Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
HSTS makes the browser remember HTTPS
HTTP Strict Transport Security tells a supporting client to use HTTPS for a remembered hostname. It can eliminate the insecure HTTP request before a redirect, but only when the client already knows the policy, through an earlier authenticated response or a supported preload mechanism. Merely adding a header cannot retroactively protect an unknown client’s first HTTP visit.
...
HTTP methods express a contract you must implement
An HTTP method describes the action requested on a target resource. Clients and intermediaries use those semantics when deciding whether to fetch, cache, or retry. Choosing a familiar verb is only the beginning: the application must implement the behavior that the verb promises. Calling a destructive operation GET does not make it safe. A useful API documents its resource model, representation, authorization, and error conditions alongside the method.
...
Preload gives crucial assets a head start
A preload announces a resource before its normal consumer discovers it. This can help when a needed image is created by JavaScript or a font is discovered only after loading and parsing a stylesheet. The benefit is an earlier opportunity to fetch. It does not follow that every hinted asset becomes the browser’s highest priority or that every page becomes faster.
...
Locks and leases tame concurrent writers
Locks and leases coordinate access to shared resources, but their failure behavior depends on the implementation. Here the concern is exclusive writers; locks can also have shared modes. A lease adds a bounded validity period. Neither a familiar name nor a timeout alone proves that a delayed writer cannot damage data after another writer takes over.
...
Redirect chains add requests
A followed redirect makes the client resolve a Location value and issue another request before it reaches the desired representation. Several individually reasonable rules can form a chain: normalize a hostname, add HTTPS, fix a trailing slash, and move an old article. Review the complete path seen by a visitor, because each intermediary becomes another dependency.
...
robots.txt guides crawlers but does not authorize access
A robots.txt file communicates crawling rules to automated clients that implement the Robots Exclusion Protocol. It can reduce unwanted traversal of expensive or unhelpful paths, but the server does not automatically enforce its contents against incoming requests. RFC 9309 explicitly separates these rules from access authorization. Treat robots.txt as a public interface for cooperating crawlers, while authentication and authorization decide who may actually retrieve protected resources.
...
S3 storage classes trade cost for access
A storage class changes retrieval behavior, resilience, and billing, not just the monthly price of bytes. Start with the time allowed to recover data and whether another copy can be recreated. Standard-IA offers immediate access with retrieval charges; Glacier Flexible Retrieval and Deep Archive require restoration before ordinary reads. One Zone-IA also has a different failure boundary: its data is not resilient to physical loss of its Availability Zone.
...
Security headers need observable browser behavior
Security response headers ask a supporting browser to enforce specific rules. Their value comes from the behavior those rules change, not from the length of a header checklist. A static site still has document loading, scripts or styles, embedding, navigation, and transport boundaries to consider. Select policies that match the actual page and delivery path, then verify both intended restrictions and legitimate functionality.
...
