Which security measures make sense for a static web site?

HTTPS always makes sense from both a performance and privacy standpoint. HTTPS/2 is significantly faster than http/1.1 and cant easily be eavesdropped on.