This site has no backend, no forms, and no database. That doesn’t make it secure by default. It makes it a smaller target, which is a different thing.
I used the OWASP Top 10 as a checklist, one category at a time. It’s the list of web security risks published by the OWASP Foundation. Some don’t apply to a static site, and I say so. Others apply more than they seem to.
Here’s what I did, why I did it, and what’s out of my reach.