Web ApplicationHeart & Science International
Static Site Rebuild
A behavioral science consulting firm's WordPress site was compromised, and the replacement removes the surface rather than defending it. The new site is a static Eleventy build with no CMS, no database and no login: 20 pages including a federal contracting section, forms that post straight to a third-party endpoint, and a strict content-security policy enforced at build time. The homepage ships one 6.5 KB JavaScript file and nothing from a third party.
- Rebuilt from scratch in under a month, with a first version live in 9 days
- No CMS, no database and no login surface - the whole class of machinery the old install exposed is simply gone
- Strict content-security policy with no inline scripts or styles, enforced by a zero-dependency build gate that fails the build on a violation
- One 6.5 KB JavaScript file and zero third-party scripts, analytics tags or CDN references
- 89% smaller homepage than the site it replaced - 51 KB of HTML against 462 KB
- 20 published pages, including federal capability pages linking the client's live SAM.gov and SBA certification records
- Keyless CI deploys through Workload Identity Federation, so no long-lived credential sits in the repository




