Static-site social networks bypass centralized servers entirely, serving user profiles and posts as plain files while routing interactions through lightweight serverless components. This architecture eliminates the honeypot databases that make traditional social networks irresistible spam targets — and the indie web is proving it works, one ActivityPub endpoint at a time.
The AI Spam Crisis That Broke Centralized Social Media
Social media platforms are losing the AI spam war on every measurable front. By May 2025, AI-written content crossed 52% of newly published articles online — up from roughly 10% in late 2022.1 Meta actioned 1.4 billion fake accounts in Q4 2024 alone.2 Spotify removed 75 million AI-generated spam tracks in a single year. Approximately 37% of all internet traffic is now classified as “bad bots.”3
The economics are perverse. Creating and operating AI spam accounts on centralized platforms costs fractions of a cent per post. Detection requires expensive machine-learning inference at massive scale. The attackers win on unit economics — they always will, as long as the cost asymmetry holds.
Static-site social networking inverts this cost equation entirely. It does so not through better spam detection, but by changing what attackers would need to compromise.
What Is a Static-Site Social Network?
A static-site social network replaces the traditional server-driven social platform with four components:
- Static files — HTML, JSON-LD, and Markdown stored on a CDN. These serve your profile, posts, and outbox to anyone who fetches them.
- Serverless endpoints — Minimal functions (Cloudflare Workers, AWS Lambda) handling only write operations: accepting follow requests, validating incoming webmentions.
- Cryptographic identity — IndieAuth or DID-based identifiers tied to a domain you control, not a username registered on someone else’s server.
- Federated protocols — ActivityPub or WebSub for interoperability with the broader fediverse.
The key insight is that a static file cannot host a spam account. It cannot autonomously generate posts, send follows, or simulate engagement. Every action requires a human triggering a rebuild — or an attacker with persistent access to your deploy pipeline, which is a qualitatively harder and more expensive attack than exploiting a writable database.
The Real Projects Making It Work
The theoretical appeal of static-site social networking has been understood for years. What has changed recently is the depth of practical implementations connecting these sites to the broader fediverse.
Bridgy Fed: The Bridge That Actually Ships
Bridgy Fed (created by Ryan Barrett, launched publicly June 2024) is the most production-ready bridge between personal websites and both ActivityPub (Mastodon, Misskey) and AT Protocol (Bluesky).4
The setup requires no ActivityPub code on your site. Add microformats2 markup — semantic HTML attributes like class="h-card" for your profile and class="h-entry" for posts — and Bridgy Fed handles protocol translation automatically:
Your Name
Your bio here
Your fediverse handle becomes @yourdomain.com@yourdomain.com. Followers on Mastodon see your posts. Replies flow back as webmentions. No server process runs permanently on your infrastructure.
Rolling Your Own ActivityPub Actor
For developers who want full control, the standard hybrid architecture follows a pattern documented independently by Paul Kinlan (Google Chrome DevRel) and developer Maho Pacheco in a six-part guide series updated through Q1 2025.56
yourdomain.com/ .well-known/ webfinger → static JSON (discovery endpoint) actor.json → static JSON (profile, public key) outbox.json → static JSON (recent posts, rebuilt on each deploy) inbox → serverless function (receives follows, replies)
The outbox and actor files are generated at build time by your static site generator. The inbox — the only dynamic component — is a serverless function that validates incoming HTTP signatures, stores follower lists in an external datastore (Firestore, DynamoDB, or even a GitHub-hosted JSON file), and triggers post distribution.
Pacheco’s Q1 2025 update added RSA-SHA256 signed HTTP request authentication, required by stricter fediverse instances like hachyderm.io, and templates that embed full post content directly in ActivityPub notes rather than links back to your site.6
Fedipage: ActivityPub Built Into the Generator
Fedipage (GitLab, by Freemo, v1.0 released October 2023) is a static site generator that ships with ActivityPub support pre-integrated, using Vercel and Firebase for the dynamic components.7 It handles follow notifications, displays fediverse boosts and replies as comments, and supports account migration via account aliasing — directly addressing the lock-in problem that makes leaving centralized platforms painful.
How the Spam Resistance Actually Works
Spam resistance in static-site social networking is not a single feature. It is an emergent property of the architecture combined with three specific mechanisms.
Mechanism 1: IndieAuth and the Real Cost of Identity
IndieAuth (W3C Community Report) uses your domain name as your identity.8 Participating in the static social web requires a domain, a functioning personal site, and proof of control over both.
On centralized platforms, creating a fake account costs seconds and nothing. Creating a convincing IndieAuth identity requires purchasing a domain (~$12/year minimum), building a basic personal site, and maintaining uptime. Not prohibitive for a targeted attacker, but sufficient to eliminate the bulk-account-creation economics that power most AI spam campaigns. You cannot programmatically generate 10,000 IndieAuth identities with a credit card and a Python script.
Mechanism 2: Webmentions and the Vouch Protocol
Webmention (W3C Recommendation) is the standard mechanism for cross-domain interaction notifications on the indie web — functionally @-mentions between independent sites.9 When someone links to your post from their domain, their server sends a notification to your webmention endpoint.
Webmention spam is currently rare because it requires a domain, a site that actually links to the target, and correct HTTP semantics. As of May 2024, IndieWeb co-founder Aaron Parecki documented the first observed webmention spam attempt — a Behance profile sending a notification without including the required backlink, which the validator rejected automatically.10
The Vouch protocol (IndieWeb Living Specification) extends Webmention with a web-of-trust layer: a sender includes a vouch parameter pointing to a mutual connection — a third site that has linked to the sender and that the receiver has previously interacted with.11 Automated spam has no vouch to provide.
POST /webmention HTTP/1.1 Content-Type: application/x-www-form-urlencoded
source=https://alice.com/reply &target=https://bob.com/post &vouch=https://carol.com/page-that-links-to-alice
This creates a trust graph that grows organically through genuine interaction, not platform algorithms.
Mechanism 3: Proof-of-Work on Every Submission
The third layer addresses residual risk from automated submissions that have somehow acquired valid domains and backlinks. ALTCHA (altcha.org, MIT license) is the most actively developed implementation of proof-of-work for web forms, using memory-hard puzzles that resist GPU acceleration.12
Unlike legacy CAPTCHAs, ALTCHA runs invisibly: client-side JavaScript computes an Argon2 or Scrypt puzzle before the form submits. The solution is verified server-side in milliseconds. For static sites, a serverless function validates the proof before accepting a comment or webmention. No cookies, no fingerprinting, GDPR-compliant.
The real-world evidence is compelling. After deploying hashcash-based proof-of-work on his contact form at difficulty 19 — requiring 30-60 seconds of client computation — developer Jameson Lopp reported spam stopped entirely. Without it, his form received spam within three hours of going live.13
The February 2024 Mastodon Attack: What Decentralization Can and Cannot Do
In February 2024, a coordinated campaign targeted the fediverse — Mastodon, Misskey, and related platforms — by exploiting open registrations on under-maintained small servers, then using ActivityPub federation to propagate spam network-wide.14
The attack exposed a structural vulnerability that pure decentralization cannot solve alone: “It’s like email from 1996,” as one developer put it during the incident. No native content-analysis spam blocking exists in the ActivityPub protocol specification. Small server operators — typically volunteers running hobby instances — lacked the operational capacity to respond in real time.
The fediverse’s primary defense tool — defederation, blocking entire servers — worked for large, well-maintained instances but was devastating for legitimate users on the blocked servers. The Carnegie Endowment’s March 2025 report on fediverse defederation documented this power asymmetry: when large commercial platforms defederate from small volunteer-run servers, the impact is bilateral and effectively permanent.15
Static-site social networking avoids the specific vulnerability the February 2024 attack exploited: there is no writable server to compromise. A static site generates no dynamic content server-side, hosts no account database, processes no incoming requests at the hosting layer. The attack surface that made the Mastodon campaign feasible does not exist.
| Platform Type | Dynamic Attack Surface | Identity Cost | Bulk Spam Viability | Moderation Model |
|---|---|---|---|---|
| Centralized (X, Meta) | High | Near zero | Systemic | Algorithmic + large team |
| Federated (Mastodon, Misskey) | Medium (per-server) | Low (free accounts) | Targeted via weak nodes | Distributed volunteer |
| Static-site social (IndieWeb) | Minimal (serverless only) | High (domain + site) | Impractical at scale | Self-sovereign |
| AT Protocol (Bluesky) | Low (app-layer) | Low | Growing | Labeler-based |
The Infrastructure Crisis the Fediverse Must Solve
A critical warning for practitioners: decentralization does not automatically produce sustainability. In March 2025, IFTAS — the Independent Federated Trust & Safety organization, the fediverse’s only dedicated cross-instance moderation support nonprofit — shut down most of its services after a funding crisis left its $1.2M projected operational budget with only $300K in grant-coverable revenue.16
Services eliminated: the Content Classification Service (IFTAS CCS), the FediCheck trust registry, the Tall Poppy anti-harassment tool. These were the closest the fediverse had to coordinated spam intelligence infrastructure.
A Practical Implementation Stack for 2026
For practitioners building or migrating to a static-site social presence, the layered stack that provides meaningful AI-spam resistance combines:
- Domain-based identity: IndieAuth with your own domain as the identifier
- Fediverse bridge: Bridgy Fed for minimal setup, or static actor.json + serverless inbox for full control
- Interaction protocol: Webmentions via webmention.io, pulled and displayed at build time
- Trust layer: Vouch protocol extension for webmention authenticity
- Computational friction: ALTCHA proof-of-work on any form or submission endpoint
- Optional syndication: POSSE to Mastodon and Bluesky for broader distribution reach
This stack does not make spam impossible. It makes spam economically unviable at scale — which, given current AI spam economics, is the realistic achievable goal. The indie web is not building a walled garden. It is raising the floor on what it costs to participate.
Frequently Asked Questions
Q: Can a static site participate in ActivityPub without any server-side code? A: Broadcast-only participation is possible — a static actor.json and outbox.json let fediverse servers discover and display your posts. But receiving follows, replies, or any bidirectional interaction requires at minimum a single serverless function to handle inbox POSTs with RSA-SHA256 HTTP signature validation.
Q: How does IndieAuth compare to Mastodon accounts for spam resistance? A: IndieAuth requires a registered domain and a live personal site, creating a hard floor on identity cost that Mastodon’s free account registration does not. Programmatically generating thousands of convincing IndieAuth identities requires thousands of registered domains — a fundamentally different economics from creating throwaway Mastodon accounts.
Q: Are webmentions vulnerable to spam as adoption grows? A: Currently, webmention spam is rare and technically self-limiting — a valid webmention requires a real backlink from the sender’s site to the target. The Vouch extension adds a web-of-trust layer that raises the bar further. However, the IndieWeb community acknowledges this as an evolving challenge that will require active protocol development as adoption scales.
Q: What happened to IFTAS and what does it mean for fediverse operators? A: IFTAS shut down its primary services in March 2025 after funding fell $900K short of operational needs. This eliminated the fediverse’s shared trust registry and content classification service. Individual instance operators now bear full moderation responsibility with no shared infrastructure — meaningfully increasing the operational burden on volunteer administrators.
Q: Is proof-of-work effective specifically against AI spam bots? A: Memory-hard PoW algorithms like Argon2 and Scrypt are designed to resist GPU and ASIC acceleration — the same hardware AI spam operations depend on for bulk computation. The critical variable is difficulty calibration: high enough to make bulk submissions economically painful, low enough that legitimate users on consumer hardware submit without significant friction. ALTCHA’s variable-difficulty mode provides a practical middle path for production deployments.
Footnotes
-
Graphite/Surfer study analyzing 65,000 articles published January 2020 through May 2025. Reported by Futurism, 2025. ↩
-
Meta Q4 2024 Community Standards Enforcement Report. ↩
-
Anura. Bot traffic distribution analysis, 2025. ↩
-
Ryan Barrett. “Bluesky and Mastodon users can now talk to each other with Bridgy Fed.” TechCrunch, June 5, 2024. ↩
-
Paul Kinlan. “Adding ActivityPub to your static site.” paul.kinlan.me, December 2022; updated references 2024–2025. ↩
-
Maho Pacheco. “A Guide to Implementing ActivityPub in a Static Site: Q1 2025 Updates.” maho.dev, March 2025. ↩ ↩2
-
Freemo. “Fedipage v1 released: the static site generator with ActivityPub support.” SocialHub ActivityPub Forum, October 2023. ↩
-
IndieAuth. W3C Community Report. indieweb.org/IndieAuth. ↩
-
Webmention. W3C Recommendation. w3.org/TR/webmention. ↩
-
Aaron Parecki. IndieWeb spam documentation, May 2024. indieweb.org/spam. ↩
-
Vouch. IndieWeb Living Specification. indieweb.org/Vouch. ↩
-
ALTCHA open-source CAPTCHA. altcha.org/open-source-captcha. MIT license. ↩
-
Jameson Lopp. “Protect Contact Forms from Spam with Proof of Work.” blog.lopp.net. ↩
-
Ernie Smith. “Why Was The Fediverse Flooded With Spam?” Tedium, February 20, 2024. Sarah Perez. “Spam attack on Twitter rival Mastodon highlights fediverse vulnerabilities.” TechCrunch, February 20, 2024. ↩
-
Carnegie Endowment for International Peace. “New Paradigms in Trust and Safety: Navigating Defederation on Decentralized Social Media Platforms.” March 2025. ↩
-
IFTAS. “IFTAS Service Shutdowns.” about.iftas.org, March 3, 2025. ↩