diff --git a/Cargo.lock b/Cargo.lock
index 1750e5d..758932c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1823,8 +1823,6 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 00f3635..ce27115 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -21,6 +21,14 @@ ssr = [
   "leptos/ssr",
   "leptos-use/ssr",
   "leptos-use/axum",
+  "doku",
+  "bcrypt",
+  "diffy",
+  "enum_delegate",
+  "async-trait",
+  "config",
+  "tower",
+  "tower-layer",
 ]
 hydrate = [
   "leptos/hydrate",
@@ -52,57 +60,28 @@ dbg_macro = "deny"
 unwrap_used = "deny"
 
 [dependencies]
-activitypub_federation = { version = "0.6.0", features = [
-  "axum",
-  "diesel",
-], default-features = false, optional = true }
 anyhow = "1.0.89"
-async-trait = "0.1.83"
-axum = { version = "0.7.7", optional = true }
-axum-macros = { version = "0.4.2", optional = true }
-axum-extra = { version = "0.9.4", features = ["cookie"], optional = true }
 leptos = "0.6.15"
 leptos_meta = "0.6.15"
 leptos_router = "0.6.15"
-leptos_axum = { version = "0.6.15", optional = true }
-bcrypt = "0.15.1"
 chrono = { version = "0.4.38", features = ["serde"] }
-diesel = { version = "2.2.4", features = [
-  "postgres",
-  "chrono",
-  "uuid",
-  "r2d2",
-], optional = true }
-diesel-derive-newtype = { version = "2.1.2", optional = true }
-diesel_migrations = { version = "2.2.0", optional = true }
-diffy = "0.4.0"
-enum_delegate = "0.2.0"
 env_logger = { version = "0.11.5", default-features = false }
 futures = "0.3.30"
 hex = "0.4.3"
-jsonwebtoken = { version = "9.3.0", optional = true }
 rand = "0.8.5"
 serde_json = "1.0.128"
 sha2 = "0.10.8"
-tokio = { version = "1.40.0", features = ["full"], optional = true }
 uuid = { version = "1.10.0", features = ["serde"] }
-tower-http = { version = "0.6.1", features = ["cors", "fs"], optional = true }
 serde = { version = "1.0.210", features = ["derive"] }
 url = { version = "2.5.2", features = ["serde"] }
 reqwest = { version = "0.12.8", features = ["json", "cookies"] }
 log = "0.4"
 tracing = "0.1.40"
 once_cell = "1.20.1"
-wasm-bindgen = "0.2.93"
 console_error_panic_hook = "0.1.7"
 time = "0.3.36"
-tower = "0.5.1"
 markdown-it = "0.6.1"
-web-sys = "0.3.70"
-config = { version = "0.14.0", features = ["toml"] }
-doku = "0.21.1"
 smart-default = "0.7.1"
-tower-layer = "0.3.3"
 katex = { version = "0.4", default-features = false }
 markdown-it-block-spoiler = "1.0.0"
 markdown-it-heading-anchors = "0.3.0"
@@ -112,6 +91,35 @@ markdown-it-sup = "1.0.0"
 leptos-use = "0.13.6"
 codee = "0.2.0"
 
+# backend-only features
+axum = { version = "0.7.7", optional = true }
+axum-macros = { version = "0.4.2", optional = true }
+axum-extra = { version = "0.9.4", features = ["cookie"], optional = true }
+tokio = { version = "1.40.0", features = ["full"], optional = true }
+tower-http = { version = "0.6.1", features = ["cors", "fs"], optional = true }
+activitypub_federation = { version = "0.6.0", features = [
+  "axum",
+  "diesel",
+], default-features = false, optional = true }
+diesel = { version = "2.2.4", default-features = false, features = [
+  "postgres",
+  "chrono",
+  "uuid",
+  "r2d2",
+], optional = true }
+diesel-derive-newtype = { version = "2.1.2", optional = true }
+diesel_migrations = { version = "2.2.0", optional = true }
+doku = { version = "0.21.1", optional = true }
+jsonwebtoken = { version = "9.3.0", optional = true }
+leptos_axum = { version = "0.6.15", optional = true }
+bcrypt = { version = "0.15.1", optional = true }
+diffy = { version = "0.4.0", optional = true }
+enum_delegate = { version = "0.2.0", optional = true }
+async-trait = { version = "0.1.83", optional = true }
+config = { version = "0.14.0", features = ["toml"], optional = true }
+tower = { version = "0.5.1", optional = true }
+tower-layer = { version = "0.3.3", optional = true }
+
 [dev-dependencies]
 pretty_assertions = "1.4.1"
 retry_future = "0.4.0"
diff --git a/src/frontend/api.rs b/src/frontend/api.rs
index 9058e50..79bcfa2 100644
--- a/src/frontend/api.rs
+++ b/src/frontend/api.rs
@@ -50,7 +50,8 @@ impl ApiClient {
         let ssl;
         #[cfg(not(feature = "ssr"))]
         {
-            hostname = web_sys::window().unwrap().location().host().unwrap();
+            use leptos_use::{use_document};
+            hostname = use_document().location().unwrap().host().unwrap();
             ssl = !cfg!(debug_assertions);
         }
         #[cfg(feature = "ssr")]
diff --git a/src/frontend/app.rs b/src/frontend/app.rs
index 4c999e7..69a53c0 100644
--- a/src/frontend/app.rs
+++ b/src/frontend/app.rs
@@ -83,6 +83,9 @@ pub fn App() -> impl IntoView {
                         <Route path="/article/:title/edit/:conflict_id?" view=EditArticle />
                         <Route path="/article/:title/actions" view=ArticleActions />
                         <Route path="/article/:title/diff/:hash" view=EditDiff />
+                        // TODO: use protected route, otherwise user can view 
+                        //       /article/create without login
+                        //https://github.com/leptos-rs/leptos/blob/leptos_0.7/examples/router/src/lib.rs#L51
                         <Route path="/article/create" view=CreateArticle />
                         <Route path="/article/list" view=ListArticles />
                         <Route path="/instance/:hostname" view=InstanceDetails />