Rebuilding dhimansoft.com from scratch

Our previous WordPress site was compromised. Rather than patch it and hope, we rebuilt from scratch: a static Next.js site, hosted on Cloudflare Pages, with no database and no admin panel for an attacker to find next time.

What it's built with

Next.js 16 with the App Router, compiled as a fully static export — there's no server process running in production, which also means there's nothing to patch when the next framework CVE lands. Content lives as JSON and MDX files in the repository itself, validated against a schema at build time, so a typo in a page's content fails the build instead of shipping.

The whole thing is designed to be measured, not just built. Every page's performance, accessibility and SEO scores come from real Lighthouse and axe runs, not a one-time check before launch.

Two bugs the hardening pass actually caught

We set a strict Content-Security-Policy early — script-src 'self', nothing looser. It looked right. It also would have quietly broken the site.

Next's static export embeds a small inline script on every page to handle client-side hydration — the thing that makes buttons and the dark-mode toggle actually work. A strict CSP with no exception for inline scripts blocks that outright. We only found this by actually serving the real build through the real production headers in a local Docker container and loading it in an actual browser, not by reading the configuration and assuming it was fine. The fix computes a real cryptographic hash of each page's actual script at build time and allows exactly that — nothing looser, no blanket exception.

The second bug was quieter: our contact form's spam widget needed to apply its own styling dynamically, and the same strict policy silently blocked that too. The widget loaded, the script ran, and it just never rendered. No error dialog, no obvious sign anything was wrong — until we actually watched it fail in a browser.

Neither of these would have shown up by reading the code. They showed up by running it for real and checking.

What's next

Case studies are coming once we've written them up properly — we'd rather ship an honest "nothing here yet" than a placeholder dressed up as a real project. If you want to see how any of this applies to something you're building, get in touch.