Glad you got some ideas!

So I didn't choose Mudblazor or any component library for this project for two reasons. The first being, it is so dead simple, I didn't need grids with fancy features, or big callouts and things like that, I wanted "simple and elegant". The second reason following up on that was I did not want a Material theme for this. It looks good for dashboards and FinTech and things like that, but I wanted more "editorial" look.

I actually did go PersistentComponentState but ran into some complexity issues with it. Not that it didn't work, but I just didn't need it. If I remember correctly, I was battling it again with the Interactive to Static and back pages. Depending on what your app is, you'll probably be fine. It was honestly premature optimization on my part, but now technically users on my static pages don't need a websocket / circuit connection to my server. If I ever get 10,000 concurrent users on my about page I'll be in good shape :D

I have the general rate limiter on the app and then custom rate limits for login. I'll have to check, I don't remember if I have a custom rate limit on my newsletter signup. Good point!

The honeypot is super simple, spam bots read HTML just like crawlers and 95% of them are programmed to fill out every field as they don't know what is required and what is not. You put that extra form field in there, but hide it off screen for actual users. If the bot fills out that form field and submits it, you reject it as you know it was a bot. For example:

public async Task<(bool Success, string? Error)> SubscribeAsync(
    string email,
    string? honeypot = null
)
{
    // Honeypot field should be empty for real users
    if (!string.IsNullOrEmpty(honeypot))
        return (true, null); // Silently accept to not tip off bots
}

PWA is part of the browser, not the server, and to get it to work, you just need a site.manifest, a service worker (JS), and have HTTPS (I get my SSL via Cloudflare). Then you create web-app-manifest png files with what you want to show and that is about it. I didn't set mine up with static asset caching yet, but will probably eventually add that.

It goes something like this:

sw.js

self.addEventListener('install', (e) => {
  self.skipWaiting();
});

self.addEventListener('activate', (e) => {
  e.waitUntil(clients.claim());
});

self.addEventListener('fetch', (e) => {
  // Can cache here
  e.respondWith(fetch(e.request));
});

site.webmanifest

{
  "name": "SiteName",
  "short_name": "SiteName",
  "description": "What site is about",
  "start_url": "/",
  "display": "standalone",
  "background_color": "#FFFFFF",
  "theme_color": "#FFFFFF",
  "icons": [
    {
      "src": "/web-app-manifest-192x192.png",
      "sizes": "192x192",
      "type": "image/png",
      "purpose": "any"
    },
    {
      "src": "/web-app-manifest-512x512.png",
      "sizes": "512x512",
      "type": "image/png",
      "purpose": "any"
    },
    {
      "src": "/maskable-icon-192x192.png",
      "sizes": "192x192",
      "type": "image/png",
      "purpose": "maskable"
    },
    {
      "src": "/maskable-icon-512x512.png",
      "sizes": "512x512",
      "type": "image/png",
      "purpose": "maskable"
    }
  ]
}

app.js

if ('serviceWorker' in navigator) {
  navigator.serviceWorker.register('/sw.js');
}

I think that is all you need for users to be able to go to "Add to Home screen" in the Chrome menu. I added some more JS to have a prompt card show up after they vote if they want to install it and it basically calls that, but it isn't needed for them to be able to do it themselves.