VMware Workstation](https://www.vmware.com/products/workstation-pro.html)** and **[Fusion](https://www.vmware.com/products/fusion.html)** normally work hard to minimize the size of virtual hard disks for optimizing the amount of storage needed on your host machine . On Windows virtual machines, [VMware has a “clean up” function](https://docs.vmware.com/en/VMware-Fusion/11/com.vmware.fusion.using.doc/GUID-6BB29187-F47F-41D1-AD92-1754036DACD9.html), which detects newly unused space and makes the size of the virtual hard disk smaller accordingly. You’ll notice that even if you create a virtual machine with a capacity of 60 GB, for example, the actual size of the VMDK file will dynamically resize to fit the usage of the guest operating system. 60 GB is simply the maximum amount of storage allowed; if your guest operating system and its files amount to 20 GB, the VMDK file will simply be 20 GB.
@@ -78,7 +78,7 @@ VMware on macOS makes this a little tricky, since it packages VMs in what looks
 
 We need to right click on the .vmwarevm "file," and select **Show Package Contents** to see what's really in there. You should see the actual .VMDK file sitting there – normally we're looking for the plain VMDK file (named _Virtual Disk.vmdk_ by default) without a bunch of numbers after it, but if you have snapshots associated with your VM, this might not be the file we actually want. But run the command below with it anyways, and the output will tell you if you need to use a different file.
 
-{{< image src="images/screen-shot-2018-12-07-at-1-58-42-pm.png" width="680" alt="Finding .vmwarevm in Finder" >}}
+{{< image src="images/screen-shot-2018-12-07-at-1-58-42-pm.png" width="680" alt="Finding .vmwarevm in Finder" />}}
 
 Now, we're going to run our final command in our **host** terminal, so open that up. Linux installations of VMware Workstation should have a simple map to the _vmware-vdiskmanager_ utility that you can run anywhere, but on macOS we need to tell it exactly where that's located: in the Applications folder, where Fusion is installed.
 
diff --git a/content/notes/millenial-with-hillary-clinton/index.md b/content/notes/millenial-with-hillary-clinton/index.md
index d0d9396b..6624d929 100644
--- a/content/notes/millenial-with-hillary-clinton/index.md
+++ b/content/notes/millenial-with-hillary-clinton/index.md
@@ -14,7 +14,7 @@ draft: false
 ---
 
 
-{{< image src="images/24707394571_0818d4ab83_o-1-copy.jpg" alt="Hillary for New Hampshire Winter Fellows with Hillary Clinton in Derry, NH (February 3, 2016)" caption="Hillary for New Hampshire Winter Fellows with Hillary Clinton in Derry, NH (February 3, 2016)" >}}
+{{< image src="images/24707394571_0818d4ab83_o-1-copy.jpg" >}}<a href="https://medium.com/@HillaryForNH">Hillary for New Hampshire</a> Winter Fellows with <a href="https://medium.com/@HillaryClinton">Hillary Clinton</a> in Derry, NH (<a href="https://www.flickr.com/photos/hillaryclinton/24707394571/">February 3, 2016</a>){{< /image >}}
 
 
 ## Keeping in mind the big picture…
@@ -28,7 +28,7 @@ My goal here isn’t to convince every Bernie believer to jump ship and support
 After working for months as a fellow on Hillary’s campaign in New Hampshire leading up to the first primary in the country, I could feed you all the standard campaign talking points in my sleep: After graduating from Yale Law she went to work at the [Children’s Defense Fund](http://www.childrensdefense.org/), not a high-paying New York law firm. She [went undercover](http://www.nytimes.com/2015/12/28/us/politics/how-hillary-clinton-went-undercover-to-examine-race-in-education.html?_r=0) in Alabama to investigate discrimination in public schools. She [got juveniles out of adult prisons](http://www.huffingtonpost.com/entry/huffpost-criminal-justice-survey-democratics_us_56bb85eae4b0b40245c5038b). She [gave 8 million children healthcare](https://www.hillaryclinton.com/briefing/factsheets/2015/12/23/hillary-clintons-lifelong-fight-for-quality-affordable-health-care-for-all-americans/). But there’s just one thing that, for some reason, is hard for people to believe: at her core she is a good, caring, and loving person who has had only selfless intentions her entire life. I promise you.
 
 
-{{< image src="images/9e58a-1bvweqv_ve2_c1tw5-ihrhw.jpg" width="400" >}}
+{{< image src="images/9e58a-1bvweqv_ve2_c1tw5-ihrhw.jpg" width="400" >}}The best birthday gift. 🎉{{< /image >}}
 
 
 I had the incredible chance to meet Hillary the weekend before the New Hampshire primary. Her motorcade plowed through a quiet suburb in Manchester around noon and she hopped out to go knock on the doors of some lucky families. As neighbors started coming out of their houses to shake her hand, I couldn’t restrain myself from at least trying to get close and wave hello. (By the way, it’s amazing how casual the people in New Hampshire are about meeting presidential candidates.)
@@ -43,5 +43,4 @@ I’m aware of the street cred young Democrats collect by claiming they hated Hi
 
 As [Bill Maher](https://medium.com/u/cdc04a9799f6) (an avid Bernie supporter) [said this weekend](https://www.youtube.com/watch?v=rd1gpjkjcfc), some in our party need to “learn the difference between an imperfect friend and a deadly enemy.” I don’t agree with everything Hillary has said or done. I don’t unconditionally defend every single chapter in her public record over the past 30 years (and [neither does she](https://www.washingtonpost.com/blogs/post-partisan/wp/2016/02/25/hillary-clinton-responds-to-activist-who-demanded-apology-for-superpredator-remarks/), by the way). I don’t think that’s possible for any voter to find in a politician. But if you identify as a Democrat, she is the farthest thing from your enemy. Plain and simple. Like you and Bernie, she wants to prevent a Republican from winning in November and reversing so much of the progress we’ve made over the past seven years on their first day in office. That is our number one goal right now. And whether it gets accomplished by a President Clinton or a President Sanders, I am 100% on board either way. Let’s stop fighting each other and start fighting together.
 
-
-{{< youtube TqrwDMTByNM >}}
\ No newline at end of file
+{{< youtube TqrwDMTByNM >}}
diff --git a/content/notes/my-first-code/index.md b/content/notes/my-first-code/index.md
index 0c3cdbe6..41ed198d 100644
--- a/content/notes/my-first-code/index.md
+++ b/content/notes/my-first-code/index.md
@@ -13,9 +13,9 @@ draft: false
 ---
 
 
-{{< image src="images/netscape.png" alt="Awesome First Code on GitHub" >}}
+{{< image src="images/netscape.png" alt="Awesome First Code on GitHub" />}}
 
-{{< image src="images/badges.png" width="537" alt="Code Quality: A for effort" >}}
+{{< image src="images/badges.png" width="537" alt="Code Quality: A for effort" />}}
 
 
 I recently published my terrible, horrible, no good, very bad [first HTML site](https://jarv.is/y2k) and [first PHP project](https://github.com/jakejarvis/jbb#readme) ever and developed a new addiction to Web 1.0 nostalgia, fed by others who were brave enough to do the same.
@@ -28,7 +28,7 @@ Hopefully we can all look back at our first projects and be proud of how far we'
 ---
 
 
-{{< image src="images/jbb-logo.png" width="640" alt="Jake's Bulletin Board" caption="Jake's Bulletin Board" >}}
+{{< image src="images/jbb-logo.png" width="640" >}}Jake's Bulletin Board{{< /image >}}
 
 
 Aside from my [first HTML creation](https://jarv.is/y2k) (circa 2001), my first real coding project was in 2003: a PHP 4 masterpiece creatively titled **Jake's Bulletin Board**. I've published the [source code in full on GitHub](https://github.com/jakejarvis/jbb) for your viewing pleasure and highlighted the best/worst parts below.
@@ -159,10 +159,10 @@ while ($topic = mysql_fetch_object($result30)) {
 
 The installation "wizard" (that's the joke, I presume...) ([sql_submit.php](https://github.com/jakejarvis/jbb/blob/87b606797414b2fe563af85e269566fc5e076cc5/setup/sql_submit.php))
 
-{{< image src="images/jbb-screen1.png" alt="JBB Installation Wizard" >}}
+{{< image src="images/jbb-screen1.png" >}}JBB Installation Wizard{{< /image >}}
 
 And finally, JBB's actual interface... or literally as much of it as I could get to function in 2019. ([index.php](https://github.com/jakejarvis/jbb/blob/87b606797414b2fe563af85e269566fc5e076cc5/index.php))
 
-{{< image src="images/jbb-screen3.png" alt="JBB Homepage" >}}
+{{< image src="images/jbb-screen3.png" >}}JBB Homepage{{< /image >}}
 
-{{< image src="images/jbb-screen4.png" alt="JBB Post" >}}
+{{< image src="images/jbb-screen4.png" >}}JBB Post{{< /image >}}
diff --git a/content/notes/netlify-analytics-review/index.md b/content/notes/netlify-analytics-review/index.md
index 99d3a0fb..c7731fb1 100644
--- a/content/notes/netlify-analytics-review/index.md
+++ b/content/notes/netlify-analytics-review/index.md
@@ -16,7 +16,7 @@ draft: false
 
 I've been trying out [Netlify Analytics](https://www.netlify.com/products/analytics/) on this site for over a month now and have some quick thoughts about this unique offering in a world full of bloated and invasive tracking scripts.
 
-{{< image src="images/pageviews-2.png" alt="Pageview charts on Netlify Analytics" >}}
+{{< image src="images/pageviews-2.png" alt="Pageview charts on Netlify Analytics" />}}
 
 
 ---
@@ -52,7 +52,7 @@ Ad blocking is becoming commonplace on the World Wide Web with [over 25% of user
 
 That's a _huge_ chunk of visitors missing that Netlify Analytics gains back for you — and probably far more if your audience is tech-savvy like those reading this post likely are. (Some might even [block JavaScript completely](https://www.gnu.org/philosophy/javascript-trap.en.html) using extensions like [NoScript](https://addons.mozilla.org/en-US/firefox/addon/noscript/).)
 
-{{< image src="images/pages.png" alt="Pageview and 404 tracking on Netlify Analytics" >}}
+{{< image src="images/pages.png" alt="Pageview and 404 tracking on Netlify Analytics" />}}
 
 Another tangential benefit you simply don't get from JavaScript-based tools like Google Analytics is the "Resources Not Found" box, which separates out URLs that resulted in a 404 Not Found error. Because of the 404 tracking, I discovered how many people were still subscribed to my posts via RSS from when I used WordPress _years_ ago, and I was able to redirect `/feed` and `/rss` to the new location.
 
@@ -72,7 +72,7 @@ It makes sense that Netlify needs to subsidize the cost of providing free enterp
 
 ### 📈&nbsp; Accuracy {#accuracy}
 
-{{< image src="images/sources-bandwidth.png" alt="Referrer and bandwidth tracking on Netlify Analytics" >}}
+{{< image src="images/sources-bandwidth.png" alt="Referrer and bandwidth tracking on Netlify Analytics" />}}
 
 Clearly, as much as I wish they did, 60,000+ visitors didn't type my website directly into the URL bar in the past month. Some of my articles have been circulating on Hacker News, Reddit, Twitter, etc. — none of which have even made a blip on the dashboard.
 
@@ -84,7 +84,7 @@ One more note: since Netlify doesn't process IP addresses or user agents, bots c
 
 ### ⏱️&nbsp; Historical Data {#historical-data}
 
-{{< image src="images/overview.png" alt="Overview of Netlify Analytics stats" >}}
+{{< image src="images/overview.png" alt="Overview of Netlify Analytics stats" />}}
 
 Trying out Netlify Analytics meant switching this site from [GitHub Pages](https://pages.github.com/) to Netlify — something I still have mixed feelings about. But if I had been on Netlify the entire time, I would have gotten thirty days of historical stats backfilled right off the bat, from before I even started paying for Analytics.
 
diff --git a/content/notes/no-homo-still-raps-motto/index.md b/content/notes/no-homo-still-raps-motto/index.md
index 4d80ae23..98c057d2 100644
--- a/content/notes/no-homo-still-raps-motto/index.md
+++ b/content/notes/no-homo-still-raps-motto/index.md
@@ -15,7 +15,7 @@ draft: false
 ---
 
 
-{{< image src="images/1_b41ztscbaxqi60snwsswfw.jpg" caption="This essay was written for Professor David Valdes-Greenwood’s “Love & Sexuality” class at Tufts University in April 2012." >}}
+{{< image src="images/1_b41ztscbaxqi60snwsswfw.jpg" >}}This essay was written for Professor <a href="http://www.davidvaldesgreenwood.com/">David Valdes-Greenwood</a>’s “Love & Sexuality” class at <a href="https://www.tufts.edu/">Tufts University</a> in April 2012.{{< /image >}}
 
 
 * * *
@@ -37,7 +37,7 @@ My next inquiry was about whether there’s room for a gay person in the mainstr
 It became apparent to me that there is still an ethical divide between the rap industry and the rest of America. In 2012, there are few areas where undisguised and unapologetic homophobia is not only accepted, but rewarded with money and power. (Rap and the Republican presidential nomination race come to mind.) Every few years, we see the issue of rap and homophobia as front-page news, but the time between these climaxes of public outrage is filled with self-encouraging homophobic songs that get no backlash at all.
 
 
-{{< image src="images/66574-132xjztnwqcm40hmdrec08q.jpg" caption="Frank Micelotta/Getty Images" >}}
+{{< image src="images/66574-132xjztnwqcm40hmdrec08q.jpg" width="700" >}}Frank Micelotta/Getty Images{{< /image >}}
 
 
 Eminem is a prime example of this. After rapping about “homos” and “fags” for years, his third studio album, _The Marshall Mathers LP_, finally saw mainstream recognition and acclaim, including the nomination for Best Rap Album and Album of the Year at the 2001 Grammy Awards. After both the National Academy of Recording Arts & Sciences and CBS “endured a storm of protest over the rapper’s best album nomination” due to his use of homophobic slurs, Eminem announced a duet with Elton John to be performed at the Grammy ceremony. “I’d rather tear down walls between people than build them up. If I thought for one minute that he was hateful, I wouldn’t do it,” John said in defense of the performance.
@@ -67,7 +67,7 @@ A year earlier, in 2009, Queens rapper N.O.R.E. also revealed to DJ Vlad:
 Several other rappers have recently been vocal against homophobia. Nicki Minaj, protégé of Lil Wayne, said in an interview last year with _Out Magazine_, “Normally, Wayne probably wouldn’t have gay guys coming to see his shows much, but they’re definitely a big part of my movement, and I hope they’d still come out and see me. I think that will be really, really interesting, just to start bridging that gap.” Up-and-coming 23-year-old rapper A$AP Rocky, admitted last year to Pitchfork.com, “I used to be homophobic, but that’s fucked up. I had to look in the mirror and say, ‘All the designers I’m wearing are gay.’”
 
 
-{{< image src="images/f9d7a-1gad6zdgng2-mjsedg5igwa.jpg" caption="Sarah Taylor/Fashion Magazine" >}}
+{{< image src="images/f9d7a-1gad6zdgng2-mjsedg5igwa.jpg" width="350" >}}Sarah Taylor/Fashion Magazine{{< /image >}}
 
 
 Unfortunately, not all rappers—including and especially the most popular and celebrated—are not as enlightened as today’s up-and-comers such as Nicki Minaj and A$AP Rocky. Kanye West, one of the rappers quoted before for shouting “no homo” on Jay-Z’s number-one single _Run This Town_ and (in)famous for speaking what’s on his mind, was the target of countless questions about his sexuality after his sudden attendance at Paris fashion shows and interest in women’s designer clothing. When asked by DJ Sway for MTV News to respond to accusations from fans that he “dresses gay,” West responded, “Your dress don’t give away whether or not you like a man. Think about actors that straight dress up like a woman or something like that. People wanna label me and throw that on me all the time, but I’m so secure with my manhood.”
@@ -77,7 +77,7 @@ West, disagreeing with Fat Joe’s claim of being surrounded by gay members of t
 While the sentiment from mainstream rappers is becoming increasingly supportive of all sexualities, West’s automatic instinct to defend himself so passionately against rumors about his own sexuality reflects no such sentiment from the community of rap fans and critics. In other words, maybe the record executives are justified to think that a gay rapper would jeopardize the one thing they are hired to protect: a profitable return on investments in recording contracts, marketing, and concert venues.
 
 
-{{< image src="images/a5c2a-1fkblnzkye3g04gdvsbbtpa.jpg" caption="Amy Odell/New York Magazine Fashion" >}}
+{{< image src="images/a5c2a-1fkblnzkye3g04gdvsbbtpa.jpg" width="580" >}}Amy Odell/New York Magazine Fashion{{< /image >}}
 
 
 Lil Wayne’s performance at MTV’s Video Music Awards last year showed the community’s lack of progress in the area of homophobia. The performance generated tons of instantaneous buzz on the Internet, but not for the reasons Wayne had hoped. Instead of his musical performance being discussed, the topic instead turned to his wardrobe. Viewers of the live award show started wondering and asking online, _“Is Lil Wayne wearing women’s pants right now?”_
@@ -85,7 +85,7 @@ Lil Wayne’s performance at MTV’s Video Music Awards last year showed the com
 Sure enough, _Rolling Stone_ confirmed with the fashion store Tripp NYC that Wayne was sporting their ladies’ leopard-print jeggings that retail online for $44. _Out Magazine_’s assistant editor Max Berlinger spoke in support of Wayne, attributing his choice of clothes to Dandyism, or “extreme visual paradigms that are manifested in a completely overt way and also heavily rooted in consumerism.” Berlinger, when asked to elaborate on artists like Kanye wearing women’s blouses and calling it individualism, simply responded with, “Fuck all that theoretical bullshit. At the end of the day, I just want someone to look confidently like themselves, which Lil Wayne did perfectly”. However, Wayne’s fans vocally disagreed. A Twitter account, @Waynes_Jeggings, was created almost immediately after the performance, and spent the rest of the night questioning Wayne’s sexuality (the messages have since been deleted).
 
 
-{{< image src="images/a805a-1ghqzd91ei4fdntwmzwxw6g.jpg" caption="Martin Rose/Getty Images" >}}
+{{< image src="images/a805a-1ghqzd91ei4fdntwmzwxw6g.jpg" width="350" >}}Martin Rose/Getty Images{{< /image >}}
 
 
 In the most revealing and straightforward social experiment yet, 21-year-old rapper Lil B, famous for his intentionally offbeat rhythm, extremely loose rhymes, and, according to him, over 3,000 songs, some with ridiculous titles such as “I’m Miley Cyrus,” “I’m God,” “I’m Orange Juice,” and “Wonton Soup,” decided to test the rap community’s homophobia once and for all. In April of last year, Lil B announced during his Coachella performance that his next independently released album would be titled _I’m Gay_. Lil B elaborated on the title, claiming “that he does not partake in that lifestyle but, but he wants to make a statement about the power of words, or lack thereof,” but little of his reasoning made it past the headlines and onto the radar of rap fans other than the title, _I’m Gay_.
diff --git a/content/notes/presidential-candidates-404-pages/index.md b/content/notes/presidential-candidates-404-pages/index.md
index 1e87d7a0..f40c5915 100644
--- a/content/notes/presidential-candidates-404-pages/index.md
+++ b/content/notes/presidential-candidates-404-pages/index.md
@@ -11,7 +11,7 @@ image: "obama-laughing.jpg"
 draft: false
 ---
 
-{{< image src="images/obama-laughing.jpg" alt="President Obama probably ranking 404 pages." >}}
+{{< image src="images/obama-laughing.jpg" >}}President Barack H. Obama, probably ranking 404 pages.{{< /image >}}
 
 Ever since [President Obama injected technology](https://arstechnica.com/information-technology/2012/11/built-to-win-deep-inside-obamas-campaign-tech/) into presidential politics in a historic way, one of the few bright spots of the incredibly long and exhausting race for me has been inspecting each candidate's campaign website. They end up revealing a great deal about how much each of them is willing to invest in the internet, and how young and innovative (and potentially funny) the staff members they attract are.
 
@@ -23,7 +23,7 @@ More recently, though, little-known hidden Easter eggs on ["404 Not Found"](http
 
 I'm a _huge_ sucker for Kate McKinnon's spot-on impression of Warren on Saturday Night Live. And [unfortunately](https://twitter.com/realdonaldtrump/status/1097116612279316480), seeing a campaign embrace SNL is like a breath of fresh air these days. [Watch all of the Kate McWarren videos so far here; you won't regret it.](http://www.nbc.com/saturday-night-live/cast/kate-mckinnon-15056/impersonation/elizabeth-warren-287903)
 
-{{< image src="images/warren.png" alt="Elizabeth Warren" >}}
+{{< image src="images/warren.png" alt="Elizabeth Warren" />}}
 
 ---
 
@@ -39,7 +39,7 @@ Although the designer who selected this GIF likely had _thousands_ of choices wh
 
 Uncle Joe has a nice and simple 404 page. I like it, along with the Ray-Bans and his choice of vanilla ice cream.
 
-{{< image src="images/biden.png" alt="Joe Biden" >}}
+{{< image src="images/biden.png" alt="Joe Biden" />}}
 
 ---
 
@@ -63,7 +63,7 @@ Another clean and simple page with a top-notch GIF. It injected some emotion int
 
 I love, love, _love_ Pete's design for his whole campaign, and his beautiful 404 page is no exception. In case you didn't know, Pete for America has an entire ["Design Toolkit"](https://design.peteforamerica.com/) publicly available for all to view and use, with really cool and in-depth explanations for all of their choices — even their [color palette](https://design.peteforamerica.com/colors). Very progressive indeed.
 
-{{< image src="images/buttigeg.png" alt="Pete Buttigeg" >}}
+{{< image src="images/buttigeg.png" alt="Pete Buttigeg" />}}
 
 ---
 
@@ -71,7 +71,7 @@ I love, love, _love_ Pete's design for his whole campaign, and his beautiful 404
 
 Love the photo choice. But although pains me to go against my Senator from my home state, I still _cannot stand_ his choice of font. Oh well, I guess that's now a criterion for running for president in 2020.
 
-{{< image src="images/booker.png" alt="Cory Booker" >}}
+{{< image src="images/booker.png" alt="Cory Booker" />}}
 
 ---
 
@@ -79,7 +79,7 @@ Love the photo choice. But although pains me to go against my Senator from my ho
 
 Not sure if donating to Yang 2020 will help put a page at [yang2020.com/alsdjfzoif](https://www.yang2020.com/alsdjfzoif) — the actual URL I visited to grab this screenshot — but the Bitmoji Andrew looks pretty chill.
 
-{{< image src="images/yang.png" alt="Andrew Yang" >}}
+{{< image src="images/yang.png" alt="Andrew Yang" />}}
 
 ---
 
@@ -87,7 +87,7 @@ Not sure if donating to Yang 2020 will help put a page at [yang2020.com/alsdjfzo
 
 This is the 404 page of someone who won't forget the [Midwestern roots](https://en.wikipedia.org/wiki/Uff_da) she comes from once she moves into the White House...or writes a memoir about her campaign from her Minnesota home.
 
-{{< image src="images/klobuchar.png" alt="Amy Klobuchar" >}}
+{{< image src="images/klobuchar.png" alt="Amy Klobuchar" />}}
 
 ---
 
@@ -95,7 +95,7 @@ This is the 404 page of someone who won't forget the [Midwestern roots](https://
 
 I'll never publicly say anything against a good Dad joke. This is no exception.
 
-{{< image src="images/bullock.png" alt="Steve Bullock" >}}
+{{< image src="images/bullock.png" alt="Steve Bullock" />}}
 
 ---
 
@@ -103,7 +103,7 @@ I'll never publicly say anything against a good Dad joke. This is no exception.
 
 Another quality Dad joke here. 
 
-{{< image src="images/bennet.png" alt="Michael Bennet" >}}
+{{< image src="images/bennet.png" alt="Michael Bennet" />}}
 
 ---
 
@@ -111,7 +111,7 @@ Another quality Dad joke here.
 
 Yet another Dad joke? I honestly had the hardest time ranking these three.
 
-{{< image src="images/delaney.png" alt="John Delaney" >}}
+{{< image src="images/delaney.png" alt="John Delaney" />}}
 
 ---
 
@@ -119,7 +119,7 @@ Yet another Dad joke? I honestly had the hardest time ranking these three.
 
 A 404 page only a motivational author and speaker running for president could envision.
 
-{{< image src="images/williamson.png" alt="Marianne Williamson" >}}
+{{< image src="images/williamson.png" alt="Marianne Williamson" />}}
 
 ---
 
@@ -127,7 +127,7 @@ A 404 page only a motivational author and speaker running for president could en
 
 I guess this would be slightly humorous...four years ago. Time to move on from your middle-school crush, Donny.
 
-{{< image src="images/trump.png" alt="Trump/Pence" >}}
+{{< image src="images/trump.png" alt="Trump/Pence" />}}
 
 ---
 
@@ -137,23 +137,23 @@ These candidates haven't configured a custom 404 page, settling for the default
 
 ### Julián Castro — [julianforthefuture.com](https://www.julianforthefuture.com/asdfasdf404) {#castro}
 
-{{< image src="images/castro.png" alt="Julián Castro" >}}
+{{< image src="images/castro.png" alt="Julián Castro" />}}
 
 ---
 
 ### Wayne Messam — [wayneforusa.com](https://wayneforusa.com/asdfasdf404) {#messam}
 
-{{< image src="images/messam.png" alt="Wayne Messam" >}}
+{{< image src="images/messam.png" alt="Wayne Messam" />}}
 
 ---
 
 ### Tulsi Gabbard — [tulsi2020.com](https://www.tulsi2020.com/asdfasdf404) {#gabbard}
 
-{{< image src="images/gabbard.png" alt="Tulsi Gabbard" >}}
+{{< image src="images/gabbard.png" alt="Tulsi Gabbard" />}}
 
 ---
 
 ### Joe Sestak — [joesestak.com](https://www.joesestak.com/asdfasdf404) {#sestak}
 
-{{< image src="images/sestak.png" alt="Joe Sestak" >}}
+{{< image src="images/sestak.png" alt="Joe Sestak" />}}
 
diff --git a/content/notes/security-headers-cloudflare-workers/index.md b/content/notes/security-headers-cloudflare-workers/index.md
index dd2579d1..49578688 100644
--- a/content/notes/security-headers-cloudflare-workers/index.md
+++ b/content/notes/security-headers-cloudflare-workers/index.md
@@ -13,13 +13,13 @@ draft: false
 ---
 
 
-{{< image src="images/security-headers.png" width="700" alt="A+ security grade for this website!" caption="A+ security grade for this website!" >}}
+{{< image src="images/security-headers.png" width="700" >}}An <a href="https://securityheaders.com/?q=jarv.is&amp;followRedirects=on">A+ security grade</a> for this website!{{< /image >}}
 
 In 2019, it's becoming more and more important to harden websites via HTTP response headers, which all modern browsers parse and enforce. Multiple standards have been introduced over the past few years to protect users from various attack vectors, including `Content-Security-Policy` for injection protection, `Strict-Transport-Security` for HTTPS enforcement, `X-XSS-Protection` for cross-site scripting prevention, `X-Content-Type-Options` to enforce correct MIME types, `Referrer-Policy` to limit information sent with external links, [and many, many more](https://www.netsparker.com/whitepaper-http-security-headers/).
 
 [Cloudflare Workers](https://www.cloudflare.com/products/cloudflare-workers/) are a great feature of [Cloudflare](https://www.cloudflare.com/) that allows you to modify responses on-the-fly between your origin server and the user, similar to [AWS Lambda](https://aws.amazon.com/lambda/) (but much simpler). We'll use a Worker to add the headers.
 
-{{< image src="images/cf-workers.png" width="650" alt="Cloudflare Workers" >}}
+{{< image src="images/cf-workers.png" width="650" alt="Cloudflare Workers" />}}
 
 Workers can be enabled for $5/month via the [Cloudflare Dashboard](https://dash.cloudflare.com/). (It's worth noting, once enabled, Workers can be used on *any zone* on your account, not just one website!).
 
diff --git a/content/notes/shodan-search-queries/index.md b/content/notes/shodan-search-queries/index.md
index bc7bb1af..0f88a2a7 100644
--- a/content/notes/shodan-search-queries/index.md
+++ b/content/notes/shodan-search-queries/index.md
@@ -18,7 +18,7 @@ draft: false
 
 Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into [Shodan](https://www.shodan.io/), the ([literal](https://www.vice.com/en_uk/article/9bvxmd/shodan-exposes-the-dark-side-of-the-net)) internet search engine. Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild.
 
-{{< image src="images/shodan.png" alt="Some search filters require a Shodan account." caption="Some search filters require a Shodan account." >}}
+{{< image src="images/shodan.png" >}}<a href="https://account.shodan.io/register">Most search filters require a Shodan account.</a>{{< /image >}}
 
 You can assume these queries only return unsecured/open instances when possible. For your own legal benefit, do not attempt to login (even with default passwords) if they aren't! Narrow down results by adding filters like `country:US` or `org:"Harvard University"` or `hostname:"nasa.gov"` to the end.
 
@@ -56,7 +56,7 @@ The world and its devices are quickly becoming more connected through the shiny
 "Server: Prismview Player"
 ```
 
-{{< image src="images/billboard3.png" width="450" alt="Example: Electronic Billboards" >}}
+{{< image src="images/billboard3.png" width="450" alt="Example: Electronic Billboards" />}}
 
 
 ### Gas Station Pump Controllers [🔎 &#x2192;](https://www.shodan.io/search?query=%22in-tank+inventory%22+port%3A10001)
@@ -65,7 +65,7 @@ The world and its devices are quickly becoming more connected through the shiny
 "in-tank inventory" port:10001
 ```
 
-{{< image src="images/7-11.png" width="600" alt="Example: Gas Station Pump Inventories" >}}
+{{< image src="images/7-11.png" width="600" alt="Example: Gas Station Pump Inventories" />}}
 
 
 ### Automatic License Plate Readers [🔎 &#x2192;](https://www.shodan.io/search?query=P372+%22ANPR+enabled%22)
@@ -74,7 +74,7 @@ The world and its devices are quickly becoming more connected through the shiny
 P372 "ANPR enabled"
 ```
 
-{{< image src="images/plate-reader.png" width="680" alt="Example: Automatic License Plate Reader" >}}
+{{< image src="images/plate-reader.png" width="680" alt="Example: Automatic License Plate Reader" />}}
 
 
 ### Traffic Light Controllers / Red Light Cameras [🔎 &#x2192;](https://www.shodan.io/search?query=mikrotik+streetlight)
@@ -115,7 +115,7 @@ Wiretapping mechanism outlined by Cisco in [RFC 3924](https://tools.ietf.org/htm
 http.title:"Tesla PowerPack System" http.component:"d3" -ga3ca4f2
 ```
 
-{{< image src="images/tesla.png" alt="Example: Tesla PowerPack Charging Status" >}}
+{{< image src="images/tesla.png" alt="Example: Tesla PowerPack Charging Status" />}}
 
 
 ### Electric Vehicle Chargers [🔎 &#x2192;](https://www.shodan.io/search?query=%22Server%3A+gSOAP%2F2.8%22+%22Content-Length%3A+583%22)
@@ -133,7 +133,7 @@ Shodan made a pretty sweet [Ship Tracker](https://shiptracker.shodan.io/) that m
 "Cobham SATCOM" OR ("Sailor" "VSAT")
 ```
 
-{{< image src="images/sailor-vsat.png" width="700" alt="Example: Maritime Satellites" >}}
+{{< image src="images/sailor-vsat.png" width="700" alt="Example: Maritime Satellites" />}}
 
 
 ### Submarine Mission Control Dashboards [🔎 &#x2192;](https://www.shodan.io/search?query=title%3A%22Slocum+Fleet+Mission+Control%22)
@@ -149,7 +149,7 @@ title:"Slocum Fleet Mission Control"
 "Server: CarelDataServer" "200 Document follows"
 ```
 
-{{< image src="images/refrigeration.png" alt="Example: CAREL PlantVisor Refrigeration Units" >}}
+{{< image src="images/refrigeration.png" alt="Example: CAREL PlantVisor Refrigeration Units" />}}
 
 
 ### [Nordex Wind Turbine](http://www.nordex-online.com/en/products-services/wind-turbines.html) Farms [🔎 &#x2192;](https://www.shodan.io/search?query=http.title%3A%22Nordex+Control%22+%22Windows+2000+5.0+x86%22+%22Jetty%2F3.1+%28JSP+1.1%3B+Servlet+2.2%3B+java+1.6.0_14%29%22)
@@ -165,7 +165,7 @@ http.title:"Nordex Control" "Windows 2000 5.0 x86" "Jetty/3.1 (JSP 1.1; Servlet
 "[1m[35mWelcome on console"
 ```
 
-{{< image src="images/c4max.png" alt="Example: C4 Max Vehicle GPS" >}}
+{{< image src="images/c4max.png" alt="Example: C4 Max Vehicle GPS" />}}
 
 
 ### [DICOM](https://www.dicomstandard.org/about/) Medical X-Ray Machines [🔎 &#x2192;](https://www.shodan.io/search?query=%22DICOM+Server+Response%22+port%3A104)
@@ -183,7 +183,7 @@ Secured by default, thankfully, but these 1,700+ machines still [have no busines
 "Server: EIG Embedded Web Server" "200 Document follows"
 ```
 
-{{< image src="images/power-gaugetech.png" width="500" alt="Example: GaugeTech Electricity Meters" >}}
+{{< image src="images/power-gaugetech.png" width="500" alt="Example: GaugeTech Electricity Meters" />}}
 
 
 ### Siemens Industrial Automation [🔎 &#x2192;](https://www.shodan.io/search?query=%22Siemens%2C+SIMATIC%22+port%3A161)
@@ -230,7 +230,7 @@ Secured by default, thankfully, but these 1,700+ machines still [have no busines
 
 [Shodan Images](https://images.shodan.io/) is a great supplementary tool to browse screenshots, by the way!  [🔎 &#x2192;](https://images.shodan.io/?query=%22authentication+disabled%22+%21screenshot.label%3Ablank)
 
-{{< image src="images/vnc.png" width="500" alt="Example: Unprotected VNC" caption="The first result right now. 😞" >}}
+{{< image src="images/vnc.png" width="500" alt="Example: Unprotected VNC" caption="The first result right now. 😞" />}}
 
 
 ### Windows RDP [🔎 &#x2192;](https://www.shodan.io/search?query=%22%5Cx03%5Cx00%5Cx00%5Cx0b%5Cx06%5Cxd0%5Cx00%5Cx00%5Cx124%5Cx00%22)
@@ -258,7 +258,7 @@ Older versions were insecure by default. [Very scary.](https://krebsonsecurity.c
 "MongoDB Server Information" port:27017 -authentication
 ```
 
-{{< image src="images/mongo.png" width="500" alt="Example: MongoDB" >}}
+{{< image src="images/mongo.png" width="500" alt="Example: MongoDB" />}}
 
 
 ### [Mongo Express](https://github.com/mongo-express/mongo-express) Web GUI [🔎 &#x2192;](https://www.shodan.io/search?query=%22Set-Cookie%3A+mongo-express%3D%22+%22200+OK%22)
@@ -269,7 +269,7 @@ Like the [infamous phpMyAdmin](https://www.cvedetails.com/vulnerability-list/ven
 "Set-Cookie: mongo-express=" "200 OK"
 ```
 
-{{< image src="images/mongo-express.png" width="700" alt="Example: Mongo Express GUI" >}}
+{{< image src="images/mongo-express.png" width="700" alt="Example: Mongo Express GUI" />}}
 
 
 ### Jenkins CI [🔎 &#x2192;](https://www.shodan.io/search?query=%22X-Jenkins%22+%22Set-Cookie%3A+JSESSIONID%22+http.title%3A%22Dashboard%22)
@@ -278,7 +278,7 @@ Like the [infamous phpMyAdmin](https://www.cvedetails.com/vulnerability-list/ven
 "X-Jenkins" "Set-Cookie: JSESSIONID" http.title:"Dashboard"
 ```
 
-{{< image src="images/jenkins.png" width="700" alt="Example: Jenkins CI" >}}
+{{< image src="images/jenkins.png" width="700" alt="Example: Jenkins CI" />}}
 
 
 ### Docker APIs [🔎 &#x2192;](https://www.shodan.io/search?query=%22Docker+Containers%3A%22+port%3A2375)
@@ -324,7 +324,7 @@ Lantronix password port:30718 -secured
 "Citrix Applications:" port:1604
 ```
 
-{{< image src="images/citrix.png" width="700" alt="Example: Citrix Virtual Apps" >}}
+{{< image src="images/citrix.png" width="700" alt="Example: Citrix Virtual Apps" />}}
 
 
 ### Cisco Smart Install [🔎 &#x2192;](https://www.shodan.io/search?query=%22smart+install+client+active%22)
@@ -356,7 +356,7 @@ Telnet Configuration: [🔎 &#x2192;](https://www.shodan.io/search?query=%22Poly
 "Polycom Command Shell" -failed port:23
 ```
 
-{{< image src="images/polycom.png" width="550" alt="Example: Polycom Video Conferencing" >}}
+{{< image src="images/polycom.png" width="550" alt="Example: Polycom Video Conferencing" />}}
 
 
 ### [Bomgar Help Desk](https://www.beyondtrust.com/remote-support/integrations) Portal [🔎 &#x2192;](https://www.shodan.io/search?query=%22Server%3A+Bomgar%22+%22200+OK%22)
@@ -388,7 +388,7 @@ HP-ILO-4 !"HP-ILO-4/2.53" !"HP-ILO-4/2.54" !"HP-ILO-4/2.55" !"HP-ILO-4/2.60" !"H
 "x-owa-version" "IE=EmulateIE7" "Server: Microsoft-IIS/7.0"
 ```
 
-{{< image src="images/owa2007.png" width="450" alt="Example: OWA for Exchange 2007" >}}
+{{< image src="images/owa2007.png" width="450" alt="Example: OWA for Exchange 2007" />}}
 
 #### Exchange 2010 [🔎 &#x2192;](https://www.shodan.io/search?query=%22x-owa-version%22+%22IE%3DEmulateIE7%22+http.favicon.hash%3A442749392)
 
@@ -396,7 +396,7 @@ HP-ILO-4 !"HP-ILO-4/2.53" !"HP-ILO-4/2.54" !"HP-ILO-4/2.55" !"HP-ILO-4/2.60" !"H
 "x-owa-version" "IE=EmulateIE7" http.favicon.hash:442749392
 ```
 
-{{< image src="images/owa2010.png" width="450" alt="Example: OWA for Exchange 2010" >}}
+{{< image src="images/owa2010.png" width="450" alt="Example: OWA for Exchange 2010" />}}
 
 #### Exchange 2013 / 2016 [🔎 &#x2192;](https://www.shodan.io/search?query=%22X-AspNet-Version%22+http.title%3A%22Outlook%22+-%22x-owa-version%22)
 
@@ -404,7 +404,7 @@ HP-ILO-4 !"HP-ILO-4/2.53" !"HP-ILO-4/2.54" !"HP-ILO-4/2.55" !"HP-ILO-4/2.60" !"H
 "X-AspNet-Version" http.title:"Outlook" -"x-owa-version"
 ```
 
-{{< image src="images/owa2013.png" width="580" alt="Example: OWA for Exchange 2013/2016" >}}
+{{< image src="images/owa2013.png" width="580" alt="Example: OWA for Exchange 2013/2016" />}}
 
 
 ### Lync / Skype for Business [🔎 &#x2192;](https://www.shodan.io/search?query=%22X-MS-Server-Fqdn%22)
@@ -450,7 +450,7 @@ Specifically domain controllers: [🔎 &#x2192;](https://www.shodan.io/search?qu
 "Set-Cookie: iomega=" -"manage/login.html" -http.title:"Log In"
 ```
 
-{{< image src="images/iomega.png" width="600" alt="Example: Iomega / LenovoEMC NAS Drives" >}}
+{{< image src="images/iomega.png" width="600" alt="Example: Iomega / LenovoEMC NAS Drives" />}}
 
 
 ### Buffalo TeraStation NAS Drives [🔎 &#x2192;](https://www.shodan.io/search?query=Redirecting+sencha+port%3A9000)
@@ -459,7 +459,7 @@ Specifically domain controllers: [🔎 &#x2192;](https://www.shodan.io/search?qu
 Redirecting sencha port:9000
 ```
 
-{{< image src="images/buffalo.png" width="580" alt="Example: Buffalo TeraStation NAS Drives" >}}
+{{< image src="images/buffalo.png" width="580" alt="Example: Buffalo TeraStation NAS Drives" />}}
 
 
 ### Logitech Media Servers [🔎 &#x2192;](https://www.shodan.io/search?query=%22Server%3A+Logitech+Media+Server%22+%22200+OK%22)
@@ -468,7 +468,7 @@ Redirecting sencha port:9000
 "Server: Logitech Media Server" "200 OK"
 ```
 
-{{< image src="images/logitech.png" width="500" alt="Example: Logitech Media Servers" >}}
+{{< image src="images/logitech.png" width="500" alt="Example: Logitech Media Servers" />}}
 
 
 ### [Plex](https://www.plex.tv/) Media Servers [🔎 &#x2192;](https://www.shodan.io/search?query=%22X-Plex-Protocol%22+%22200+OK%22+port%3A32400)
@@ -484,7 +484,7 @@ Redirecting sencha port:9000
 "CherryPy/5.1.0" "/home"
 ```
 
-{{< image src="images/plexpy.png" width="560" alt="Example: PlexPy / Tautulli Dashboards" >}}
+{{< image src="images/plexpy.png" width="560" alt="Example: PlexPy / Tautulli Dashboards" />}}
 
 
 
@@ -538,7 +538,7 @@ html:"DVR_H264 ActiveX"
 "Serial Number:" "Built:" "Server: HP HTTP"
 ```
 
-{{< image src="images/hp.png" width="700" alt="Example: HP Printers" >}}
+{{< image src="images/hp.png" width="700" alt="Example: HP Printers" />}}
 
 
 ### Xerox Copiers/Printers [🔎 &#x2192;](https://www.shodan.io/search?query=ssl%3A%22Xerox+Generic+Root%22)
@@ -547,7 +547,7 @@ html:"DVR_H264 ActiveX"
 ssl:"Xerox Generic Root"
 ```
 
-{{< image src="images/xerox.png" width="620" alt="Example: Xerox Copiers/Printers" >}}
+{{< image src="images/xerox.png" width="620" alt="Example: Xerox Copiers/Printers" />}}
 
 
 ### Epson Printers [🔎 &#x2192;](https://www.shodan.io/search?query=%22SERVER%3A+EPSON_Linux+UPnP%22+%22200+OK%22)
@@ -560,7 +560,7 @@ ssl:"Xerox Generic Root"
 "Server: EPSON-HTTP" "200 OK"
 ```
 
-{{< image src="images/epson.png" width="550" alt="Example: Epson Printers" >}}
+{{< image src="images/epson.png" width="550" alt="Example: Epson Printers" />}}
 
 
 ### Canon Printers [🔎 &#x2192;](https://www.shodan.io/search?query=%22Server%3A+KS_HTTP%22+%22200+OK%22)
@@ -573,7 +573,7 @@ ssl:"Xerox Generic Root"
 "Server: CANON HTTP Server"
 ```
 
-{{< image src="images/canon.png" width="550" alt="Example: Canon Printers" >}}
+{{< image src="images/canon.png" width="550" alt="Example: Canon Printers" />}}
 
 
 
@@ -590,7 +590,7 @@ ssl:"Xerox Generic Root"
 "Server: AV_Receiver" "HTTP/1.1 406"
 ```
 
-{{< image src="images/yamaha.png" width="550" alt="Example: Yamaha Stereos" >}}
+{{< image src="images/yamaha.png" width="550" alt="Example: Yamaha Stereos" />}}
 
 
 ### Apple AirPlay Receivers [🔎 &#x2192;](https://www.shodan.io/search?query=%22%5Cx08_airplay%22+port%3A5353)
@@ -629,7 +629,7 @@ Apple TVs, HomePods, etc.
 title:"OctoPrint" -title:"Login" http.favicon.hash:1307375944
 ```
 
-{{< image src="images/octoprint.png" width="700" alt="Example: OctoPrint 3D Printers" >}}
+{{< image src="images/octoprint.png" width="700" alt="Example: OctoPrint 3D Printers" />}}
 
 
 ### Etherium Miners [🔎 &#x2192;](https://www.shodan.io/search?query=%22ETH+-+Total+speed%22)
@@ -638,7 +638,7 @@ title:"OctoPrint" -title:"Login" http.favicon.hash:1307375944
 "ETH - Total speed"
 ```
 
-{{< image src="images/eth.png" width="800" alt="Example: Etherium Miners" >}}
+{{< image src="images/eth.png" width="800" alt="Example: Etherium Miners" />}}
 
 
 ### Apache Directory Listings [🔎 &#x2192;](https://www.shodan.io/search?query=http.title%3A%22Index+of+%2F%22+http.html%3A%22.pem%22)
diff --git a/layouts/_default/single.amp.html b/layouts/_default/single.amp.html
index a6f9fe80..882949c8 100644
--- a/layouts/_default/single.amp.html
+++ b/layouts/_default/single.amp.html
@@ -62,6 +62,11 @@
       p.center, p.image, p.caption {
         text-align: center;
       }
+      p.caption {
+        margin-top: -1em;
+        font-size: 0.9em;
+        color: #5e5e5e;
+      }
       header {
         width: 100%;
         background-color: #f9f9f9;
diff --git a/layouts/shortcodes/image.amp.html b/layouts/shortcodes/image.amp.html
index 0b787606..542bce12 100644
--- a/layouts/shortcodes/image.amp.html
+++ b/layouts/shortcodes/image.amp.html
@@ -29,7 +29,8 @@
 
 <p class="image">
   <amp-img
-    {{ with .Get "alt" }}alt="{{ . }}"{{ end }}
+    {{- with .Get "alt" }} alt="{{ . | safeHTMLAttr }}" title="{{ . | safeHTMLAttr }}"{{ end }}
+    {{- with .Inner }} alt="{{ . | plainify | safeHTMLAttr }}" title="{{ . | plainify | safeHTMLAttr }}"{{ end }}
     src="{{ $image.Permalink }}"
     width="{{ $displayWidth }}"
     height="{{ $displayHeight }}"
@@ -37,4 +38,4 @@
   </amp-img>
 </p>
 
-{{- with .Get "caption" }}<p class="caption"><em>{{ . }}</em></p>{{ end -}}
+{{- with .Inner }}<p class="caption">{{ . | safeHTML }}</p>{{ end -}}
diff --git a/layouts/shortcodes/image.html b/layouts/shortcodes/image.html
index c1320764..4a39f4b8 100644
--- a/layouts/shortcodes/image.html
+++ b/layouts/shortcodes/image.html
@@ -27,19 +27,15 @@
 {{- $displayWidth := $setWidth -}}
 {{- $displayHeight := (math.Ceil (mul $origRatio $setWidth)) -}}
 
-{{- if .Get "caption" -}}
+{{ with .Inner }}
 <figure>
   <picture>
-{{- else -}}
-<p>
-{{- end -}}
-<img src="{{ $image.Permalink }}" width="{{ $displayWidth }}" height="{{ $displayHeight }}"
-     {{- with .Get "alt" }} alt="{{ . }}"{{ end }}
-     {{- with .Get "caption" }} title="{{ . }}"{{ end }}>
-{{- with .Get "caption" -}}
+    <img src="{{ $image.Permalink }}" width="{{ $displayWidth }}" height="{{ $displayHeight }}"
+         alt="{{ . | plainify | safeHTMLAttr }}" title="{{ . | plainify | safeHTMLAttr }}">
   </picture>
-  <figcaption>{{ . }}</figcaption>
+  <figcaption>{{ . | safeHTML }}</figcaption>
 </figure>
-{{- else -}}
-</p>
-{{- end -}}
+{{ else }}
+<p><img src="{{ $image.Permalink }}" width="{{ $displayWidth }}" height="{{ $displayHeight }}"
+     {{- with .Get "alt" }} alt="{{ . | safeHTMLAttr }}" title="{{ . | safeHTMLAttr }}"{{ end }}></p>
+{{ end }}
diff --git a/layouts/shortcodes/image.rss.html b/layouts/shortcodes/image.rss.html
index 820a3b6a..5122eef1 100644
--- a/layouts/shortcodes/image.rss.html
+++ b/layouts/shortcodes/image.rss.html
@@ -29,7 +29,7 @@
 
 <p style="text-align: center;">
 <img src="{{ $image.Permalink }}" width="{{ $displayWidth }}" height="{{ $displayHeight }}"
-     {{- with .Get "alt" }} alt="{{ . }}"{{ end }}
-     {{- with .Get "caption" }} title="{{ . }}"{{ end }}>
-{{ with .Get "caption" }}<br>{{ . }}{{ end -}}
+     {{- with .Get "alt" }} alt="{{ . | safeHTMLAttr }}" title="{{ . | safeHTMLAttr }}"{{ end }}
+     {{- with .Inner }} alt="{{ . | plainify | safeHTMLAttr }}" title="{{ . | plainify | safeHTMLAttr }}"{{ end }}>
+{{ with .Inner }}<br>{{ . | safeHTML }}{{ end -}}
 </p>