How I made my Astro site secure by default (strict CSP, self-hosted fonts, zero trackers)

Short summary

A detailed guide to making Astro sites secure and private by default: strict CSP with script-src 'self' and no unsafe-inline, self-hosted fonts to eliminate Google CDN leaks, and additional security headers (HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options). Astro's build-time script processing makes strict CSP painless since inline scripts become external hashed files automatically.

• •Strict CSP with script-src 'self' and no unsafe-inline neutralizes XSS injection attacks
• •Self-host fonts as woff2 files to eliminate Google CDN privacy leaks and improve performance
• •Add HSTS, nosniff, Referrer-Policy, Permissions-Policy, and X-Frame-Options headers to close remaining gaps

Generated with AI, which can make mistakes.