Guides

Cloudflare Pages gives you free, git-connected hosting for static sites and static-generator output (Hugo, Astro, Next.js static export, plain HTML). Push to main, get a deploy. Push to a branch, get a preview URL. This walkthrough covers the GitHub integration end to end: connecting the repo, build configuration, environment variables, custom domains, and preview deployments. Prerequisites A Cloudflare account (free tier is sufficient) Your site’s source in a GitHub repository A build command and output directory, if you’re using a static site generator (Hugo, Astro, Eleventy, etc.) — skip this if you’re deploying plain HTML/CSS/JS Step 1: connect the GitHub repository Log into the Cloudflare dashboard and select Workers & Pages from the left sidebar. Click Create application → Pages tab → Connect to Git. Authorize Cloudflare’s GitHub App if you haven’t already. You’ll be asked to grant access to either all repositories or a selected list — choose selected repositories and pick only what you need. Don’t grant blanket access to your whole GitHub account for a single site. Select the repository and branch you want to deploy from (usually main). Step 2: configure the build Cloudflare will try to auto-detect your framework. Verify or set: ...

The install instructions for rustup, Homebrew, nvm, Docker, most Kubernetes tooling, most observability agents, and thousands of smaller projects share a single opening line: 1curl -sSL https://example.com/install.sh | sudo bash Most operators run it. Most operators know, dimly, that they probably shouldn’t. This series is about what “probably shouldn’t” actually means, and about a workflow that gives you the convenience of a one-liner without the trust-me-bro leap of faith. NIS2 · Article 21(2)(d) Supply-chain security. Regulators expect controls over software acquisition — unverified curl | bash is exactly the failure mode Article 21(2)(d) was written about. What can actually go wrong Four failure modes, ordered by realism. None of them are hypothetical. ...

Work through the steps in order. Each one is small enough to do in under an hour, produces a measurable delta on PageSpeed Insights, and costs nothing beyond your own time. Step 10 covers server-level hardening — not strictly a “speed” fix, but a site getting hammered by bad bots is a slow site, so it belongs on the same list. New to the metric names below? See Core Web Vitals: what PageSpeed is actually measuring first — LCP, INP, CLS, TTFB, and TBT are explained there in plain terms. ...

The fixes for everything below live in the companion piece: How to make your website faster without buying anything. The three that feed ranking Core Web Vitals are a set of standardised measurements Google uses to quantify real-world user experience on a webpage. Introduced in 2020, became a confirmed Google Search ranking signal in 2021. Three metrics: Metric What it measures Good threshold LCP Loading performance Under 2.5 s INP Interactivity Under 200 ms CLS Visual stability Under 0.1 The three that don’t (but are useful anyway) The others covered below — TTFB, FCP, TBT — are supporting metrics. They don’t affect rankings directly but they’re diagnostically useful: they tell you why your Core Web Vitals are poor. ...

A digital marketer I work with sent me a message last week. They were burning ad spend on traffic from regions they couldn’t sell to, getting hammered by bot requests from certain countries, and had read somewhere that you could just “add something to .htaccess” to fix it. They weren’t wrong. But they weren’t quite right either. Country blocking sounds simple. In practice, the right solution depends on your web server, whether you’re behind Cloudflare, your traffic volume, and how much maintenance overhead you’re willing to carry. This guide covers the two implementations I actually use in production, plus a few things the tutorials tend to skip. ...

Before you write anything, know what you’re writing. Four document types cover most IT operations. Each answers a different question. Confusing them — writing a policy when you needed an SOP, or promoting an SOP into a policy because it sounds more serious — produces documents nobody uses and audit findings nobody expected. The four types, in one sentence each Policy — the rule. Answers what is expected, and why. Standard — the requirement that makes the rule measurable. Answers what must be achieved. Procedure (SOP) — the steps. Answers how to do the thing. Work instruction — the granular detail inside a step. Answers exactly how to do that one action. They stack: ...

Most outages that hurt aren’t caused by missing technology. They’re caused by missing documentation. A server dies at 2 a.m. and the on-call engineer has never seen the system before. An auditor asks for evidence that patches ship inside the remediation window; you have no record. Someone leaves and six months of tribal knowledge walks with them. Every one of those failures was on your risk register — you just never wrote it down. ...

Tested on: Ubuntu 24.04 LTS, Ollama 0.30.9 (June 2026 stable line), NVIDIA driver 555-series with CUDA 12.x, Caddy 2.8 as the reverse proxy. The Ollama binary moves fast; verify the systemd unit and environment-variable names against the release you are installing. This guide assumes you have already worked through ubuntu-baseline or rhel-baseline and the ssh-hardening guide. Ollama is layered on top of a defensible host, not a fresh provider image. If the underlying box is not hardened, hardening the model server on top of it is theatre. ...

Tested on: Hugo 0.147.0 (extended), Cloudflare Pages (Free plan), 23 May 2026. The standards in this space are moving fast — re-check the IANA Link Relations registry and the IETF Content-Signal draft before copying anything verbatim into a production site. The phrase “agent-ready” covers a moving target. Twelve months ago it meant “have a sitemap.” Today it touches RFC 8288 Link headers, the IETF Content-Signal draft, IANA registered relations, content negotiation for text/markdown, llms.txt, AI sitemaps, and /.well-known/agent-skills/. Most of those are drafts or vendor experiments. Some of them are stable enough to ship now. Others are worth watching but not worth wiring up yet. ...

The first article in this series covered the strategic and governance considerations for deploying agentic AI in a security context — control postures, the human-in-loop vs on-loop distinction, and the compliance position. If you have not read it, I would suggest starting there. This article is for the architects and engineers who now need to build the system. I will cover reference architecture, how to threat model an agentic pipeline, practical prompt-injection defences, and what your audit trail needs to look like if it is going to hold up under scrutiny. ...