(untitled)

This is my first post on lainchan so I hope it's inline with the standard of this community. I'm new to programming and such and have finished writing a website, I'm preparing to bring it online and would like to know if there is anything I need to watch out for in regards to security the site is only html and css, no JavaScript, no php. Is their even any attack vectors for a such a site? The only thing I can think of is DOS, and I have no idea how to protect the site from that. As a final clarification; I'm looking for a through list of possible threats to a the site. Also any non security tips for my site are also appreciated.

*thorough not through

There will be no attack vectors through the site itself in this case. Any remotely available service left open on the machine which hosts the site can still be vulnerable. For example if the only services that you are hosting on the machine are SSH and your web server, you need to make sure that both are locked down. For example, if you had a weak password on your user account, someone could brute force their way into your machine via SSH. In order to protect against this there are solution like fail2ban, but the most important thing is using SSH keys instead of passwords to authenticate. It could also be possible to find a vulnerability in the SSH daemon or HTTP daemon which an attacker could exploit. In order to combat this, you should always install security updates as soon as possible. In regards to DOS, again this can be mitigated by installing the latest security updates. If you are talking about DOS by someone just exhausting your available bandwidth, there's nothing really that you can do except distributing your site over multiple servers in different locations and having a load balancer exclude the servers being DOS'd. There's also stuff like null routing the connections from an attacker allowing your web server or whatever not have to spend processing time dealing with the requests. Though that is more applicable if the DOS is expending your processing capabilities and not your bandwidth. Since your site is just serving static content, it shouldn't use very much processing power in general. There're also solutions like cloudflare, but doing that allows them to be a man in the middle and view all user traffic unencrypted. Assuming that your just a hobbyist, I wouldn't really bother protecting against a DOS attack as it's not really likely. Personally, I'd be much more worried about locking down SSH access than protecting against a DOS attack.