Astro for client websites. A folder of files you can hand over.
Static builds on hosting with a free tier, behind a strict content-security policy, making zero third-party requests at runtime. Faster than any builder’s output, and portable by definition.
The fee buys a template. The template holds the site.
A builder site is not a site. It is a rendering of your client’s content inside somebody else’s application, and it exists only while the application does. Stop paying, and it stops rendering. Ask for the files, and on some platforms the honest answer is that there are none to give: Wix documents no site export at all, Squarespace produces one .xml file, and the Webflow ZIP arrives without the CMS.
The fee funds that arrangement. Suppose $30 a month across ten client sites: $3,600 a year, paid by you or passed on to clients who will eventually ask what it is for. Meanwhile the things it pays for — hosting static pages, a TLS certificate, a build — have become free or close to it.
The stack in the playbook takes the application out of the middle. What the client owns is a folder. What the browser receives is the folder.
No application in the middle. Nothing to stop rendering.
Six decisions, made once.
Astro, building to static files
Every page is rendered at build time to plain HTML and CSS. No server runs to serve a page, so there is nothing to patch, nothing to scale and nothing to fall over at two in the morning.
A strict content-security policy
The browser is told which origins it may load from, and the list has one entry: the site itself. Scripts come from the site or not at all. An injected tag is refused before it runs.
Self-hosted fonts
The typeface ships with the site as font files on the same origin. No request leaves for a font service, so no font service can see the visitor, slow the page or go away.
Zero third-party requests, verified
A build step reads the finished output and fails on any URL that points off the origin: scripts, styles, images, font files, anything. The line in the footer is a test result, not a promise.
A host with a free tier
A static folder runs on any host that serves files, and the good ones have a free tier a content site does not outgrow. Pick one. If the deal changes, move the folder. That is what portable means.
A form endpoint on the same origin
The form posts to a route the site owns, and the record lands in a store on the site’s account. No form service, no third-party inbox. That is the Data letter, the one a static folder has to earn.
None of these is clever, and that is the point. A stack you can explain to a client in one sentence is a stack you can hand to them in one folder.
This site is the reference build.
ownthecode.dev runs on the stack it describes. Astro builds every page to static files. The response carries a content-security policy whose script source is this site alone. Bai Jamjuree is served from this origin as font files. The release gate scans the built output and fails the deploy on any request that would leave it. The email form at the foot of this page posts to a route on this origin and writes to a store on this site’s account.
Each of those can be checked from the browser you are reading this in. Open the network panel and reload: every request comes from this domain. Read the response headers and find the policy. Look for a request to a font service, and find none.
The stack passes the CODES test, and the route in front of the form is why it passes Data. You can change how it behaves, which is Control. Nobody can change the deal while you stay, which is Ownership. A folder of files has no ceiling a content site will hit, which is Scalability. Passing is the easy part. The other five systems are how you run it so that nothing bad ever ships.
A folder of files. Hosted anywhere. Owned outright.
The stack is the ground. The gate is the rule.
On its own, the stack passes every test and prevents nothing. The release gate is what stops bad content leaving it, and the rest of the playbook builds on the two together.
Read the sharpest chapter first. It costs an email.
We’ll send the build-gate chapter in full: the checks, the code, and the reasoning. Read it. If it doesn’t change how you think about shipping client sites, you’ve lost ten minutes and kept a working release gate.
That did not send. Check the address and try again.