How to host Lightfall, and never think about SSL again

The answer, first

Put everything in one Cloudflare account: the site on Cloudflare Workers (its static-file hosting), the four map tile files on Cloudflare R2 (its file storage), and the domain on Cloudflare too. That is already the plan in SPEC §4, and the research backs it. Cloudflare's own docs say "Start new projects with Workers" [1], and Astro's guide agrees [2]. Once the domain is on Cloudflare, SSL is not a job you do: Cloudflare "handles issuance, renewal, and deployment automatically", free on every plan [24].

Why not the usual alternatives: Vercel's free Hobby plan is "restricted to non-commercial personal use only", and processing payment or advertising a product for sale counts as commercial [48]. GitHub Pages is not allowed to run "your online business, e-commerce site" [57]. On Netlify's free plan, running out of credits pauses every site on the account [54].

• The site: Workers static assets

  What

  A static Astro site needs no adapter: a small wrangler.jsonc file pointing at ./dist, built with npx astro build and published with npx wrangler deploy [2].

  Cost

  "Requests to static assets are free and unlimited" and "There is no additional cost for storing Assets" [5]. Workers Paid, if ever needed, is $5/month [4].

  Fits?

  Each file max 25 MiB; 20,000 files per version on Free [3]. The current dist/ is 128 files, the largest about 1.0 MB (checked on disk). The tiles are not in dist/.

  The catch

  A card-data clause in Cloudflare's terms for Free Services. See risks; it probably does not bite because Shopify takes the card, but that is my reading.

• The tiles: R2 with a tiles subdomain

  What

  A bucket holding the four .pmtiles files, served at something like tiles.your-domain.com. R2 supports the Range header the map reader depends on [38].

  Cost

  Storage $0.015/GB-month with 10 GB-month free; reads $0.36 per million after 10 million free a month; egress (data sent to visitors) "Free" [37]. About 362.2 MiB of tiles fits inside the free storage (arithmetic).

  Why not in the site

  nyc-region-z15.pmtiles is 326.4 MiB, over Workers' 25 MiB per-file cap [3]. No Cloudflare doc says Workers static assets answer range requests either [6][9].

  The catch

  How many range requests one map visit makes has not been measured, so the read bill is an estimate (table below).

• Domain and SSL: Cloudflare

  What

  Buy the domain at Cloudflare Registrar, or buy it elsewhere and point its nameservers at Cloudflare [32][23]. Then attach it to the Worker as a Custom Domain: "Cloudflare will create DNS records and issue necessary certificates on your behalf" [21].

  Cost

  Registrar charges "what is paid to the registry... No markup" [31]. A third-party tracker lists .com at $10.46 a year to register and renew [34]; Porkbun lists .com at $11.08 [35]. Universal SSL certificates: free [24].

  Renewals

  Certificates last 90 days and auto-renew from 30 days before expiry; Cloudflare picks the certificate authority [25]. Domain auto-renew is on by default [32].

  The catch

  A Cloudflare Registrar domain must use Cloudflare nameservers while it stays there [32]. Official per-extension prices were not fetched from Cloudflare itself; its product page says you "See registration, transfer, and renewal prices upfront" [33].

The easiest path, step by step

1. Pick and buy a domain. Easiest: Cloudflare Registrar, so DNS is already in the right place [32]. If you buy elsewhere, onboard it: Domains, Onboard a domain, enter the root domain, pick a plan, review DNS records, then paste Cloudflare's nameservers at the registrar [22]. Turn DNSSEC off at the registrar first, and allow up to 24 hours [23].
2. Create an R2 bucket and upload the four tile files. Connect tiles.your-domain as the bucket's Custom Domain (R2, bucket, Settings, Custom Domains, Add) [39], and add a CORS policy so the site may read it [40][41]. Details in the tiles section.
3. Add one config file, wrangler.jsonc, pointing at ./dist [2]. (A repo change, so it is a suggestion; not made.)
4. Connect the GitHub repo. Workers & Pages, select the Worker, Settings, Builds, Connect, then push a commit [10]. Set the tile address as a Build variable, because Astro bakes it in at build time [11][18].
5. Attach the domain to the Worker. Settings, Domains & Routes, Add, Custom Domain [21]. Add a www redirect rule [29].
6. Switch on Always Use HTTPS [26], and consider HSTS with a short max-age [27]. The certificate itself needs nothing from you [24].
7. Run the launch checklist: security headers, the tile range test, the card-data question, the real domain in astro.config.mjs.

What it costs each month

Bottom line (arithmetic on the rows above): about $10.46 a year for the domain, and $0 a month while traffic stays inside the free allowances. Realistic ceiling at launch: $5 a month if you take Workers Paid, plus $5 to $7 for email you can send from. One honest gap: no fetched page literally states "the Cloudflare Free plan costs $0"; the docs call it the Free plan and the terms call it "Free Services" [19].

Words used here

Static site

Plain files (HTML, CSS, JavaScript, images) built ahead of time. No server program runs when someone visits. Lightfall's build is static.

Host

The company whose computers hand those files to visitors.

CDN (content delivery network)

Copies of your files kept in data centres around the world, so each visitor gets them from somewhere nearby.

Cloudflare Workers / static assets

Cloudflare's app platform. "Static assets" is its feature for serving plain files like Lightfall's.

Cloudflare R2

Cloudflare's file storage (a "bucket" of files), used here for the big map tile archives.

Domain / registrar

Your address on the web (like lightfall.com). A registrar is the shop you rent it from, yearly.

DNS

The internet's phone book. It turns a name into the address of the computer that answers for it.

Nameservers

The company whose phone book is in charge of your domain. Pointing nameservers at Cloudflare hands it that job.

Zone

Cloudflare's word for one domain added to your account, with all its DNS records.

Apex (root) domain

The bare name, your-domain.com, with nothing in front.

Subdomain

A name in front of the apex: www.your-domain.com, tiles.your-domain.com.

CNAME record

A DNS record that says "this name is an alias of that other name".

SSL / TLS certificate

TLS is the encryption behind the padlock and https. The certificate proves the site is really yours. SSL is the old name people still use.

Certificate authority (CA)

The organisation that issues certificates, such as Let's Encrypt.

HSTS

A header telling browsers "only ever use https for this site", remembered for a set time.

DNSSEC

A signature on DNS answers. It must be off while you move nameservers, or the domain can go dark.

Egress

Data sent out of a provider to visitors. Many storage services charge for it; R2 does not.

Byte-range request

Asking for part of a file ("bytes 1,000 to 5,000") instead of all of it. The map reads small pieces of a 91 MiB archive this way.

PMTiles

One big file holding every map tile, read by byte-range requests instead of millions of small files.

CORS

A browser rule: a page may only read data from another address if that address says it is allowed. The tiles subdomain counts as another address.

Preview deploy

A private test copy of the site at its own URL, built from a branch, that does not change the live site.

Build variable

A setting read while the site is being built, then baked into the files. Different from a runtime variable, which a server reads on each visit.

CSP (Content Security Policy)

A header listing where a page may load scripts, images and data from, which blunts injected code.

Headless Shopify

Lightfall's own pages are the shop front; Shopify runs only the cart, checkout and orders behind them.

Hosting platforms compared

The questions that matter for Lightfall: may a site that sells prints use the cheap tier, where can a 91 MiB tile file live, is HTTPS automatic, and do pushes to GitHub deploy with previews. "Not verified" means the fact-checker did not find it on a fetched page, not that the answer is no.

Why Cloudflare wins for Lightfall (judgement): it is the only option where the site, the tiles, the domain, DNS and certificates sit in one account with free egress, and the plan SPEC §4 already chose. AWS S3 plus CloudFront is the credible runner-up for tiles (documented Range caching), at the price of a second vendor and more moving parts.

Domain, DNS and SSL, in plain English

When someone types your address, their browser asks DNS where it lives. Your domain's nameservers answer. If those nameservers are Cloudflare's, Cloudflare answers with its own servers, shows the browser a certificate proving the site is yours, and hands over the page over an encrypted connection. So the one decision that makes SSL effortless is letting Cloudflare run the domain's DNS.

Buying the domain

If the domain is bought somewhere else

1. In Cloudflare: Domains, Onboard a domain, enter the apex domain (for example example.com), choose how to add DNS records, Continue, select a plan [22].
2. Review the DNS records Cloudflare found [22].
3. At your registrar, turn DNSSEC off first: "Changing nameservers while DNSSEC is active can cause your domain to become unreachable" [23].
4. Replace the registrar's nameservers with Cloudflare's, copied exactly: "If their names are not copied exactly, your DNS will not resolve correctly." Then "Wait up to 24 hours" [23]. Full setup is the only option on the Free plan [23].
5. Complete the SSL/TLS setup step [22]. Certificates are "issued after your domain is active on Cloudflare"; no issuance time is given [24].

Pointing the domain at the site

• Apex on the Worker: Workers & Pages, select the Worker, Settings, Domains & Routes, Add, Custom Domain, enter the domain. Cloudflare creates the DNS record and certificate. It must be an active zone you own; it fails on a hostname that already has a CNAME record; wildcards are not supported [21].
• www is a separate hostname. A Worker on example.com does not receive www.example.com [21]. Cloudflare's template redirects https://www.* to https://${1} with a 301 and the query string kept [29]; the www hostname needs a proxied DNS record for the redirect to run [30].
• tiles subdomain on R2: added from the bucket, not the Worker (see tiles). Universal SSL covers the apex and first-level subdomains like www and tiles; deeper names (a.b.example.com) need Total TLS or Advanced certificates [24].

SSL: what Cloudflare does, and the two switches you own

• Certificates: "free, unshared, publicly trusted", Domain Validated, and Cloudflare "handles issuance, renewal, and deployment automatically" [24]. Validity 90 days; renewal starts 30 days before expiry; "Cloudflare controls the validity periods and certificate authorities" [25].
• Industry change, no action needed: Let's Encrypt moves its default certificates to 64 days on 10 Feb 2027 and 45 days on 16 Feb 2028, and says manual renewal "is not recommended" [28]. With Cloudflare renewing for you, this is background.
• Switch 1, Always Use HTTPS (SSL/TLS, Edge Certificates; every plan): redirects every http request to https. It "does not resolve issues with mixed content" (an https page loading an http file) [26]. The redirect status code is not stated.
• Switch 2, HSTS: max-age from 1 to 12 months, with includeSubDomains, preload (needs 12 months) and No-Sniff options. Warning from the doc: remove HTTPS before max-age runs out and "your website becomes inaccessible to visitors" [27]. My advice (judgement): start at 1 month, leave preload off until the site has run cleanly for a while.

The map tiles: R2, and the alternatives

Why all four go to R2, not just the big one. The only mention of Range in the Workers static-assets headers doc is a cache-control condition [6], and the one match in the asset-worker source is that same condition (utils/headers.ts:60) [9]. No doc says a partial response (206) comes back. R2's GetObject lists "Range" as supported [38]. The code already treats the tile location as one base address for all four files (src/lib/map/tile-url.ts), so splitting them would mean two settings.

Setting up the bucket

1. Upload the four files without Content-Encoding. If Cloudflare has to decompress an encoded response "it ignores Range" and sends the whole body as 200 OK [44]. Protomaps suggests rclone for files over 300 MB [42]; these are all under.
2. Custom domain: R2, bucket, Settings, Custom Domains, Add, enter the domain, Continue, review the DNS record, Connect Domain, wait for Initializing to become Active. The domain must be a zone "in the same account as the R2 bucket" [39].
3. Leave the r2.dev address off: it is "rate-limited and should only be used for development purposes". Disable under Settings, Public Development URL (type "disallow"). Do not point a CNAME at r2.dev: "an unsupported access path" [39].
4. CORS policy: R2, bucket, Settings, CORS Policy, Add CORS policy, JSON tab, Save [40]. Protomaps' recommended values are GET and HEAD, headers range and if-match, expose etag, max age 3000 [41]. Origins are scheme://host with no path; changes can take up to 30 seconds, and cached files on a custom domain keep old headers until the cache is purged [40].
5. Cache Rule for .pmtiles. Free plans cache files up to 512 MB, but PMTILES is not on the default cached-extension list, so it needs a Cache Rule (Free allows 10) [43][45]. The exact rule settings were not researched. Cloudflare aligns range fetches to 1 MiB cache blocks, and "On a cold cache miss, the first origin request also omits Range" [44].

[
  {
    "AllowedOrigins": ["https://your-domain.com"],
    "AllowedMethods": ["GET", "HEAD"],
    "AllowedHeaders": ["range", "if-match"],
    "ExposeHeaders": ["etag"],
    "MaxAgeSeconds": 3000
  }
]

Draft, untested: Cloudflare's dashboard JSON shape [40] filled with Protomaps' values [41]. The Wrangler command-line format is different (it wraps rules in {"rules":[...]}) [40]. Add every origin that must show the map (see preview deploys in risks).

What the reads could cost

Protomaps says "each Range tile request will count as a GET" [41]; GetObject is a Class B operation [37]. Nobody has measured how many range requests a Lightfall visit makes, so the numbers below are assumptions, for scale only.

Latency, a third-party claim: Protomaps writes that R2 "is known to have higher latency (500ms or higher) than other Cloud Storage products, but lower storage and no egress costs" [42]. That is not a Cloudflare measurement. Protomaps' optional Worker in front of R2 serves individual tiles and needs to sit on your own domain for caching [42]; Lightfall reads whole archives, so a plain R2 custom domain matches today's code.

Alternatives for the tiles

Deploys from GitHub, and preview links

The goal: push to main and the live site updates; push any other branch and you get a private preview link. Cloudflare's version of this is Workers Builds.

{
  "name": "lightfall",
  "compatibility_date": "YYYY-MM-DD",
  "assets": { "directory": "./dist" }
}

Astro's example uses the name my-astro-app; "lightfall" is my suggestion. Astro also shows "not_found_handling": "404-page" for a custom 404 [2]; Lightfall has no 404 page today (checked: no src/pages/404.astro). This file is not in the repo; adding it is a suggestion.

1. Connect: Workers & Pages, select the Worker, Settings, Builds, Connect, follow the prompts, push a commit [10].
2. Settings: Git branch defaults to main; build command optional (Astro's guide: npx astro build; Lightfall's npm run build is astro build); deploy command defaults to npx wrangler deploy [11][2].
3. Previews: non-production branches run npx wrangler versions upload by default, which makes a preview version without promoting it [11]. "Every time you create a new version of your Worker, a unique static version preview URL is generated automatically" [13].
4. Limits: Free 3,000 build minutes/month, 1 build at a time; Paid 6,000 minutes then $0.005/minute, 6 at a time; builds time out at 20 minutes on both [12].

Honest comparison: Cloudflare rates Workers' branch deploy controls as partial next to Pages, saying Workers Builds "does not yet have the same level of configurability as Pages does" [8]. The configuration page says nothing about PR comments or GitHub checks [11]. If an automatic comment with the preview link on every pull request matters, Firebase documents exactly that [69]; for Lightfall I would still take Workers (judgement).

Analytics: Cloudflare Web Analytics is "Available on all plans" [16], but the one-click setup documented is for a Pages project (Metrics, Enable) [15]; setup for Workers static assets is not documented on the page fetched. No limit on sites proxied through Cloudflare [17].

Security headers, and keeping /admin out

Headers are instructions sent along with each file. On Workers static assets you set them in a plain-text _headers file in public/: up to 100 rules, 2,000 characters per line; they do not apply to responses generated by Worker code [6]. A _redirects file works the same way (2,000 static plus 100 dynamic redirects) [7]. Lightfall has neither file today (checked with ls).

/*
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: no-referrer
  Permissions-Policy: document-domain=()
  Content-Security-Policy-Report-Only: default-src 'self'; worker-src 'self'; img-src 'self' data: blob:; connect-src 'self' https://tiles.your-domain.com; frame-ancestors 'none'

• The first four lines are the examples in Cloudflare's headers doc [6]. nosniff stops browsers guessing file types; DENY stops other sites framing yours.
• CSP belongs in a header, not a meta tag: frame-ancestors and Report-Only cannot be set with <meta>. connect-src governs fetch(), which is how tile range reads travel [75].
• MapLibre's needs: worker-src 'self' and img-src data: blob: 'self', and with a strict CSP use setWorkerUrl [76]. Lightfall already calls it (src/lib/map/globe.ts:74, checked).
• Start Report-Only. The draft only reports violations, it blocks nothing. What Astro's build inlines (scripts, styles) was not researched, so an enforcing policy could break the page. When the shop is built, connect-src also needs https://{store}.myshopify.com, the Storefront API host [83].

The draft above is a starting point assembled from the cited docs, not a tested policy. Adding public/_headers is a repo change and is not made.

/admin never ships

• Already guarded. src/integrations/admin.mjs lines 132 to 139: after every build, findAdminInDist scans dist/ and throws "the built site carries admin, which must never ship". Read from the file, not run.
• Why that protects the live site: Workers Builds runs the build before deploying [10], so a build that throws never reaches the deploy step (my reading of the ordering: build command, then deploy command [11]).
• The menu only lists Admin under astro dev, so the built menu never links it (src/lib/site/menu.ts).

Environment variables

An environment variable is a setting kept outside the code, so the same code can point at localhost on your laptop and at R2 in production.

• Astro: variables "are statically replaced at build time", and only ones starting with PUBLIC_ reach code in the browser [18]. Changing the tile address means a rebuild, not a settings change on the live site.
• .env is git-ignored (.gitignore line 7) and .env.example is committed, both checked. Nothing secret is in the repo for the host to read.
• Port mismatch, found on disk: .env uses 4322, while .env.example and tile-url.ts's comment say 4321. Harmless for hosting; worth tidying so a fresh clone matches.

Does the print shop change hosting? And email

• No server needed for the shop. Shopify headless works with "any framework, tooling, or hosting" [84]. The public Storefront token is designed for the browser; the cart's checkoutUrl sends the buyer to Shopify's hosted checkout, and should be requested when the buyer is ready because it can go stale [83]. The Headless app is free [85]. Which Shopify plan is required was not verified.
• Card data: because the card is typed on Shopify's page, not Lightfall's, the Cloudflare Free Services clause on collecting card information probably does not apply. That is my reading, not Cloudflare's. An embedded card form on Lightfall itself would change that [19].
• Email forwarding (hello@your-domain): Cloudflare Email Routing, "Available on Free and Paid plans", requires Cloudflare DNS, adds MX, SPF and DKIM records, and needs the destination inbox verified [77][78]. It only forwards: "Email Routing does not support sending or replying from your Cloudflare domain" [79]. Limits: 200 rules, 25 MiB messages [80]. Strict DMARC on the sender can make forwarded mail fail [79].
• Email you can send from: Fastmail Individual $5/month billed annually ($6 monthly), 60 GB, custom domain; its Business Basic tier does not support custom domains [82]. Google Workspace Business Starter regular price $7.00/user/month [81] (the page's promo dates contradict its own fine print, so ignore the promo).

Launch checklist

Suggestions, in order. Items marked (repo) change files the site's engineers own; none were made. Account creation and spending are Jake's call.

1. Decide the card-data question: confirm with Cloudflare that a Free-plan site sending buyers to Shopify's checkout is fine under §2.2.1(h) [19]. Whether paying for Workers alone changes it is also unverified, since DNS, SSL and CDN would still be Free Services.
2. Domain bought, zone active on Cloudflare, DNSSEC handled [32][23].
3. R2: bucket, four files uploaded without Content-Encoding, tiles. custom domain Active, r2.dev disabled, CORS saved, Cache Rule for .pmtiles [39][40][44][43].
4. Test a range request against R2 before wiring the site: curl -I -H "Range: bytes=0-99" https://tiles.your-domain.com/world-z5.pmtiles should return only the requested bytes (status 206 Partial Content is the HTTP standard's answer; not taken from a fetched page). Look for Cf-Cache-Status: HIT on a repeat [42]. (A test to run; not run.)
5. Measure range requests per map visit in the browser's Network tab, then redo the cost table with the real number.
6. (repo) wrangler.jsonc with assets.directory ./dist [2].
7. (repo) astro.config.mjs: change site from https://lightfall.example (checked, line 27) to the real domain.
8. Workers Builds connected to the private repo; PUBLIC_TILE_URL set as a Build variable [10][11]. Check the first build log for the Node version (see risks).
9. Custom Domain on the Worker for the apex; proxied www record plus the 301 redirect rule [21][29][30].
10. HTTPS: certificate shows Active, Always Use HTTPS on, HSTS at a short max-age with preload off [24][26][27].
11. (repo) public/_headers with the draft above, CSP in Report-Only; watch the console, then enforce [6][75].
12. Confirm /admin is absent on the live site (expect a 404) and that the build log shows no admin guard error.
13. Preview branch test: push a branch, open its preview URL, confirm the map loads (the CORS origins must include the preview host) [13][40].
14. Email: Email Routing for forwarding, or Fastmail/Workspace to send [77][82].

Risks, gaps and things not verified

• Card-data clause. Cloudflare's self-serve agreement: you may not "process or collect personal or business credit card information on any web property that is receiving Free Services" [19]. Checkout on Shopify's page probably keeps Lightfall clear, but Cloudflare has not confirmed that. It is the most important open question.
• Large-files clause. Outside Enterprise, Cloudflare says video and "other large files" must go through paid services such as the Developer Platform, and it may limit CDN use serving "a disproportionate percentage" of large files without them [20]. Whether R2 tiles count as the Developer Platform route is a reading, not confirmed.
• Range on Workers static assets is undocumented. Only a cache-control condition mentions Range in the docs and the asset-worker source; worker.ts and the platform edge were not read [6][9]. This is why every tile file goes to R2.
• Requests per map visit are unmeasured, so the R2 read bill is illustration. Whether Cloudflare cache hits on an R2 custom domain avoid Class B charges is not stated anywhere fetched. That "one range request = one Class B read" comes from Protomaps, not Cloudflare.
• The .pmtiles Cache Rule settings (match by extension, edge TTL) were not researched; only the Free limit of 10 rules was.
• Preview deploys and CORS. A preview URL is a different host from your domain; unless the bucket's CORS list includes that host, the map will not load on previews. The exact preview hostname was not captured, and this is my reading of how CORS applies, untested.
• Node version on Workers Builds was not researched. Lightfall's scripts rely on Node stripping TypeScript types (lint-type.mjs says Node 25; this machine runs v25.9.0) and the repo pins no version (no .nvmrc, no engines field). If astro build touches those paths on an older Node, the first build could fail.
• Timings not stated: zone activation and Universal SSL issuance times are not given; the nameserver change says up to 24 hours.
• Whether zone HSTS and Always Use HTTPS apply to Workers Custom Domain responses is not stated in either doc. Check with a browser after launch.
• R2 latency of "500ms or higher" is Protomaps' claim, not measured by Cloudflare or by us. The globe's first paint could feel it.
• Registrar lock-in: a Cloudflare Registrar domain cannot use another DNS provider while it stays there. Moving means transferring the domain.
• Official Cloudflare Registrar prices were not fetched from Cloudflare (where its per-extension price list lives was not established); .com $10.46 comes from a third-party tracker. Namecheap was not verified (403). .nyc eligibility rules were not verified.
• "Free plan costs $0" is not literally stated on any page fetched, and the original claim was dropped by the fact-checker for that reason.
• Web Analytics for Workers static assets: automatic setup is documented for Pages only; no price stated beyond "Available on all plans".
• Shopify: the required Shopify plan and price, the Headless app's plan list and how Prodigi connects were not verified.
• Other hosts' gaps: Netlify's terms not fetched; Vercel, Firebase, Render, DigitalOcean and Amplify have no Range or per-file documentation in what was fetched; Render plan prices not retrieved.
• Google Workspace's promo window (28 Sep to 28 Dec 2026) starts after today and conflicts with its own "12 months" fine print; only the $7.00 regular price is quoted.
• Extraction, not raw pages: the fetch tool returns a model's reading of each page. Quotes matched on re-fetch, but word-for-word accuracy is not guaranteed.
• Search budget: web search ran out (200 of 200); later checks used direct fetches and a GitHub API code search.

How this was researched

Verified finding records

69

Claims rejected

18

Sources cited

85

Research areas

2

Two research areas (hosting platforms; domain, DNS, SSL, tiles, email, security and shop) each had a researcher and then an adversarial fact-checker who re-fetched every page, corrected wrong figures and sources, and dropped anything not on the page. 18 claims were rejected and none appear here. Some of the 69 records are the same page checked by both areas.

Official docs and pricing pages were preferred. Third-party pages are labelled: cfdomainpricing.com (prices) and Protomaps (a map-tile project whose docs make claims about providers). Facts about the Lightfall repo (tile sizes, file counts, admin guard, headers files, env files, ports) were read on disk on the same day, not fetched. Retrieval dates are recorded as 2026-09-15 as instructed; one researcher's system clock read 2026-09-14.

Sources

Cloudflare: hosting the site

1. Cloudflare Pages docs (banner recommending Workers) · retrieved 2026-09-15
2. Astro docs — Deploy your Astro site to Cloudflare · retrieved 2026-09-15
3. Cloudflare Workers — Limits · retrieved 2026-09-15
4. Cloudflare Workers — Pricing · retrieved 2026-09-15
5. Cloudflare Workers static assets — Billing and limitations · retrieved 2026-09-15
6. Cloudflare Workers static assets — Headers · retrieved 2026-09-15
7. Cloudflare Workers static assets — Redirects · retrieved 2026-09-15
8. Cloudflare — Migrate from Pages to Workers · retrieved 2026-09-15
9. cloudflare/workers-sdk source — asset-worker utils/headers.ts (read via GitHub API) · retrieved 2026-09-15
10. Cloudflare Workers Builds · retrieved 2026-09-15
11. Cloudflare Workers Builds — Configuration · retrieved 2026-09-15
12. Cloudflare Workers Builds — Limits and pricing · retrieved 2026-09-15
13. Cloudflare Workers — Preview URLs · retrieved 2026-09-15
14. Cloudflare Pages — Limits · retrieved 2026-09-15
15. Cloudflare Web Analytics — Get started · retrieved 2026-09-15
16. Cloudflare Web Analytics — Overview · retrieved 2026-09-15
17. Cloudflare Web Analytics — Limits · retrieved 2026-09-15
18. Astro docs — Using environment variables · retrieved 2026-09-15
19. Cloudflare Self-Serve Subscription Agreement (updated 12 Sept 2025) · retrieved 2026-09-15
20. Cloudflare Service-Specific Terms — Application Services (CDN) · retrieved 2026-09-15

Domain, DNS and SSL

21. Cloudflare Workers — Custom Domains · retrieved 2026-09-15
22. Cloudflare — Onboard a domain · retrieved 2026-09-15
23. Cloudflare DNS — Full setup · retrieved 2026-09-15
24. Cloudflare SSL — Universal SSL · retrieved 2026-09-15
25. Cloudflare SSL — Certificate validity periods · retrieved 2026-09-15
26. Cloudflare SSL — Always Use HTTPS · retrieved 2026-09-15
27. Cloudflare SSL — HTTP Strict Transport Security (HSTS) · retrieved 2026-09-15
28. Let's Encrypt — From 90 to 45 days · retrieved 2026-09-15
29. Cloudflare Rules — Redirect www to root · retrieved 2026-09-15
30. Cloudflare Rules — Create a Single Redirect in the dashboard · retrieved 2026-09-15
31. Cloudflare Registrar docs — Overview · retrieved 2026-09-15
32. Cloudflare Registrar docs — Register a domain · retrieved 2026-09-15
33. Cloudflare — Registrar product page · retrieved 2026-09-15
34. cfdomainpricing.com by NameBeta (third party, not Cloudflare; updated 2026-09-14) · retrieved 2026-09-15
35. Porkbun — Domains · retrieved 2026-09-15
36. Google Domains (moved to Squarespace) · retrieved 2026-09-15

Map tiles and storage

37. Cloudflare R2 — Pricing · retrieved 2026-09-15
38. Cloudflare R2 — S3 API compatibility · retrieved 2026-09-15
39. Cloudflare R2 — Public buckets · retrieved 2026-09-15
40. Cloudflare R2 — Configure CORS · retrieved 2026-09-15
41. Protomaps — PMTiles on cloud storage · retrieved 2026-09-15
42. Protomaps — Deploy on Cloudflare (third-party claims labelled) · retrieved 2026-09-15
43. Cloudflare Cache — Default cache behavior · retrieved 2026-09-15
44. Cloudflare Cache — Range requests · retrieved 2026-09-15
45. Cloudflare Cache — Cache Rules · retrieved 2026-09-15
46. Backblaze B2 — Pricing · retrieved 2026-09-15
47. GitHub Docs — About large files on GitHub · retrieved 2026-09-15

Other hosts compared

48. Vercel — Fair use guidelines (updated 2026-07-29) · retrieved 2026-09-15
49. Vercel — Pro plan · retrieved 2026-09-15
50. Vercel — Pricing · retrieved 2026-09-15
51. Vercel — Limits · retrieved 2026-09-15
52. Vercel — Working with SSL · retrieved 2026-09-15
53. Netlify — Pricing · retrieved 2026-09-15
54. Netlify — Billing FAQ for credit-based plans · retrieved 2026-09-15
55. Netlify — HTTPS (SSL) · retrieved 2026-09-15
56. Netlify — Custom headers · retrieved 2026-09-15
57. GitHub Docs — GitHub Pages limits · retrieved 2026-09-15
58. GitHub Docs — Securing your GitHub Pages site with HTTPS · retrieved 2026-09-15
59. AWS Amplify — Pricing · retrieved 2026-09-15
60. AWS Amplify — Quotas · retrieved 2026-09-15
61. AWS Amplify — Using SSL/TLS certificates · retrieved 2026-09-15
62. AWS Amplify — Web previews for pull requests · retrieved 2026-09-15
63. Amazon S3 — Website endpoints · retrieved 2026-09-15
64. Amazon CloudFront — Range GETs · retrieved 2026-09-15
65. Amazon CloudFront — Pricing (flat-rate plans) · retrieved 2026-09-15
66. Amazon CloudFront — Pay-as-you-go pricing · retrieved 2026-09-15
67. Amazon S3 — Pricing · retrieved 2026-09-15
68. Firebase Hosting — Usage, quotas and pricing · retrieved 2026-09-15
69. Firebase Hosting — GitHub integration · retrieved 2026-09-15
70. Firebase Hosting — Connect a custom domain · retrieved 2026-09-15
71. Render — Outbound bandwidth · retrieved 2026-09-15
72. Render — Static sites · retrieved 2026-09-15
73. DigitalOcean — App Platform pricing · retrieved 2026-09-15
74. DigitalOcean — App Platform limits · retrieved 2026-09-15

Security, email and the shop

75. MDN — Content Security Policy (CSP) · retrieved 2026-09-15
76. MapLibre GL JS docs (CSP directives) · retrieved 2026-09-15
77. Cloudflare Email Routing — Overview · retrieved 2026-09-15
78. Cloudflare Email Routing — Enable Email Routing · retrieved 2026-09-15
79. Cloudflare Email Routing — Postmaster · retrieved 2026-09-15
80. Cloudflare Email Routing — Limits · retrieved 2026-09-15
81. Google Workspace — Pricing · retrieved 2026-09-15
82. Fastmail — Pricing · retrieved 2026-09-15
83. Shopify dev — Storefront API (includes cart and checkoutUrl) · retrieved 2026-09-15
84. Shopify dev — Headless storefronts · retrieved 2026-09-15
85. Shopify App Store — Headless · retrieved 2026-09-15