Spain Take the World, the Clubs Take Over — and I Need Your Opinion

So that's that. The World Cup is over, and Spain didn't just win it — they took the final and made it look like a training exercise. There was one team playing the game on its own terms and another team watching it happen.

You can win a World Cup by riding your luck. Spain didn't. That's the kind of tournament that gets remembered as a full stop at the end of a sentence rather than a question mark.

And now, the quiet bit

Here's the strange thing about a World Cup summer: the moment it ends, the calendar feels empty. No group stage to argue about, no bracket to redraw every three days.

It doesn't last. The domestic leagues are about to come back and eat the next ten months whole — and honestly, that's the football this site was built for. Long seasons, tables that shift week by week, streaks that take twenty games to build and one bad afternoon to break. Tournaments are a fireworks display. Leagues are the weather.

So the fixtures are coming back, the streaks start ticking again, and the tables go from being a summer curiosity to the thing you check on a Sunday morning.

Which brings me to the fork in the road

Now that the tournament is done, I've got a stretch of time to build something substantial — and I genuinely can't decide which way to go. There are two directions, and they pull against each other.

Option 1 — go wider

More competitions. More leagues, and crucially cup competitions: domestic cups, continental knockouts, the tournaments where a second-division side occasionally walks into a giant's stadium and walks out with the tie.

The argument for it: right now, if your league isn't covered, the site is useless to you. No amount of extra detail fixes that. Width is what turns "not for me" into "for me."

The argument against: cups are awkward. Two-legged ties, extra time, penalties, seeding, teams from different countries and different levels meeting each other. A lot of what makes the streak and standings tools work quietly assumes a league — a fixed set of teams playing each other twice. Cups break that assumption in a dozen small ways.

Option 2 — go deeper

Players and coaches. Who actually scored, who kept the clean sheets, which manager has never won at a particular ground, what changes when a specific player is missing.

The argument for it: it's the question people actually ask. "Are they good at home?" eventually becomes "are they good at home without their striker?" Team data can't answer that. There's a ceiling to what team-level numbers can tell you, and I'm starting to bump into it.

The argument against: it's a lot more data, it's messier, and it's the kind of thing that's easy to do badly. Half-finished player data is worse than none.

I'd like to hear from you

I've gone back and forth on this for weeks, which is usually a sign I should stop guessing and ask.

So: which would actually make you use the site more? More competitions, or more depth on the ones already here? If it's width — which leagues or cups? If it's depth — what would you want to look up first?

Drop me a line at SmartSoccerStats@gmail.com. Short answers are fine. "Add the Dutch cup" is a useful message. So is "I don't care about players at all, just cover my league." I read all of it, and it genuinely does change what I build next.

One small thing while I'm here

Unrelated to any of the above, and much less interesting: I've added a set of security headers to the site this week.

These are instructions the server sends to your browser alongside every page, telling it what it's allowed to do with what it just received. You'll never see them. Briefly, they:

• Force HTTPS for future visits, so your browser refuses to fall back to an unencrypted connection even if something tries to push it there.
• Stop the browser guessing file types. If the server says something is an image, the browser treats it as an image and doesn't go looking for a second opinion — which is one classic way a harmless-looking file gets executed as code.
• Block the site from being embedded inside someone else's page, which is how a copy of a site gets wrapped in a frame and passed off as the real thing.
• Leak less about where you came from when you click a link out of the site.
• Pre-emptively refuse camera, microphone and location, none of which this site has ever asked for or wanted.
• Restrict where scripts are allowed to load from — currently in a report-only mode, meaning it watches and reports rather than blocks, so I can confirm it doesn't break anything before switching it on properly.

To be clear about the scale of this: as the site stands today, it's public and read-only, and these headers weren't fixing an emergency.

But they're not decoration either — they're groundwork. Accounts are something I'm seriously considering, and the day a site grows a login, every one of these stops being housekeeping and starts doing real work. Sessions are precisely what they protect. Far better to have them already in place, already tested, already boring, than to be retrofitting them in a hurry around something that actually matters.

I also tightened up how blog posts get converted to HTML, which was the one genuinely soft spot in the whole thing. It only ever mattered because I write the posts myself — but "only I can write here" is a rule enforced by nothing, and those are the ones worth turning into actual code.

Right. The leagues are back soon. See you in the data.