llms.txt
+24 −8
− > Drop2Run, at dropto.run: publishing for what AI makes. A page an assistant wrote, a folder of markdown notes, a PDF or Word report, or a built site becomes an HTTPS link in seconds — from a chat, a coding agent, a shell or a browser drop. Documents open in a reader; everything else is served as a static site from Cloudflare's edge in 300+ cities. Publishing is free, with or without an account, and traffic is never billed.− - **No build and no server.** No build step, no server-side rendering, no containers, no database. A− framework project has to be built first; the output folder is what gets published. The one code that runs− is serverless functions — small API routes under `_functions/`, on the plans that include them− (https://dropto.run/docs/functions.md).− its limits as markdown, generated from the live tiers, is <https://dropto.run/pricing.md>.− - [Pricing](https://dropto.run/pricing): Every tier and its limits. Paid tiers add room, custom domains and a page with no badge.− - [FAQ](https://dropto.run/faq): What can be hosted and what cannot — plain HTML, a built React or Vue app, or a folder of markdown and PDFs served through a viewer.+ > Drop2Run, at dropto.run: publishing for what AI makes. A page an assistant wrote, a folder of markdown notes, a PDF or Word report, or a built site becomes an HTTPS link in seconds — from a chat, a coding agent, a shell or a browser drop. Documents open in a reader; everything else is served as a site from Cloudflare's edge in 300+ cities, with serverless functions for its API routes on the Pro and Team plans. Publishing is free, with or without an account, and traffic is never billed.+ - **No build and no server of your own.** No build step, no server-side rendering, no containers, no+ database, nothing on a schedule. A framework project has to be built first; the output folder is what gets+ published. The code that does run is serverless functions — small API routes under `_functions/`, run per+ request, on the Pro and Team plans (https://dropto.run/docs/functions.md). A key a function uses is set as a+ variable, never published.+ its limits as markdown, generated from the live tiers, is <https://dropto.run/pricing.md>. How an agent+ gets a credential and uses it — a sign-in a person approves, then a bearer token — is+ <https://dropto.run/auth.md>.+ - [Build an app with sign-in](https://dropto.run/docs/build-an-app.md): A whole web app on one static site — pages, an API in serverless functions, accounts with hashed passwords and sessions, and data in the site's key-value store. Complete code, tested end to end.+ - [Pricing](https://dropto.run/pricing): Every tier and its limits. Paid tiers add room, custom domains, a page with no badge, an API proxy and, on Pro and Team, serverless functions.+ - [Serverless functions for a static site](https://dropto.run/functions): A JavaScript file in _functions becomes an API route of your site — a webhook, an API call with a key the browser never sees, a form handled your way — on the Pro and Team plans, with no server to run.+ - [Writing feed](https://dropto.run/blog/feed.xml): RSS 2.0, every article newest first with its title, date and one-sentence summary.+ - [AI-made HTML that is blank when opened from disk](https://dropto.run/blog/ai-html-blank-when-opened): Why a page that renders in a Claude or ChatGPT preview is blank when double-clicked — file:// is an opaque origin so module scripts, fetch() and local fonts are blocked as CORS, bare imports like "react" need an import map, JSX needs a build, artifact storage and Claude calls exist only on Anthropic's side, CDN files need a connection — with the exact Chromium console messages, and `python3 -+ - [Why a site works locally but breaks after deploying](https://dropto.run/blog/works-locally-breaks-deployed): Diagnosing from the first failed request in the Network tab — a build served from a subfolder (GitHub Pages project sites; Vite base, Next.js basePath, Create React App homepage, and why base "./" breaks deep links behind an SPA fallback), what "MIME type of text/html" on a module script really means, publishing the project folder instead of dist, Jekyll dropping folders that start wit+ - [Why a shared link shows no preview](https://dropto.run/blog/link-preview-not-showing): How Facebook, LinkedIn, Slack, Discord and iMessage build link previews — one script-free, cookie-less fetch of the top of the HTML, then a cache (about 30 minutes on Slack and Discord, 30 days on Facebook, old shares never updated) — the Open Graph tags and image sizes each requires, why relative og:image URLs, tags set by JavaScript, logins and robots.txt (honoured by Facebook, ignored by Slack) break the+ - [Why a site isn't showing up on Google](https://dropto.run/blog/site-not-showing-on-google): Telling not-indexed from not-ranking with Search Console's URL Inspection rather than site: (which Google says does not list every indexed URL); noindex in a meta tag or an X-Robots-Tag response header (absent on default GitHub Pages, vercel.app and netlify.app addresses we checked, present on this service's default subdomains, removed for a public site on its own domain); robots.txt controlling fetchi+ - [Redirects on a static site](https://dropto.run/blog/redirects-static-site): Moving pages without breaking links — 301/308 versus 302/303/307 (RFC 9110 method rules, Google's canonical signal), the _redirects format with splats and placeholders, and per-host differences: Netlify defaults to 301 and lets an existing file win unless the rule ends in !, Cloudflare Pages defaults to 302 and always applies the rule, Vercel's vercel.json sends 308 by default, GitHub Pages only has jekyll-redirect-fr+ - [Trailing slash on a static site](https://dropto.run/blog/trailing-slash-static-site): Why /about and /about/ are different URLs — RFC 3986 relative-link resolution, Google treating each form separately, file versus folder deciding the canonical form — and what Cloudflare (html_handling, 307), Vercel (trailingSlash and cleanUrls, 308), Netlify (Pretty URLs; a redirect rule cannot add or remove a slash) and Apache (DirectorySlash) do, with a curl loop to check any host.+ - [How to store data on a static site](https://dropto.run/blog/static-site-database): Six places a static site can keep data, chosen by who must see it and who may change it — localStorage/IndexedDB (one device, ~5 MiB), the site's own JSON files, a form backend (Netlify Forms, Formspree), Firestore or Supabase called from the browser (public key, Security Rules or Row Level Security do the protecting), a function holding a secret in front of a hosted database, and host storage (Workers KV event+ - [Favicon not showing on a site](https://dropto.run/blog/favicon-not-showing): Where a browser looks for a site icon per the HTML Standard — link rel="icon" tags (last equally appropriate one wins), then an optional request for /favicon.ico at the origin root, described for HTTP(S) pages — and why each lookup misses: file not in the published folder, a single-page-app fallback answering with the home page as text/html (Netlify, Cloudflare Pages, Vercel), a GitHub Pages project sub-path, an http+ - [Custom headers on a static site](https://dropto.run/blog/headers-static-site): Where HTTP response headers are set on a static host — a _headers file on Netlify (not applied to proxied or function responses) and Cloudflare Pages (100 rules, 2,000 characters a line, same header from two rules comma-joined, "! Name" to remove), a headers array in vercel.json, add_header in nginx (needs "always" for a 404, and a block with its own add_header inherits none), Header always set in Apache, and no se+ - [A tenant-isolation test that passed without isolation](https://dropto.run/blog/isolation-test-without-isolation): Mutation-testing a multi-tenant edge cache key (site id + deploy id): why removing the site id survived a whole suite (expectations built with the function under test, fixtures with distinct deploy ids), the measured cross-tenant read it allows through a preview hostname whose deploy id the request chooses, a test for that exact attack that only caught it through test order becaus+ - [FAQ](https://dropto.run/faq): What can be hosted and what cannot — plain HTML, a built React or Vue app, a folder of markdown and PDFs served through a viewer, and the small API routes serverless functions answer.