Open Experiment Forge

Guide

A safe static website baseline

A practical starting checklist for publishing a simple website with fewer moving parts.

Status: seed
  • security
  • static-site
  • deployment

A static website is not automatically perfect, but it starts with fewer exposed parts. There is no app server handling public requests, no database to leak, and no account system to protect.

Baseline

  1. Publish static files over HTTPS.
  2. Avoid third-party scripts until they have a clear purpose.
  3. Add security headers at the host level.
  4. Keep dependencies small and updated.
  5. Treat Markdown as trusted author content, not user input.

Headers worth starting with

  • Content-Security-Policy
  • Strict-Transport-Security
  • X-Content-Type-Options
  • X-Frame-Options
  • Referrer-Policy
  • Permissions-Policy

The exact values may change if the site later adds analytics, forms, embedded media, or a CMS.