diff --git a/plugins/english/wetriedtls.ts b/plugins/english/wetriedtls.ts
index b00eb3c6e..27e3b824f 100644
--- a/plugins/english/wetriedtls.ts
+++ b/plugins/english/wetriedtls.ts
@@ -133,14 +133,88 @@ function paragraphText(p: string): string {
   return decodeEntities(p.replace(/<[^>]+>/g, '')).trim();
 }
 
-function isTitleRepeat(p: string): boolean {
-  // A paragraph that is nothing but bold text, e.g. the repeated
-  // series / chapter title the site prepends to every chapter body.
+/** Lowercase and drop everything but letters and digits, for loose matching. */
+function normalizeText(s: string): string {
+  return s
+    .toLowerCase()
+    .replace(
+      /[\s\u2000-\u2bff\u3000-\u303f\uff01-\uff0f!-/:-@[-`{-~\xa0-\xbf]+/g,
+      '',
+    );
+}
+
+/**
+ * True when a block is the site's repeated series / chapter title header,
+ * e.g. `◈ Series Name`, `Chapter 12: Title`, `Series<br>Chapter 12`. The
+ * titles come from the chapter page itself, so this needs no state from
+ * parseNovel. A block only counts when nothing but known titles (plus a
+ * bare "Chapter N") is left after removing them, so a genuine bold line
+ * such as a POV label or scene header is never stripped.
+ */
+function isTitleRepeat(p: string, knownTitles: string[]): boolean {
+  let rest = normalizeText(paragraphText(p.replace(/<br\s*\/?>/gi, ' ')));
+  if (!rest) return false;
+  const titles = knownTitles
+    .map(normalizeText)
+    .filter(t => t.length > 0)
+    .sort((a, b) => b.length - a.length);
+  let removed = false;
+  for (const t of titles) {
+    if (rest.indexOf(t) !== -1) {
+      rest = rest.split(t).join('');
+      removed = true;
+    }
+  }
+  rest = rest.replace(/(?:volume|vol|chapter|ch|episode|ep)\d+/g, '');
+  // Catalog titles often omit a leading article the header keeps.
+  return removed && /^(?:the|an?)?$/.test(rest);
+}
+
+/**
+ * Translator / editor credits and the "Discord:" / "Ko-Fi:" lines that sit
+ * in the chapter header next to the banner are site chrome, not story
+ * content. Covers `Translator: X`, `Editors: A, B`, `Translator/Editor: X`
+ * and `[Translator – X]`. Narrow on purpose: it must start with a role
+ * word followed by a separator (a dash only when spaced, so prose such as
+ * "Editor-in-chief Kim ..." never matches).
+ */
+function isCreditLine(p: string): boolean {
+  const t = paragraphText(p);
+  return (
+    /^\[?\s*(?:(?:translat(?:or|ors|ion)|editors?|proofreaders?|typesetters?|tlc?|qc)\s*[/&,]?\s*)+\s*(?:[:\]]|[–—-]\s|by\b)/i.test(
+      t,
+    ) || /^(?:discord|ko-?fi|patreon)\s*:/i.test(t)
+  );
+}
+
+/**
+ * splitTopLevel, with plain wrapper elements (div / section / article)
+ * unwrapped so a header and the story inside one wrapper are judged block
+ * by block instead of as a single unit.
+ */
+function splitBlocks(html: string): string[] {
+  const out: string[] = [];
+  for (const b of splitTopLevel(html)) {
+    const w = /^<(div|section|article)\b[^>]*>([\s\S]*)<\/\1\s*>$/i.exec(b);
+    if (w) for (const inner of splitBlocks(w[2])) out.push(inner);
+    else out.push(b);
+  }
+  return out;
+}
+
+/** A block that is nothing but bold text, e.g. a header line. */
+function isBoldOnly(p: string): boolean {
   const inner = p
-    .replace(/^<p[^>]*>/i, '')
-    .replace(/<\/p>$/i, '')
+    .replace(/<\/?(?:p|span)\b[^>]*>/gi, '')
+    .replace(/<br\s*\/?>/gi, '')
     .trim();
-  return /^<strong>[\s\S]*<\/strong>$/.test(inner);
+  return /^<(strong|b)\b[^>]*>[\s\S]*<\/\1>$/i.test(inner);
+}
+
+/** A divider row (`──────` or a horizontal rule) in the chapter header. */
+function isDivider(p: string): boolean {
+  if (/<hr[\s>/]/i.test(p) && !paragraphText(p)) return true;
+  return /^[─━—–_=~-]{3,}$/.test(paragraphText(p).replace(/\s+/g, ''));
 }
 
 function isPromoParagraph(p: string): boolean {
@@ -149,12 +223,189 @@ function isPromoParagraph(p: string): boolean {
   if (/<img[\s>]/i.test(p)) return false;
   const t = paragraphText(p).toLowerCase();
   if (!t || t === '= = =') return true;
-  if (t.indexOf('we tried translations') !== -1) return true;
-  if (t.indexOf('dsc.gg') !== -1 || t.indexOf('join our discord') !== -1)
+  if (/we\s*tried\s*translations/.test(t) || /^we\s*tried\s*tls$/.test(t))
+    return true;
+  if (t.indexOf('dsc.gg') !== -1 || /join (our|the) discord/.test(t))
     return true;
   return false;
 }
 
+/**
+ * Decode the HTML entities that can appear inside an attribute value —
+ * decimal (&#106;), hex (&#x6A;) and the named entities that can smuggle a
+ * scheme past a prefix check (&colon;) — so the scheme test sees what the
+ * reader will actually navigate to.
+ */
+function decodeAttrEntities(s: string): string {
+  return s
+    .replace(/&#x([0-9a-f]+);?/gi, (_m, h: string) =>
+      String.fromCharCode(parseInt(h, 16)),
+    )
+    .replace(/&#(\d+);?/g, (_m, n: string) =>
+      String.fromCharCode(parseInt(n, 10)),
+    )
+    .replace(/&colon;?/gi, ':')
+    .replace(/&tab;?/gi, '\t')
+    .replace(/&newline;?/gi, '\n');
+}
+
+/** True for URLs that would execute script when followed from the reader. */
+function isScriptUrl(url: string): boolean {
+  // Browsers ignore whitespace and control characters inside a scheme.
+  const norm = decodeAttrEntities(url)
+    .split('')
+    .filter(ch => ch.charCodeAt(0) > 0x20 && ch.charCodeAt(0) !== 0x7f)
+    .join('')
+    .replace(/\s+/g, '');
+  return /^(javascript|vbscript):/i.test(norm);
+}
+
+// Dangerous elements, plus the raw-text elements (title, xmp, ...) whose
+// content a browser reads as text: tags inside them must not be judged as
+// real tags by the attribute pass below.
+const UNSAFE_TAGS =
+  'script|iframe|object|embed|form|input|textarea|select|button|style|link|meta|base|noscript|title|xmp|noembed|noframes|plaintext';
+
+/** Attributes whose value the reader may navigate to. */
+const URL_ATTRS = /^(?:xlink:)?(?:href|src|action|formaction)$/;
+
+/** SVG animation attributes that can write a script URL into an href. */
+const ANIMATION_ATTRS = /^(?:values|to|from)$/;
+
+function isUnsafeAttr(name: string, value: string): boolean {
+  const n = name.toLowerCase();
+  if (n.indexOf('on') === 0) return true;
+  if (URL_ATTRS.test(n)) return isScriptUrl(value);
+  if (ANIMATION_ATTRS.test(n)) return value.split(';').some(isScriptUrl);
+  return false;
+}
+
+/**
+ * Strip anything that could execute code from chapter HTML: dangerous
+ * elements, event handler attributes (<img onerror=...>), and script URLs in
+ * link-like or SVG animation attributes. The reader sanitizes too; this
+ * keeps the plugin's own output safe. Everything else is preserved as-is.
+ */
+function sanitizeHtml(html: string): string {
+  // Comments and other markup declarations hold no story text, and a quote
+  // inside one must not hide a following tag from the attribute pass.
+  // Repeat until stable so removing one tag cannot splice a new one together.
+  let s = html;
+  for (let prev = ''; prev !== s; ) {
+    prev = s;
+    s = s
+      .replace(/<!--[\s\S]*?(?:--!?>|$)/g, '')
+      .replace(/<!\[CDATA\[[\s\S]*?(?:\]\]>|$)/gi, '')
+      .replace(/<[!?][^>]*>/g, '')
+      .replace(
+        new RegExp('<(' + UNSAFE_TAGS + ')[\\s>/][\\s\\S]*?</\\1\\s*>', 'gi'),
+        '',
+      )
+      .replace(new RegExp('</?(?:' + UNSAFE_TAGS + ')\\b[^>]*>', 'gi'), '');
+  }
+
+  // Walk every tag the way an HTML parser tokenizes it, so an attribute
+  // directly after a quoted value (src="x"onerror=...) is still seen and
+  // text such as "one = 1" is never mistaken for an attribute.
+  const isSpace = (ch: string) => /^[\t\n\f\r ]$/.test(ch);
+  const tagRe = /<\/?[a-z]/gi;
+  let out = '';
+  let pos = 0;
+  let m: RegExpExecArray | null;
+  while ((m = tagRe.exec(s)) !== null) {
+    let i = m.index + m[0].length;
+    while (i < s.length && !isSpace(s[i]) && s[i] !== '/' && s[i] !== '>') i++;
+    out += s.slice(pos, i);
+    for (;;) {
+      const gap = i;
+      while (i < s.length && (isSpace(s[i]) || s[i] === '/')) i++;
+      if (i >= s.length || s[i] === '>') {
+        i = Math.min(i + 1, s.length);
+        out += s.slice(gap, i);
+        break;
+      }
+      const nameStart = i++;
+      while (i < s.length && !/^[\t\n\f\r />=]$/.test(s[i])) i++;
+      const name = s.slice(nameStart, i);
+      let j = i;
+      while (j < s.length && isSpace(s[j])) j++;
+      let value = '';
+      if (s[j] === '=') {
+        j++;
+        while (j < s.length && isSpace(s[j])) j++;
+        const q = s[j];
+        if (q === '"' || q === "'") {
+          const close = s.indexOf(q, j + 1);
+          const end = close < 0 ? s.length : close;
+          value = s.slice(j + 1, end);
+          i = Math.min(end + 1, s.length);
+        } else {
+          const start = j;
+          while (j < s.length && !isSpace(s[j]) && s[j] !== '>') j++;
+          value = s.slice(start, j);
+          i = j;
+        }
+      }
+      out += s.slice(gap, nameStart);
+      if (!isUnsafeAttr(name, value)) out += s.slice(nameStart, i);
+    }
+    pos = i;
+    tagRe.lastIndex = i;
+  }
+  return out + s.slice(pos);
+}
+
+const VOID_TAGS =
+  /^(area|base|br|col|embed|hr|img|input|link|meta|param|source|track|wbr)$/i;
+
+/**
+ * Split chapter HTML into its top-level nodes in document order: each
+ * element (with everything nested in it, so lists, tables, blockquotes and
+ * divs stay intact) or run of loose text becomes one block. An unclosed
+ * <p> is ended by the next <p>, as an HTML parser would.
+ */
+function splitTopLevel(html: string): string[] {
+  const blocks: string[] = [];
+  const tagRe = /<(\/?)([a-z][a-z0-9]*)\b[^>]*?(\/?)>/gi;
+  let depth = 0;
+  let openName = '';
+  let blockStart = 0;
+  let m: RegExpExecArray | null;
+  const push = (from: number, to: number) => {
+    const b = html.slice(from, to).trim();
+    if (b) blocks.push(b);
+  };
+  while ((m = tagRe.exec(html)) !== null) {
+    const closing = m[1] === '/';
+    const name = m[2].toLowerCase();
+    const selfClosed = m[3] === '/' || VOID_TAGS.test(name);
+    if (depth === 0) {
+      // A stray close tag, or a <br> / <wbr> inside loose text, is not a block.
+      if (closing || /^(br|wbr)$/.test(name)) continue;
+      push(blockStart, m.index); // loose text before this element
+      blockStart = m.index;
+      if (selfClosed) {
+        push(blockStart, m.index + m[0].length);
+        blockStart = m.index + m[0].length;
+      } else {
+        depth = 1;
+        openName = name;
+      }
+    } else if (!closing && name === 'p' && depth === 1 && openName === 'p') {
+      push(blockStart, m.index); // unclosed <p>: end it, start a new one
+      blockStart = m.index;
+    } else if (!selfClosed) {
+      depth += closing ? -1 : 1;
+      if (depth === 0) {
+        push(blockStart, m.index + m[0].length);
+        blockStart = m.index + m[0].length;
+      }
+    }
+  }
+  push(blockStart, html.length);
+  return blocks;
+}
+
 /** Parse the /query API response (catalog + search share the shape). */
 function parseQueryResults(jsonText: string): {
   items: NovelCard[];
@@ -210,31 +461,32 @@ function parseChapterList(
   jsonText: string,
   locked = false,
 ): { items: ChapterInfo[]; lastPage: number } {
+  // fetchText returns '' for a failed request. That must never read as a
+  // valid empty page, or parseNovel would take a failed fetch for the end
+  // of the list and present a truncated chapter list as complete.
   const root = safeJson(jsonText);
+  if (!isRecord(root) || !Array.isArray(root.data))
+    throw new Error('Failed to load the chapter list (unexpected response)');
+  const meta = root.meta;
+  if (!isRecord(meta) || typeof meta.last_page !== 'number')
+    throw new Error('Failed to load the chapter list (no pagination info)');
   const items: ChapterInfo[] = [];
-  let lastPage = 1;
-  if (isRecord(root)) {
-    const meta = root.meta;
-    if (isRecord(meta) && typeof meta.last_page === 'number')
-      lastPage = meta.last_page;
-    const data = Array.isArray(root.data) ? root.data : [];
-    for (const c of data) {
-      if (!isRecord(c)) continue;
-      const slug = str(c.chapter_slug).trim();
-      const name = str(c.chapter_name).trim();
-      if (!slug || !name) continue;
-      const title = str(c.chapter_title).trim();
-      const idx = parseFloat(str(c.index));
-      items.push({
-        slug,
-        name: title ? name + ': ' + decodeEntities(title) : name,
-        number: isNaN(idx) ? 0 : idx,
-        publishedAt: str(c.created_at),
-        locked,
-      });
-    }
+  for (const c of root.data) {
+    const slug = isRecord(c) ? str(c.chapter_slug).trim() : '';
+    const name = isRecord(c) ? str(c.chapter_name).trim() : '';
+    if (!isRecord(c) || !slug || !name)
+      throw new Error('Failed to load the chapter list (malformed chapter)');
+    const title = str(c.chapter_title).trim();
+    const idx = parseFloat(str(c.index));
+    items.push({
+      slug,
+      name: title ? name + ': ' + decodeEntities(title) : name,
+      number: isNaN(idx) ? 0 : idx,
+      publishedAt: str(c.created_at),
+      locked,
+    });
   }
-  return { items, lastPage };
+  return { items, lastPage: meta.last_page };
 }
 
 /**
@@ -267,15 +519,34 @@ function shrinkIllustrations(html: string): string {
 }
 
 /**
- * Route a cover through a fast image proxy at a list-friendly size.
- * The site's own covers are up to ~1 MB (they load painfully slowly in
- * the app's novel list) and the CDN offers no smaller variant, so we
- * request a 400px-wide webp instead. Non-URL values pass through.
+ * Covers are served straight from the site's CDN. Routing them through an
+ * image proxy cannot carry a fallback in a single URL field, so a blocked
+ * or down proxy would break every cover while the CDN still works.
+ * Non-URL values pass through.
  */
 function coverUrl(thumbnail: string): string {
-  const t = (thumbnail || '').trim();
-  if (!/^https?:\/\//i.test(t)) return t;
-  return proxiedImageUrl(t, 400);
+  return (thumbnail || '').trim();
+}
+
+/**
+ * The series title, chapter name and chapter title recorded in the chapter
+ * page's own data, used to recognise the repeated title header.
+ */
+function pageTitles(flight: string): string[] {
+  const titles: string[] = [];
+  const add = (re: RegExp) => {
+    const m = re.exec(flight);
+    if (!m) return;
+    try {
+      titles.push(decodeEntities(JSON.parse('"' + m[1] + '"')));
+    } catch {
+      /* ignore an unreadable title */
+    }
+  };
+  add(/"series":\{[^}]*?"title":"((?:[^"\\]|\\.)*)"/);
+  add(/"chapter_name":"((?:[^"\\]|\\.)*)"/);
+  add(/"chapter_title":"((?:[^"\\]|\\.)*)"/);
+  return titles;
 }
 
 type ChapterContentResult =
@@ -346,20 +617,64 @@ function parseChapterContent(html: string): ChapterContentResult {
     .trim();
   if (!body) return { status: 'empty' };
 
-  // Split into top-level blocks — paragraphs, headings, figures and
-  // standalone images, in document order — and trim the site's promo
-  // header / footer (banner, series/chapter title repeats, discord plug).
-  const blocks = body.match(
-    /<p[\s\S]*?<\/p>|<h[1-6][\s\S]*?<\/h[1-6]>|<figure[\s\S]*?<\/figure>|<img[^>]*>/gi,
-  ) || [body];
+  // Split into top-level blocks in document order and trim the site's
+  // promo header / footer (banner, credits, title repeats, discord plug)
+  // from the edges. Blocks the parser does not recognize (lists, tables,
+  // blockquotes) are kept whole: dropping them would lose chapter text.
+  const blocks = splitBlocks(body);
+  if (blocks.length === 0) return { status: 'empty' };
+  const titles = pageTitles(flight);
+  // Site chrome is a short plain line. A long block, or a list / table /
+  // blockquote that merely contains a banner or credit, is story text and
+  // must never be trimmed as junk.
+  const isEdgeJunk = (p: string) =>
+    !/^<(?:blockquote|ul|ol|table|pre)\b/i.test(p) &&
+    paragraphText(p).length <= 250 &&
+    (isPromoParagraph(p) ||
+      isCreditLine(p) ||
+      isDivider(p) ||
+      isTitleRepeat(p, titles));
+  // A short line that opens with a known title is header too: the page data
+  // can lack the chapter title the line goes on with ("Series<br>Chapter 88:
+  // Karakula Labyrinth") or the part number it adds ("Title (1)").
+  const normTitles = titles.map(normalizeText).filter(t => t.length > 0);
+  const startsWithTitle = (p: string) => {
+    const t = normalizeText(paragraphText(p.replace(/<br\s*\/?>/gi, ' ')));
+    return normTitles.some(k => t.indexOf(k) === 0);
+  };
+  // A bold lead-in only counts as header when it reads like a title line.
+  const isHeaderLine = (p: string) =>
+    isEdgeJunk(p) ||
+    (paragraphText(p).length <= 250 && startsWithTitle(p)) ||
+    (isBoldOnly(p) &&
+      /^[◈◆■●\s]*(?:chapter|ch\.?|vol\.?|volume|episode|ep\.?|prologue|epilogue|side story|extra)\b|^[◈◆■●]|[◈◆■●]$/i.test(
+        paragraphText(p),
+      ));
   let start = 0;
   let end = blocks.length;
-  const isEdgeJunk = (p: string) => isPromoParagraph(p) || isTitleRepeat(p);
-  while (start < end && isEdgeJunk(blocks[start])) start++;
+  // The site's header is a bold series / chapter title followed by a divider
+  // row, and those lines do not always match the catalog title exactly. A
+  // bold-only lead-in directly followed by a divider is header; a bold line
+  // without one is kept as content.
+  for (;;) {
+    while (start < end && isEdgeJunk(blocks[start])) start++;
+    let divider = -1;
+    for (let i = start; i < Math.min(end, start + 8) && divider < 0; i++) {
+      if (isDivider(blocks[i])) divider = i;
+    }
+    let header = divider >= 0;
+    for (let i = start; header && i < divider; i++) {
+      header = isHeaderLine(blocks[i]);
+    }
+    if (!header) break;
+    start = divider + 1;
+  }
   while (end > start && isEdgeJunk(blocks[end - 1])) end--;
   const cleaned = blocks.slice(start, end).join('\n');
-  if (!paragraphText(cleaned)) return { status: 'empty' };
-  return { status: 'ok', html: shrinkIllustrations(cleaned) };
+  // An image-only chapter (illustrations with no text) is still content.
+  if (!paragraphText(cleaned) && !/<img[\s>]/i.test(cleaned))
+    return { status: 'empty' };
+  return { status: 'ok', html: sanitizeHtml(shrinkIllustrations(cleaned)) };
 }
 
 function mapStatus(s: string): string {
@@ -399,7 +714,7 @@ class WeTriedTLS implements Plugin.PluginBase {
   name = 'We Tried TLS';
   icon = 'src/en/wetriedtls/icon.png';
   site = SITE;
-  version = '1.0.4';
+  version = '1.1.0';
 
   filters = {
     status: {