A Strict CSP Is Easy When Your Site Is Static
A strict Content-Security-Policy is the best XSS defense most sites never ship. On a static site it's one response header and a hash — no WAF, no SaaS.
Build-time HTML, island-based interactivity, and the static-first framework that fits content sites better than React-app stacks.
3 posts in this category.
A strict Content-Security-Policy is the best XSS defense most sites never ship. On a static site it's one response header and a hash — no WAF, no SaaS.
The awesome-astro list is the default entry point into the Astro ecosystem. It is also half noise. Here is what to actually install — and what to skip — sorted by what survives a year of production use.
Last week we published the case for picking Astro over Next.js on content sites. Then we migrated this blog. One PR, half a working day, and a Lighthouse Performance score of 100 from a real production deploy — here are the honest numbers and what surprised us.