How this site is built
Each section is a decision: what I needed, what I chose, and what that choice costs. The costs matter more than the choices.
What happens when you open a page
- Your browser asks the nearest Cloudflare location. While it prepares the answer, it already tells your browser which files to fetch first (an early hint).
- The page arrives as finished HTML with the security headers attached. There is no application server behind it.
- The stylesheet, script and fonts come from the same place. Their names carry a fingerprint of their content, so your browser can keep them for a year.
- In browsers that support it, resting your pointer on a link prepares the next page in the background, so it opens instantly.
No framework
A page about one person should open at once, even on a poor connection. So the site is plain HTML, one stylesheet and one script that stays under 30 KB compressed, and the pages are built in advance: the same code that would draw the page in your browser draws it at build time, so you receive finished HTML.
The cost is a small build script that I maintain myself instead of leaning on a framework’s conventions.
Static files and no server code
With no database and no application server there is nothing to patch in the request path. The contact form opens your mail program with a prepared draft rather than posting to a service I would have to defend.
The cost is that the site cannot store anything for me, such as messages.
Cloudflare for production, with a fallback
Cloudflare Pages lets me send real security headers and keep fingerprinted files for a year; the free static hosting I started on cannot set headers at all.
The cost is one more vendor and a secret to protect. The earlier hosting stays ready as a fallback, so going back takes minutes.
A strict Content Security Policy
Scripts may only come from this site, plus Google’s analytics once you accept. That rules out whole classes of attack.
The cost is that convenient shortcuts such as inline scripts are not allowed, so every behaviour lives in a file the policy can name.
Analytics only after consent
Knowing how the site is used is useful; tracking people without asking is not. Analytics stays off until you accept.
The cost is that my numbers undercount, and I accept that.
Speed as a tested requirement
A budget written in a document is forgotten; a budget in the test suite stops the release. A first visit may use 200 KB and 12 requests in the test browser, and a change that goes over does not ship.
The cost is that some things, such as large images or extra fonts, have to be justified before they are added.
Two gates before production
Every change is published to a password-protected copy first. Production needs a separate manual step with a typed confirmation and a reviewer’s approval.
The cost is speed: publishing is slower than releasing on every merge, deliberately.
Tests for what visitors feel
The suite checks accessibility, colour contrast, security headers, the three languages, the printed page, the transitions and the performance budget, in desktop and phone layouts.
The cost is a few minutes of waiting, kept low by running the test groups in parallel.