sevalla.com Paid content

Static site hosting stores pre-built files — HTML, CSS, JavaScript, images — and serves them to visitors exactly as they are. There is no server-side rendering, no database query, and no application process generating a page per request. You upload files, the web server returns them. That makes static hosting the simplest and usually the cheapest way to put a website online, and it is a good fit if your content changes occasionally rather than per visitor.

The trade-off is that anything requiring per-user or per-request logic — logins, shopping carts, comment systems, form processing — has to be handled elsewhere (a third-party service, a serverless function, or client-side JavaScript). If your site is a blog, documentation, portfolio, brochure, or project page, static hosting usually covers it.

How static hosting works

1. You build or write your site locally. Output is a folder of files, typically with an index.html at the root.
2. You upload that folder to the host — by FTP/FTPS, a web uploader, a WYSIWYG editor, or a Git-based workflow depending on the host.
3. The host's web server maps a request for https://example.com/about/ to a file such as /about/index.html and returns it over HTTP or HTTPS.
4. If no index file exists in a directory, behavior depends on configuration. Many hosts enable autoindex, which shows a file listing instead of a 404 — effectively a browsable "web FTP" view of that folder.

Because nothing is generated at request time, the server does very little work per visit. That is why static sites tend to load fast and stay up under traffic spikes.

Static vs dynamic hosting

The choice is not absolute. Some hosts allow both: Web 1.0 Hosting, for example, describes itself as static-first but notes that dynamic scripts using PHP, Python, or blog engines are permitted, and it offers an L2TP/IPsec tunnel so you can run your own web server at home and expose it through the host.

What to check before choosing a static host

• Storage and traffic limits. Free tiers are common but vary widely. Web 1.0 Hosting lists 100 MB free, 500 MB for community members, extra space for donations, and unlimited traffic.
• Domain options. Look for a free subdomain and the ability to attach your own domain. Web 1.0 Hosting offers third-level names on .w10.site, .w0.am, .narod.ws, and .oldcities.org, and documents linking a custom domain in its FAQ.
• Upload methods. FTP/FTPS is the baseline. A browser uploader or WYSIWYG editor helps if you do not want to install a client. Git-based deploys matter if you want versioned, automated publishing.
• HTTPS and IP versions. Confirm both HTTP and HTTPS, and IPv4 and IPv6, if you care about reachability from older or unusual networks.
• Server-side includes (SSI). SSI lets you reuse headers, footers, and snippets across pages without a build step — useful on hosts without a static site generator.
• File-type and hotlinking policy. Some hosts restrict media or block hotlinking. Web 1.0 Hosting states no limits on file types and allows hotlinking, so you can embed your files on other sites.
• Legacy and retro support. If you want the site reachable from old browsers, palmtops, or retro computers, check whether the host targets that. Web 1.0 Hosting explicitly aims at old devices and the smallweb movement, while also permitting modern sites.

Deploying a static site: a concrete walkthrough

Assume you have a folder mysite/ containing index.html, style.css, and an images/ directory.

1. Get an account and a name. Register on the host and claim a subdomain (for example yourname.w10.site) or prepare to link your own domain.
2. Connect. Open an FTP/FTPS client, enter the host, username, and password from your account, and connect. If the host offers a browser uploader, you can skip the client.
3. Upload. Place index.html at the web root so it is served at /. Upload style.css and images/ alongside it, preserving the folder structure your HTML references.
4. Verify. Visit https://yourname.w10.site/. You should see your page. Visit a subdirectory URL to confirm index handling, and try a URL that does not exist to see the custom 404 page.
5. Link a custom domain (optional). Follow the host's FAQ: point your domain's DNS at the host, then add the domain in your account. Expect a propagation delay before it resolves.
6. Reuse code with SSI (optional). If supported, rename a shared fragment (e.g. footer.html) and include it in pages with an SSI directive, so one edit updates every page.

Common problems and fixes

• 404 on the homepage. Your entry file is not named index.html or is not at the web root. Rename it or move it.
• Directory shows a file list instead of your page. autoindex is on and that folder has no index.html. Add one, or accept the listing as a feature.
• Custom domain does not resolve. DNS records are wrong or still propagating. Recheck the records against the host's instructions and wait.
• Mixed content warnings. Your page loads assets over http:// while the site is on https://. Update links to https:// or protocol-relative URLs.
• Uploads fail or files are missing. Confirm you are in the correct directory and that the transfer completed; some clients silently skip files on permission errors.
• Old device cannot load the site. Modern CSS or JavaScript may be the cause, not the host. Test with plain HTML and minimal styling.

When a niche or retro-friendly host makes sense

Mainstream static hosts optimize for modern build pipelines and CDNs. A smaller host may instead optimize for reachability from old hardware and for the smallweb/old-web ethos. Web 1.0 Hosting is an example: it bundles a search engine, webmail, and web chat that work on both modern and legacy systems, offers a HamsterCMS website builder, and supports access by raw IP (http://135.181.118.12/~yourwebsite) when DNS is unavailable. It also allows an L2TP/IPsec connection so your own machine or server can serve a site at login.w10.site/~/ without a static IP, plus an overlay intranet for services like game servers.

Choose that kind of host if you want free space, legacy-device access, SSI, hotlinking, and a community-oriented setup. Choose a mainstream static host if you need automated Git deploys, global CDN performance, or tight integration with a modern framework. Either way, the underlying model is the same: build files, upload them, and let the server hand them out.

Cybersecurity is the practice of keeping your data, accounts, and services from being accessed, stolen, altered, or knocked offline by someone who shouldn't have them. For a personal site or small online presence, that reduces to a short list of concrete jobs: protect your login credentials, keep your software current, serve traffic over HTTPS, and lock down the domain and DNS layer that everything else depends on. You don't need an enterprise security team to cover the basics — but you do need to treat your registrar account and your hosting account as the two most valuable things you own, because whoever controls those controls the site.

What cybersecurity actually protects

It helps to separate the assets from the threats, because most small-site incidents come from a handful of causes.

The pattern: each asset has one or two controls that remove most of the risk. You don't need all of them on day one, but skipping the account and domain layers is the mistake that's hardest to undo.

The threat categories a small site actually faces

• Credential theft — reused or weak passwords, or credentials leaked from another breached service. This is the most common way small sites fall.
• Phishing — fake login pages or "your domain is expiring" emails designed to capture your registrar or hosting password.
• Malware and backdoors — usually arriving through an outdated CMS, plugin, or theme.
• DDoS — flooding a site until it's unreachable; often handled by your host or a CDN rather than by you.
• Misconfiguration — an open admin panel, directory listing, or default credentials left in place.

Notice that four of the five are about access, not exotic exploits. That's why the basics work.

Core protections to apply first

Use strong, unique passwords and a password manager

Every account tied to your site — registrar, host, CMS, email — should have a different password. A password manager makes this practical. The goal is that one leaked password can't be replayed anywhere else.

Turn on multi-factor authentication

MFA is the single highest-value control for your registrar and hosting accounts. Even if a password is stolen, an attacker without the second factor can't log in. Prefer an authenticator app or hardware key over SMS where the service supports it.

Serve everything over HTTPS

An HTTPS/TLS certificate encrypts traffic between visitors and your site and prevents browser "not secure" warnings. Most hosts and registrars offer a free certificate; the important part is that it's installed and that HTTP redirects to HTTPS.

Update promptly and keep the surface small

Apply CMS, plugin, and theme updates as they're released, and delete anything you're not using. Fewer components means fewer places for a known vulnerability to sit unpatched.

Apply least privilege

Give each person (and each integration) only the access they need. Don't run your site day-to-day from an administrator account, and don't hand out admin rights for tasks that don't require them.

Secure the domain and DNS layer

This layer is easy to overlook and expensive to lose, because a hijacked domain can point anywhere.

• Protect the registrar account with a unique password and MFA. Your registrar account is the root of control over the domain.
• Enable the registrar lock (often called a transfer lock or clientTransferProhibited) so the domain can't be moved without your action.
• Keep registrant contact email secure — that inbox is often the recovery path for the domain.
• Enable DNSSEC where your registrar and DNS provider support it, so responses can be cryptographically validated and spoofing is harder.
• Watch for unauthorized DNS changes — if records you didn't touch appear, treat it as a compromise.

Porkbun is an ICANN-accredited domain registrar, which means it operates under ICANN's registrar rules — relevant here because those rules govern transfers, locks, and registrant contact requirements. Its site lists Stripe among its payment platforms. Beyond that, check your specific registrar's and DNS provider's current feature set for lock and DNSSEC support, since availability varies.

Warning signs and first steps if something looks wrong

Watch for: unexpected DNS records, visitors reporting malware warnings, unexplained admin accounts, a sudden traffic drop, or emails about transfers you didn't request.

If you suspect a compromise:

1. Change passwords on registrar, hosting, and CMS accounts, starting with the registrar.
2. Revoke active sessions and reset MFA where possible.
3. Check DNS records against what you expect and revert unauthorized changes.
4. Restore from a known-good backup if files were altered.
5. Re-scan and update the software before reopening the site.

Containment first, then recovery — don't try to clean a live, still-compromised site.

What to outsource vs. manage yourself

Hosting-level security, CDN, and WAF are usually worth outsourcing because they require scale and constant attention. Account hygiene, MFA, updates, and domain/DNS protection are things you should keep in your own hands regardless of size — they're cheap to do and costly to skip.

Cloudflare is a global network that sits between your visitors and your origin server, caching static files and filtering malicious traffic before it reaches you. You use it by adding your domain to Cloudflare, pointing your nameservers at Cloudflare, and letting its edge network handle DNS, TLS, caching, and DDoS mitigation. The same network also powers free public CDNs like cdnjs, which serves JavaScript, CSS, and font libraries to roughly 12.5% of all websites at a rate of about 250 billion requests per month.

The core services, and what each one actually does

Cloudflare bundles several distinct functions. They are often described together, but they solve different problems.

The important mental model: Cloudflare is a reverse proxy. Traffic flows through it rather than directly to your server. That single fact explains both the speed benefit (caching and proximity) and the protection benefit (filtering before requests arrive).

How the caching layer speeds up a site

When a browser requests a static file — an image, a stylesheet, a script — Cloudflare checks whether a copy already exists on an edge server near that visitor. If it does, the file is returned immediately. If not, Cloudflare fetches it from your origin, stores it, and serves it to subsequent visitors from the edge.

Two things make this fast:

• Proximity. The request travels a short distance to a nearby data center instead of crossing an ocean to your server.
• Offloaded origin. Your server handles far fewer requests, so it has capacity for the dynamic pages that genuinely need it.

Caching works best for files that rarely change. HTML pages generated per user, API responses, and anything behind a login generally should not be cached at the edge, or should be cached only briefly.

How a site uses Cloudflare through a CDN like cdnjs

You do not need to run your own Cloudflare account to benefit from the network. Public CDNs built on it let you load common libraries with a single URL.

cdnjs is described as "the free CDN for open source libraries," offering JavaScript, CSS, and font resources "globally cached on Cloudflare's network." In practice, you reference a library directly in your HTML:

<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/.../style.min.css">
<script src="https://cdnjs.cloudflare.com/ajax/libs/.../library.min.js"></script>

The browser requests the file, Cloudflare serves it from the nearest edge location, and your own server is never involved. This is why a small site can deliver a popular library as quickly as a large one — the file is already cached close to the visitor.

Note the distinction: cdnjs is a content CDN for third-party libraries. Your own Cloudflare setup is an infrastructure CDN for your own files. They share the same underlying network but serve different purposes, and you can use both at once.

Basic setup steps

The general flow for putting your own domain behind Cloudflare:

1. Create an account and add your domain. Cloudflare scans your existing DNS records and imports them.
2. Review the imported records. Confirm that A, AAAA, and CNAME records point to the right origins before you switch anything.
3. Change your nameservers at your registrar. Cloudflare gives you two nameserver addresses; you replace your current ones with those. This is the step that actually activates the service.
4. Wait for propagation. DNS changes take time to spread, and Cloudflare shows your domain as active once it detects the new nameservers.
5. Enable caching and TLS. Turn on the proxy (the orange cloud) for records you want accelerated, and choose an SSL mode that matches your origin's capabilities.

The expected result: your domain resolves through Cloudflare, static assets are cached at the edge, and HTTPS is handled at the edge.

Common problems and how to handle them

A cached file won't update. You deployed a new version of a stylesheet, but visitors still get the old one. The edge is serving its stored copy. Fixes: purge the specific file or the whole cache from the dashboard, or use versioned filenames (for example app.v2.css) so each release is a new URL that was never cached.

Something that should be dynamic is being cached. If a page shows stale or wrong content, check whether its cache rules are too broad. You can bypass the cache for specific paths or set a short time-to-live.

HTTPS errors after switching. These usually come from a mismatch between the SSL mode and what your origin actually supports. If your origin has no valid certificate, a strict mode will break the connection; a flexible mode avoids that but leaves the origin-to-edge leg unencrypted.

DNS records disappeared or changed. Records are managed at Cloudflare after the switch, not at your old registrar. Edit them in the Cloudflare dashboard.

When Cloudflare is the right fit

Cloudflare makes sense when you want caching, DDoS absorption, DNS, and TLS from one place without running edge infrastructure yourself. It is a poor fit if you need to cache highly personalized responses at the edge, or if your origin already sits behind a provider that handles these functions and adding another proxy layer creates conflicts.

For loading third-party libraries specifically, you often don't need your own account at all — a public CDN on the same network, like cdnjs, already does the caching for you.