Handbook for Mastering the Principles of Static Web Development : Part II

Part II of the static web handbook covers what happens once your site works: keeping it secure, keeping it fast, and selling from it. A static site is already hard to attack and quick to load, and a few server settings and habits keep it that way.

1. Security: smaller surface, not zero

A static site has no database and no server code per visit, so SQL injection and most server-side attacks have nothing to hit. What remains:

• Your build tools and dependencies. Keep the generator and npm packages updated, and run npm audit before you build.
• Third-party scripts. Every analytics, chat or widget script runs with full access to your page. Add only the ones you need, from sources you trust.
• Forms and small scripts. A contact form's PHP handler is server code: validate every field on the server, and never put an API key or password in JavaScript.
• Your hosting login. A stolen FTP or control panel password lets someone replace every page. Use strong passwords and two-factor sign-in.

2. HTTPS and security headers

Every Domain India shared hosting plan includes a free SSL certificate: AutoSSL with Let's Encrypt on cPanel, and Let's Encrypt on DirectAdmin. Once it is issued, send all visitors to HTTPS. mod_rewrite works in .htaccess on our cPanel, DirectAdmin and Webuzo servers:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Security headers go in the same .htaccess. Wrap them in IfModule so the site keeps working if the headers module is not available, and test each page afterwards:

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data:; frame-ancestors 'self'"
</IfModule>

3. Performance: keep the static advantage

Caching rules for .htaccess, again wrapped so they are skipped if the module is missing:

<IfModule mod_headers.c>
  <FilesMatch "\.(css|js|woff2|webp|avif|svg|png|jpg)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
  <FilesMatch "\.html$">
    Header set Cache-Control "no-cache"
  </FilesMatch>
</IfModule>

Use a year-long lifetime only for files whose names change when their content changes. Otherwise returning visitors keep the old version.

On our cPanel servers, pages can also be served from a server-side cache for up to 120 minutes. Add ?t=1 to an address to check that an update is live. Measure with Lighthouse in Chrome DevTools and aim for good Core Web Vitals: Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift.

4. Selling from a static site

A static site can sell, as long as the payment itself happens somewhere secure:

• Hosted checkout or payment links. A gateway such as Razorpay can host the payment page, so card and UPI details never touch your site.
• Embedded checkout with server confirmation. Open the gateway's checkout from your page, then confirm the payment with a small server-side script and a webhook. See Razorpay integration in PHP and Node.js.
• Product data. Keep products in a JSON or Markdown file that your generator builds into pages, or pull them from a headless CMS or e-commerce API at build time.
• Stock and orders. Once you need live stock levels, customer accounts or order management, a hosted e-commerce service or a dynamic shop fits better than a static site.

5. Pitfalls to avoid

• Too much client-side JavaScript, which slows the first view and hides content from search engines. Generate pages at build time.
• Skipping accessibility: headings in order, alt text, contrast and keyboard access.
• Forgetting redirects when you rename pages. Add a 301 in .htaccess for every old address.
• No version control. Keep the source in Git, and upload only the build output.

6. Where Domain India fits

Any Domain India shared hosting plan (cPanel, DirectAdmin or Webuzo) can serve a static site, with free SSL and .htaccess support. Upload the build output to public_html with the File Manager or FTP. Prices on the cards are live and exclude 18% GST.

Ready to publish? Read part 1 of the handbook, then choose cPanel hosting for your site.