The challenge
Most small businesses want a fast, secure website without renting a heavyweight platform or paying for a managed CMS they will never fully use. They need TLS that never lapses, a small attack surface, and a way to publish changes that cannot leave the site half-broken.
The failure modes are predictable: an expired certificate that nobody noticed, a mixed-content warning after a careless edit, or a deploy that overwrites the document root mid-request. We design the host so none of those can happen quietly.
Our approach
We provision a single hardened Apache virtual host on a Linux server and serve the site as static files from a dedicated document root. TLS is issued and renewed automatically by Let’s Encrypt via certbot; plain HTTP is permanently redirected to HTTPS; and a strict set of response headers is applied at the vhost level so every request is covered.
Publishing is a single command: the build is produced locally, rsynced into the document root, ownership is corrected, and Apache is reloaded only after a configuration test passes — so a bad config can never take the site down. A single-page-app fallback keeps client-side routes resolving on deep links and hard refreshes.
What we deliver
- Auto-renewing Let’s Encrypt certificate (www + apex) with a renewal dry-run verified at setup.
- HTTP→HTTPS 301 redirect and HSTS (max-age two years, includeSubDomains).
- A tuned Content-Security-Policy plus X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
- Immutable, far-future caching for hashed assets; no-cache for HTML so new deploys appear immediately.
- gzip/deflate compression and an SPA fallback for client-side-routed apps.
Example configuration
The virtual host carries the security headers and SPA fallback; certbot then generates the matching TLS vhost and the redirect. A representative slice:
<VirtualHost *:80>
ServerName www.inspiration-overdrive.com
DocumentRoot /var/www/inspiration-overdrive
<Directory /var/www/inspiration-overdrive>
Options -Indexes +FollowSymLinks
AllowOverride None
Require all granted
# SPA deep links resolve to index.html
FallbackResource /index.html
</Directory>
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data:; \
style-src 'self' 'unsafe-inline'; script-src 'self'; object-src 'none'"
</VirtualHost># One command provisions the cert, the redirect, and HSTS:
certbot --apache -d www.inspiration-overdrive.com -d inspiration-overdrive.com \
--non-interactive --agree-tos -m admin@example.com --redirect --hsts
# certbot installs a systemd timer; confirm renewal works end-to-end:
certbot renew --dry-runOutcome
A low-maintenance, audit-friendly host that scores well on TLS and header checks, renews itself, and deploys in one command. This very website runs on exactly this stack.