How we got an A+ on security headers with a static site
Hash-based CSP, the headers your framework leaves out and what Cloudflare can break: how this site reaches A+ on securityheaders.com and MDN Observatory.
Tag: Astro
How we build and why: technical decisions with their costs, written so you can check them.
Why this site uses Astro and not Next.js
We build with Next.js, yet this site does not use it. A strict CSP, static HTML and zero JavaScript by default tipped the balance.