How to Publish a Fast, Secure Website for the Cost of a Domain

This site used to run on traditional shared web hosting. It now runs on GitHub and Cloudflare, and the only thing we pay for is the domain name. Here’s how it fits together, in case you want a site for your own projects.

What each piece does

• GitHub stores the site and every past version of it. GitHub’s free personal plan includes unlimited private repositories.
• Astro turns simple Markdown text files into finished web pages.
• Cloudflare Workers hosts those pages. On the free plan, requests for static files are free and unlimited. Requests that run code, such as a form submission, are limited to 100,000 per day.
• Workers Builds rebuilds and publishes the site whenever new work reaches GitHub. The free plan includes 3,000 build minutes a month.
• Pagefind adds site search that runs in the visitor’s browser, so there’s no search server.
• Cloudflare Universal SSL provides the HTTPS certificate for free and renews it automatically.
• Cloudflare Turnstile and Email Routing protect the contact form from bots and deliver messages to our inbox. Turnstile’s free plan has no limit on verifications, and sending to your own verified address is free.

How publishing works

Each post is one Markdown file with a title, date, summary, tags and source links. Add the file, push it to GitHub, and it’s live about a minute later.

Pages are built ahead of time and served from Cloudflare’s network, so nothing has to be assembled for each visitor. That’s where most of the speed comes from.

Why it’s safer

A traditional site often has a login page, plugins and a database that all need constant updates. A static site has none of those exposed to the internet, which leaves far less to attack.

Less to attack doesn’t mean nothing to protect, so these habits still matter:

• Keep secrets out of your code. Even in a private repository, passwords and API keys don’t belong in files. Store them as Workers secrets, which can’t be viewed again once set. Some values are meant to be public. Turnstile has a public site key that belongs in your page and a secret key that never should.
• Protect your accounts. Turn on two-factor authentication for GitHub, Cloudflare and your domain registrar. Anyone who gets into one of those can change your site.
• Limit access. When you connect Cloudflare to GitHub, grant access only to the repository it needs.
• Review before you publish. Anything that lands on your main branch goes live, so check changes first, especially automated ones.
• Keep a second copy. GitHub is already an offsite copy. A second one on your own storage costs nothing.

The basic steps

1. Buy a domain, or use one you already own.
2. Add the domain to a free Cloudflare account and change its nameservers at your registrar.
3. Create a private GitHub repository and build your site in it.
4. Create a Cloudflare Worker with static assets and connect it to the repository.
5. Attach your domain to the Worker as a custom domain.
6. Set up the contact form, then send yourself a real test message.

Tying it together with an AI tool

None of this requires being a web developer, especially with an AI coding tool to do the heavy lifting. We used Claude Code, which works directly in your project folder, but the same idea applies to similar tools.

Here’s where it helped most:

• Building the site. You describe what you want, and it writes the pages, styling and configuration, then builds and tests the result.
• Walking through setup. The Cloudflare and domain steps happen in dashboards, so it can tell you what to click and check whether a change actually worked.
• Remembering the project. A short instructions file in the repository records how the site is organized and how posts are formatted, so each new session starts with that context.
• Handling routine publishing. Scheduled AI tasks can watch for news and draft posts, then open a pull request on GitHub. Nothing goes live until you read it and merge it.
• Double-checking the work. It can compare a draft against its sources and flag claims that go further than the source does.

AI tools make mistakes, and they can sound confident while doing it, so a few ground rules help:

• Keep credentials to yourself. Do your own sign-ins and enter secret keys directly into Cloudflare, rather than pasting them into a chat.
• Be specific about accounts and scope. Tell it which account and project to use, and have it ask before anything hard to undo, like deleting records or files.
• Stay the final approver. Read posts and check important facts before they’re published. The tool can do the work, but the site is still yours.

When this isn’t the right fit

This approach suits blogs, project logs, portfolios and small business sites. If you need user accounts, a store or a lot of custom server code, you’ll need more than static pages, and the free limits may matter.