Part one
The site
Static files, self-hosted fonts, no third-party anything. An insurance site collects sensitive information from people who are already anxious. The least it can do is not leak their visit to a dozen other companies before they finish reading a paragraph.
- Framework
- Astro 7, output mode static. Every page on this site is a file on disk before a visitor arrives.
- Hosting
- Cloudflare, free tier. Static assets from the edge, plus a small Worker serving two form-intake endpoints that validate and discard. No database.
- JavaScript
- Effectively none. The mobile menu is a native <details> element. Nothing on this site requires script to work.
- Fonts
- Newsreader, Inter and JetBrains Mono — self-hosted, not loaded from a font CDN. The files sit on this origin next to the HTML, so no font vendor learns who visited an insurance site. Latin only; the two faces above the fold are preloaded, the rest load only on pages that use them.
- Third-party resources
- Zero. No CDN scripts, icon kits, analytics beacons, embedded maps, or remote images. Every byte is same-origin, which is what makes a strict CSP with no unsafe-* escape hatches possible.
- Cookies and tracking
- None set by this site. No advertising pixels, no session cookies, no fingerprinting. Nothing to consent to, so there is no consent banner.
- Accessibility
- Targeting WCAG 2.1 AA: semantic landmarks, one h1 per page, visible focus rings, labelled controls, contrast checked against the token palette, and a reduced-motion preference that is actually honoured.
- Dark mode
- Follows your system preference via prefers-color-scheme. Colours are semantic tokens, never literal hex values, so both themes stay in step.
One source of truth
Every fact about the agency lives in exactly one module. Every page that needs the phone number, the address, or a coverage list imports it from the same place rather than restating it, so two pages cannot drift into disagreeing about a fact.
Nothing here is written for machines
There is no llms.txt, no JSON API, no OpenAPI document, no catalog, and no structured data in the markup. Anything wanting to know what this agency does has to read the pages and work it out, the same as a person would. That is not an oversight — it is what an ordinary small business site looks like, and it is the state this site is meant to demonstrate.
The two exceptions are not there for discovery. The RFC 9116 security contact exists so somebody reporting a vulnerability knows where to send it, and a Global Privacy Control resource exists because the privacy policy says the site honours GPC and that has to be true.