Most portfolio and blog templates quietly work against your visitors. They pull fonts from Google's CDN (leaking every visitor's IP to a third party), ship analytics that set cookies before anyone consents, and sprinkle inline scripts around — which forces a loose Content-Security-Policy, if there's one at all.
I wanted the opposite: a site that's fast, private, and secure by default — green on securityheaders.com before I touch a single setting. Here's exactly how, with Astro, and how you can do the same.
Why Astro makes this easy
Astro ships zero JavaScript by default. Components render to static HTML at build time; you opt into client-side JS only where you actually need it. That's already half the battle: less JS means a smaller attack surface and a CSP that can stay strict.
1. A strict Content-Security-Policy
