Open your browser's developer tools on this page and watch the network tab. Every request goes to alexleloup.com. No analytics, no font service, no tracking pixels, no chat widget. That was a deliberate choice, and it's the same way I think about vendor risk anywhere.
Every third party is a dependency you don't control
Most personal sites load a handful of outside services before the first paragraph appears: fonts from Google, an analytics script, code from the site builder. Each one is content you didn't write, served from a server you don't run, and it can change tomorrow without telling you. That's third-party risk on a small scale. In the corporate world, we'd call it a vendor and ask for an audit report. On a personal site, most people never think about it.
What it took
Less than you'd expect:
- Self-hosted fonts. JetBrains Mono and IBM Plex Serif are open source, so the files live on this server instead of someone else's.
- No analytics. I don't need a visitor count badly enough to send every reader's data somewhere else.
- A strict Content Security Policy. The browser is told to load scripts, styles, fonts, and images from this domain only, and to refuse inline scripts. If someone managed to inject code, the browser wouldn't run it.
- The usual hardening. HTTPS everywhere with HSTS, no framing by other sites, and a
security.txtfile so anyone who finds a problem knows how to report it.
The trade-off
I don't know how many people visit or where they come from. I'm fine with that. This site's job is to be accurate, fast, and trustworthy when someone looks me up, not to feed a dashboard.
The point
Security is mostly a series of small, unglamorous decisions made consistently. This site is a small example: fewer moving parts, fewer things to trust, less to go wrong. If you want to check my work, the developer tools are one keystroke away.