If you're trying to figure out CORS errors, it means you're either loading fonts or making XMLHttpRequests across domains. Neither of those were available in the 90s era OP is rhapsodizing about. You don't have to use the additional features/complexity of the past 15–20 years… but if you do, it's not surprising that things get a little more complex!

You actually do have to use HTTPS nowadays, and that's a non-trivial amount of complexity compared to just serving up a static page over HTTP.

Eh, most static site hosting provider offer it out of the box nowadays

What if I want to run a simple but non-static website? It was a lot easier to just do CGI with a small perl script in the 2000s.

Pretty much every web provider supports PHP, so it would be as simple as changing the extension from .html to .php

No it’s not. Certs are pretty dumbed down. So much so that there is a thing called certbot that just does it for you.

Yeah, we run certbot. It fails for some reason at least once a year and we have to do something to fix it. At the very least you have to find a way to run it on the regular and you can't forget about it or else your simple static website starts looking like malware. Tell me again how trivial it is for a 15-year-old kid using their parents' Windows 10 machine to get certbot running reliably.

IE had ActiveX since 1996, which allowed for things similar to Ajax.

I used https://neocities.org/ recently to make a simple static html website with no issues and no configuration. And I'm someone who usually uses the more "advanced" stuff. It's nice having the freedom to chase a little nostalgia sometimes.

Is that like modern geocities?

Exactly. Same in the spirit.

Welcome to CORS errors, so sorry you made the trip. :)

CORS will eventually click for you and then it will always make sense. Until then, sorry you’re going through the muck.

I honestly feel like CORS was invented just to get people to use reverse proxies more.

CORS enables site operators to prevent third-party sites from offloading requests for them onto clients, and conveniently reduces XSS exposure as a side-effect.