This site is a static website (HTML/CSS/JS only). That gives it the smallest possible attack surface: there is no server, no database, no admin panel, and no user accounts to compromise.
| Control | What was done |
|---|---|
| Zero third-party runtime code | All libraries (Three.js r128, loaders, fonts) are vendored locally. The site makes no requests to CDNs or trackers. |
| Strict Content-Security-Policy | Every page ships a CSP meta tag: script-src 'self' (+ a pinned SHA-256 hash for the JSON-LD block), style-src 'self' 'unsafe-inline', object-src 'none', base-uri 'self', form-action 'self', restricted frame-src (Google Maps only), img-src/font-src/connect-src 'self'. Inline scripts and third-party scripts cannot execute. |
| No inline event handlers | All onclick=/inline JS removed — event listeners only. |
| No user input reaches the DOM | Search text is used only for array filtering; the car-detail ?id= parameter is resolved against a fixed whitelist of cars; nothing is ever interpolated into innerHTML unescaped. |
| No backend form | The contact form composes a WhatsApp message (URL-encoded) and opens wa.me — there is no server-side endpoint to inject into or abuse. |
| Openers neutralized | Every external link uses rel="noopener noreferrer". |
| Referrer minimized | <meta name="referrer" content="strict-origin-when-cross-origin"> on all pages. |
| JSON-LD integrity | The structured-data script is pinned by a CSP SHA-256 hash, so any tampering with it would be blocked by the browser. |
| Hosting headers prepared | _headers, netlify.toml and .htaccess ship ready-made X-Frame-Options: DENY, X-Content-Type-Options, Permissions-Policy, HSTS and header-level CSP for hosts that support them. |
| Security contact published | /security.txt and /.well-known/security.txt let researchers reach you. |
- Keep the repo private if it contains anything sensitive — it does not (no keys, no credentials are committed). Never commit a GitHub token.
- If you ever add a backend (booking, newsletter, admin panel): validate everything server-side, use parameterized queries, rate-limit the contact endpoint, and keep the CSP intact.
- Custom domain + HTTPS — GitHub Pages/Netlify/Cloudflare all give free
HTTPS. A custom domain (e.g.
nasibcarstore.af) looks professional and lets you enable HSTS. - Update the vendored libraries periodically — Three.js r128 is pinned and vendored on purpose (stability + offline). When updating, review the diff.
- Enable 2FA on your GitHub account and revoke any personal access token you shared after the site is published.
- No website can be "unhackable". This one removes the realistic attack paths (injection, third-party supply chain, open forms) and relies on the host's HTTPS for the rest.
- GitHub Pages does not allow custom HTTP headers, so the header-level protections (HSTS, X-Frame-Options) are already enforced by GitHub's own platform headers. If you want full control of headers, host the same folder on Netlify or Cloudflare Pages — the config files are included.
Found a weakness? Please email radmaneshhassani8@gmail.com or radmanesh.hassani@icloud.com before publishing it anywhere.