Why a static site is hard to hack

A static site is just files on a CDN. There is no database to inject into and no admin login to brute-force.

My checklist

1. Strict Content-Security-Policy header.
2. HSTS with preload.
3. Two-factor authentication on GitHub and hosting.