Sticking to this rule has served me well over the years: - resources that are dynamically-generated are served by API endpoints, therefore known locations with

Sticking to this rule has served me well over the years: - resources that are dynamically-generated are served by API endpoints, therefore known locations with predictable parameters - everything else must be static files And definitely no dynamic script as the fallback rule, it's too wasteful in an era of crawlers that ignore robots.txt and automated vulnerability scanners. A backend must be resilient.