Ad-Hoc Web Deploy Primer

1 · TL;DR — the one-paragraph version

2 · Platform comparison

The "who hosts my HTML" decision. Below: the platforms that matter, ranked by fit for ad-hoc bespoke work.

3 · Costs — what you actually pay

The "free forever" zone (Cloudflare Pages free tier)

What you'd pay if you exceed free tier

Real-world cost projection — Lou's hub vision

If loudog.uno/share/{person}/{project} hosts 10 personal projects with ~500 visitors/mo each and 10GB of total media:

4 · Deploy methods — the 5 levels of agency

5 · The supporting stack

HTML hosting is one piece. Real sites need more. Here's the full Cloudflare stack — you can mix-and-match per project.

An "expert" site recipe for the loudog.uno hub:

// Mom hub at loudog.uno/share/mom/
Cloudflare Registrar → loudog.uno              # $30/yr
Cloudflare Pages    → loudog-uno project       # static HTML + JSON index
Pages Functions     → routing, signed URLs     # dynamic mom/* routes
Cloudflare R2       → media bucket             # photos, videos, audio
Cloudflare Access   → email-OTP gate           # mom + 5 family emails
D1                  → site_metadata.db         # content index, when added

6 · Security

The three privacy levels for the URL you ship

Token hygiene (what you're setting up right now)

• Scope minimally. A token that only needs to deploy Pages shouldn't have DNS edit. One token per use-case if you can stomach it.
• Rotate. Quarterly is fine. Cloudflare tokens are immortal until you delete them.
• Store outside of repos. ~/.zshrc, ~/.config/cloudflare/token with chmod 600, or 1Password. Never in .env committed to git.
• Use IP filtering when you can. CF token UI offers "Client IP Address Filtering" — restrict to your home IP if you're not traveling.
• Audit logs. Dashboard → Manage Account → Audit Logs shows every token-authed action. Check after suspicious activity.

The "robots.txt is not security" reality check

Some agents and crawlers ignore robots.txt. Internet Archive (Wayback) historically respected it; some AI scrapers don't. If the content can't ever be seen by strangers, use real auth. robots.txt + URL obscurity is "soft" privacy at best.

Headers and CORS

Cloudflare Pages defaults are pretty open. If your project has data endpoints or scripts that you don't want loaded from other domains, add a _headers file at the root of your deploy:

# _headers
/*
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Content-Security-Policy: default-src 'self'

/api/*
  Access-Control-Allow-Origin: https://loudog.uno

7 · Workflow patterns

8 · What "expert" looks like (cheatsheet)

The mental model of someone who can deploy any bespoke page in under 60 seconds:

Environment

# In ~/.zshrc:
export CLOUDFLARE_API_TOKEN="..."      # broad token, see Agentic Pipeline doc §5A
export CF_ACCOUNT_ID="..."           # your account id
alias cfdeploy="npx wrangler pages deploy . --project-name=$(basename $(pwd))"

The starter template (keep this around)

# ~/templates/static-site/
.
├── index.html        # your page
├── _headers          # security headers
├── robots.txt        # Disallow: / if private
├── functions/
│   └── _middleware.js   # password gate, if needed
└── README.md         # notes for future-you

The five commands you actually need

## 1. New deploy
npx wrangler pages project create $NAME --production-branch=main
npx wrangler pages deploy . --project-name=$NAME --commit-dirty=true

## 2. Custom domain (once CF token has Zone:DNS:Edit)
curl -X POST -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT_ID/pages/projects/$NAME/domains \
  -d '{"name":"sub.loudog.uno"}'
curl -X POST -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records \
  -d '{"type":"CNAME","name":"sub","content":"$NAME.pages.dev","proxied":true}'

## 3. Tail logs (debugging Functions)
npx wrangler pages deployment tail --project-name=$NAME

## 4. Delete project (clean up throwaways)
npx wrangler pages project delete $NAME

## 5. List everything
npx wrangler pages project list

Decision tree

Need a public page now?
  → YES: Pages, no functions, deploy

Need auth?
  → 1 password OK: add functions/_middleware.js cookie gate
  → real user identity: switch to Cloudflare Access (free < 50 users)

Need dynamic logic (API, form, db read)?
  → Light: Pages Functions
  → Heavy: standalone Worker

Need to store files > 1MB?
  → Public: R2 public bucket + Cache-Control
  → Private: R2 + signed URLs via Worker

Need a custom domain?
  → On Cloudflare: register via Registrar, auto-bind via Pages domains API
  → Elsewhere: add CNAME at your DNS host pointing to project.pages.dev

Going to maintain this for > 1 month?
  → Git-connect the project, never run wrangler again

9 · Common footguns & fixes

Document built 2026-05-11 · for Lou DeSantis · by Sai (claude-opus-4-7).
Companion to Agentic Cloudflare Pipeline.
Pricing/limits are current as of 2026-01 and may change — verify on each vendor's pricing page before committing infrastructure decisions.