How to Build an Undying Website: The Zero-Logic, Zero-Infra Manifesto

Greetings to all junior infrastructure engineers who were rudely awakened in the dead of night to mitigate the recent Php2shell emergency, bleary-eyed and guzzling energy drinks while scrambling to write emergency WAF rules (laughs).

The recent Php2shell incident shook the tech industry to its core. A critical execution bypass flaw in PHP—the programming language that has quietly powered the Web since its infancy—sparked nationwide panic, prompting the head of state (Prime Minister of Japan) to issue an extraordinary public cybersecurity advisory on national television.

That evening, a non-tech acquaintance who wouldn't know an IP address from a zip code texted me out of the blue:

"Hey, there's some terrifying cyberattack on the evening news... You know about computers, right? What on earth is this 'PHP' thing they're talking about?"

I couldn't help but crack a wry smile. PHP: the good old giant that still quietly runs over 70% of the entire Web. Hearing everyday citizens ask "What is PHP?" with genuine trepidation about some apocalyptic cyber weapon was a surreal moment for a veteran systems engineer.

...And right in the midst of that chaos, I opened the Cloudflare Analytics dashboard for our workshop site (https://kinuta.dev/), and did a double take:

9,140 requests from Colombia.

For a split second, I wondered: "Did Kinuta Dev go viral among Colombian tech geeks? Did a South American manufacturing boutique reach out for a consulting gig?" Then I opened the raw access logs and chuckled.

Every single request originated from a solitary IP address in Barranquilla, Colombia (152.202.232.217). Sniffing out a freshly registered .dev domain, an automated bot had spent the small hours carpet-bombing our endpoints with classic PHP and WordPress exploit probes:

A textbook Php2shell and WordPress reconnaissance script. The bot believed with religious fervor that it was hunting a vulnerable PHP server, firing thousands of probes into our domain.

The punchline? During all 9,140 hostile requests, the CPU utilization of our origin server was exactly 0.00%. Load average did not twitch by a single decimal. I was tucked warmly in bed, blissfully fast asleep.

Why? Because there was no server to crash, and no PHP interpreter to compromise. None. Anywhere.

2. Toothpicks Against a Fortress: Zero Attack Surface

No matter how passionately the Colombian scanner pounded /wp-login.php, Kinuta Dev runs exclusively on Cloudflare Pages static edge hosting.

On disk, there is nothing except pure HTML, CSS, client-side JavaScript, and optimized image assets. Neither Apache nor Nginx is running. There is no Node.js runtime, no Docker daemon, no MySQL, no PostgreSQL, and not a single trace of a PHP engine.

The bot's packets never even came close to Japan. They were intercepted at Cloudflare's nearest South American Anycast edge datacenters (Bogotá or Miami), where the edge cache instantly served thousands of static "404 Not Found" headers in single-digit milliseconds.

Cybersecurity experts preach day and night about "minimizing your attack surface." Yet the most decisive way to shrink your attack surface is not stacking five firewalls or buying expensive enterprise WAF appliances.

It is physically eliminating the execution environment (dynamic runtimes, OS layers, and databases) from existence altogether.

Instead of building impenetrable castle gates, leave an open grassy plain with no castle to storm. What better security architecture could possibly exist?

3. "SSR Is the Trend, You Know": Returning to the Engineer's Shangri-La

Over the past few years, modern frontend engineering has worshipped server-side rendering (SSR), React Server Components (RSC), and edge hydration.

If you are building an ultra-personalized real-time e-commerce engine or social network, dynamic compute makes sense. But for 90% of corporate websites, engineering blogs, documentation hubs, and marketing landing pages, why on earth are you running a Node.js server to query a database for static prose every single second?

Adopting SSR simply because "it is modern" inevitably breeds familiar misery:

• Midnight Healthcheck Alerts: Node.js memory leaks triggering silent container restarts.
• DB Pool Exhaustion: A viral post exhausts the SQL connection pool and throws 500 Internal Server Error.
• Dependency Sisyphus: Weekly npm audit vulnerabilities demanding endless weekend version bumps.
• Pointless Cloud Bills: Paying hundreds of dollars monthly for idle redundant containers and managed relational databases while everyone sleeps.

I am a dyed-in-the-wool infrastructure veteran who spent years in noisy on-prem server rooms, tightening SCSI cables amidst deafening cooling fans, recompiling Linux kernels in the middle of the night.

Having lived through all of that, I say with absolute conviction:

"Having come full circle, pure static HTML (Jamstack / SSG) is the ultimate Shangri-La for Web engineers."

Write raw Markdown. Push to Git. GitHub Actions compiles the HTML in seconds, placing immutable artifacts onto Cloudflare's global edge network. It combines the featherlight simplicity of 1990s text editors with the indestructible horsepower of a planetary CDN.

4. Why We Proudly Display [email protected] — The Aesthetics of Having No Mail Server

Senior engineers who inspect our footer often ask me: "Okada, have you lost your mind?"

They are looking at our primary contact handle: [email protected]—an address practically begging every automated spam harvester on earth to hammer it with dictionary attacks.

Traditional sysadmins shudder at the sight. We remember the sheer agony of managing mail servers (Sendmail, Postfix, Qmail, Dovecot).

Terrified of open relays, battling reverse DNS (PTR) records, deciphering cryptic SPF, DKIM, and DMARC TXT records, and shedding tears when an IP was unjustly blacklisted by Spamhaus... And who could forget the traumatic Gmail POP3 retrieval deprecation? As a 20-year veteran of Gmail from its invite-only beta, being forced to spend Christmas Eve through New Year's frantically migrating mail pipelines in freezing rooms left scar tissue that never quite heals.

So how can I sleep soundly while publicly broadcasting [email protected]?

Because we do not have a mail server either.

Our domain uses Cloudflare Email Routing, enabled in three clicks. A catch-all rule (*@kinuta.dev) catches any recipient address and forwards it seamlessly to personal Gmail inboxes for free.

Cloudflare's edge crushes malicious relays and bulk spam at the border. There is no mail spool to manage, and no disk space to overflow. It is the ultimate zero-maintenance communication pipe.

5. Sad News: Our Official Mascot "Kinuta Tanuki" Has Never Had a Single Job

Despite having built this undying website, our workshop suffers from a deeply tragic internal dilemma.

Think of Twitter's Fail Whale, Amazon's error dogs, or GitHub's Octocat. Iconic tech platforms possess beloved 500-error mascots designed to soothe frustrated users.

Naturally, we created our own official error mascot: "Kinuta Tanuki".

...Yet alas. Since the day this site was launched, Kinuta Tanuki has not been summoned for a single microsecond.

Of course he hasn't. Cloudflare Pages has zero reason to throw a 500 error:

• No PHP means no 500 Internal Server Error.
• No Node.js means no 502 Bad Gateway.
• No origin server means no 504 Gateway Timeout.

As a result, our lovingly designed mascot sits idle in the corner of our office, chewing on a melonpan like an unemployed freeloader. Having indestructible infrastructure can be a cruel thing.

6. What If the Cloud Giants Vanish? CTO Okada's Only Crisis Scenario

We pride ourselves on an uncrashable setup, but in engineering, nothing is absolute. Here is the single scenario in which Kinuta Dev dies:

"If Microsoft (GitHub), Cloudflare, and Oracle (OCI Always Free) all vanish from the face of the Earth simultaneously tomorrow, our website will finally die."

Of course, if that happens, an asteroid has struck Earth, World War III has severed all undersea cables, or a solar flare has fried all electronics. At that point, nobody will care about my website anyway.

Jokes aside, our degraded recovery architecture is rigorous. Complete Git repositories are mirrored on local workstations and Google Drive. If Cloudflare were ever compromised, rewriting a DNS CNAME record would redeploy the entire website onto Google Cloud Storage or our beloved Sakura Internet (Ishikari Datacenter) in northern Japan within minutes.

Standing on the shoulders of giants while keeping your own hands firmly on the reins—that is pragmatic engineering.

7. Conclusion: The Philosophy of Subtraction — Zen and Infrastructure

In Zen Buddhism, there is a foundational doctrine known as Fushō Fumetsu (不生不滅): "That which is never born can never perish."

Modern infrastructure engineering has become hopelessly obsessed with addition. Microservices, service meshes, distributed tracing, container orchestration... We stack software layers to fix the complexity of earlier software layers, ultimately burning in the fire of our own creation.

Contrast this with Japanese dry landscape gardens (Karesansui). Using not a single drop of water, a master gardener evokes oceans and cosmos with nothing but raked sand and stones.

Infrastructure shares the exact same truth: If you never spawn a server, a server can never die. If you run zero dynamic code, you will never lose sleep over Php2shell.

By subtracting everything superfluous and honing the purest essence—immutable HTML on global edge networks—we attain true resilience. Tonight, servers across the globe may tremble under automated exploit storms. Yet our website rests serenely in 300 edge cities across the planet, running with a perfectly calm face.