How we got an A+ on security headers with a static site
Hash-based CSP, the headers your framework leaves out and what Cloudflare can break: how this site reaches A+ on securityheaders.com and MDN Observatory.
Web security
Headers, CSP and what it takes for a site to be verifiably secure.