Host your site free on Cloudflare Pages — and actually lock it down
Owning a domain and paying for hosting are two different things. If your site is static — a portfolio, a landing page, docs, a small business site — you can host it on Cloudflare Pages for free, on your own domain, with HTTPS included. The catch most people miss: "free and online" isn't the same as "safe." A few minutes of hardening closes the easy holes.
The free hosting part
- Cloudflare → Pages → Create a project. Connect a Git repo or upload your built site (your
dist/orpublic/folder). - Add your domain under Custom domains. Cloudflare proxies it automatically and issues an SSL certificate.
- Set SSL/TLS to "Full (strict)" and turn on "Always Use HTTPS."
That's a live, HTTPS, globally-cached site for $0. Now make it hard to abuse.
Two layers of hardening
1. Security headers. A _headers file in your site root ships a strict Content-Security-Policy, HSTS, anti-clickjacking, no-sniff and a tight Referrer-Policy on every response. It's the difference between a browser trusting your site and a browser letting an attacker inject into it.
2. Five WAF rules. Cloudflare's free plan gives you five custom WAF rules. Against a static site that's plenty, because a static host has no database and no server code to exploit — you're just filtering noise. The five that matter:
- Method lockdown — a static site only needs GET/HEAD. Block POST, PUT, DELETE and the rest outright.
- Bot sieve — challenge non-verified bots, while letting real search crawlers through so your SEO is untouched.
- Region gate — allow the countries you actually serve; challenge the rest.
- Exploit-path block — requests for
/wp-admin,/.env,/.git/and friends are always hostile on a static host. - Rate limit — cap requests per IP to blunt scrapers and floods.
"But the rules are public — won't attackers just dodge them?"
This is the important part. Good rules don't rely on being secret. Each of these keys on a signal an attacker can't forge for free — the HTTP method, whether Cloudflare verified them as a real search bot, the country of their IP, the path they asked for, their request rate. And they layer: slipping past one still leaves the other four, in front of an origin that has nothing to hack. Security through obscurity fails the moment someone reads your config; security through hard signals doesn't care if they do.
Generate your config
The free Cloudflare Pages Hardener writes all five rule expressions (with your countries and rate limit filled in) plus a step-by-step deploy checklist — copy, paste, done. Pair it with the Security Headers tool for the _headers file, and your free site is in better shape than most paid ones.