16-bitproof-of-work handshake
9hardening headers
403without a valid origin, verified live
Paste the idea, get the verdict. Brutal, never sneering.
Then the hardening pass: a proof-of-work handshake, per-IP limits, an origin allowlist, a honeypot, a content security policy and integrity hashes on every script. All of it is still enforced on the live site.