@iamtakingiteasy @Yoruka @sally @Zergling_man Unfortunately that uses one line of JavaScript instead of none.

You only need one line of JavaScript to deny access;
document.body.innerHTML = 'We have detected that you have JavaScript enabled in your browser, please disable it to continue. Please be aware that your browser has a severe vulnerability, as it performs remote code execution of malicious JavaScript automatically.';


I'm interested if there's a CSS technique that can be used to cover up the page only if JavaScript is enabled, but without actually using a single line of JavaScript (considering the depraved featureset of browsers I figure it's possible).