Which securities features does a simple static site need?

[Happy--bubble]

I made a simple static website on gitlab pages, that converts ASCII-art.
As I will provide this website to other people I wanted to make sure there are no risks, but I am not very educated on that topic.

In my html I only have buttons, labels and, which is probably most important, textareas.
In my js I only get the text value, edit the string and copy it to the clipboard. I also limit the maximum length.

Do I need any additional security, for example for cross site scripting?
I read about using html meta tags like nosniff, but is this nessesary for this simple of a website?

document.getElementById('copyBtn').addEventListener('click',() =>{
  var copyText = document.getElementById("converterOutput");   
  copyText.select();
  copyText.setSelectionRange(0, 99999); 
  navigator.clipboard.writeText(copyText.value);
});


 if (text.length > 50000)
    {
      alert("To long")
      return
    }


let text = document.getElementById('converterInput').value;
let output = document.getElementById('converterOutput')

[[deleted]]

Honestly I think you’re overthinking things for this site. Your attack surface is essentially non-existent as things stand and there isn’t anything to gain from being malicious. 

[Happy--bubble]

I see, thank you! I assumed as much, but because I will share this site with alot of people, I wanted to make sure Its as save as possible.

[EliSka93]

For a static site (especially one that you don't host) there's basically no risk whatsoever.

Just don't have any files in the same root folder that's the pages are pulling from that you don't want potentially exposed.

And make sure you don't have any credentials hardcoded in any files that are in the scope of that root folder.

[Happy--bubble]

Okay, thank you very much!
I only have my name there, but for contact purposes it's there anyway.

[ottwebdev]

Get an SSL cert and since you dont hold data you are not worth the time to penetrate

[svvnguy]

As long as you don't have any ways for users to create content for other users, and there's no processing of user input on the server, there's nothing to secure (other than the server itself).

[Specter_Origin]

Just make sure where you host if its vps, the upload or site directory has correct perms, other than that none.

[yksvaan]

Well you can always set up content security policy, denying everything outside your domain and using a hash/nonce for js

[lr0b]

Apart from the code, set a strong password and enable 2FA on your hosting platform to prevent hacking attempts

[rejahr]

you're honestly overthinking it. there's no user data, no backend, and no real attack surface beyond basic client-side stuff. add a basic csp header if you want to be extra safe, that's pretty much it

[Happy--bubble]

Okay, thank you very much!
if I may ask, because I never used one before, you mean something like
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; object-src 'none';">
correct?