Security Architecture, by Default
AstroWEBTheme treats security as part of the foundation rather than an add-on: real response-header CSP, nonce-aware scripts, and Turnstile-protected forms configured from the start.
Most website security gets added after something goes wrong: a meta-tag CSP that does not actually block anything, a contact form with no bot protection, scripts loaded without review. AstroWEBTheme starts from the opposite direction — a security model configured before the first page is built, not bolted on afterward.
Real response-header CSP
Content Security Policy is enforced through response headers rather than a meta tag, which closes the gaps meta-only CSP leaves open. The policy is generated from src/site/config/security.mjs, so project-specific adjustments stay declarative instead of hand-edited into templates.
Nonce-aware scripts
Scripts that need to run are nonce-tagged per request rather than relying on a blanket unsafe-inline allowance, keeping the CSP strict while still allowing legitimate interactive components to work.
Lazy and idle script loading
Non-critical scripts load through a manifest-driven strategy — on interaction or during idle time — instead of all blocking the initial render. This keeps the security model from working against page performance.
Turnstile-protected forms
Contact and enquiry forms are designed to work with Cloudflare Turnstile out of the box, protecting against automated submissions without the visible friction of a traditional CAPTCHA.
Consent-aware analytics
Analytics and ad scripts respect visitor consent choices before loading, rather than firing unconditionally on page load.
The full technical breakdown — headers, directives, and how they’re generated — lives in Response-Header CSP for Client Sites.
Need a security review on an existing Astro project, not a new one? NViewsWEB reviews dependencies, headers, forms, and production configuration before launch.
