How I Hardened a Static Website Against Common Web Attacks

How I Hardened a Static Website Against Common Web Attacks I recently built a static website for a side project and decided to take security seriously — even though it's "just" a static site with no backend. Here's everything I did to harden it, and why each step matters. The Security Headers All configured via .htaccess on Apache (Hostinger shared hosting): # Prevent clickjacking Header always set X-Frame-Options "DENY" # XSS protection (legacy browsers) Header always set X-XSS-Protection "1; mode=block" # Prevent MIME-type sniffing Header always set X-Content-Type-Options "nosniff" # Force HTTPS for 1 year + subdomains Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" # Control referrer information Header always set Referrer-Policy "strict-origin-when-cross-origin" # Disable unnecessary browser features Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=()" # Hide server information He