I shipped the same static page to 8 free hosts - here is what each one does to your HTML

veida — Mon, 07 Sep 2026 12:18:07 +0000

I needed one small static page live on as many independent free hosts as I could get, and I wanted to know what each host actually does to the HTML you hand it. So I shipped the same 4.6 KB page to eight of them in a day and measured the result on every one.

The page itself is real: a single-purpose image generator with a working embed on it, backed by the free anonymous tier of Veida. That mattered for the test, because a few of these hosts rewrite what you upload, and an iframe is the first thing to break.

The eight, and what survived

Host	HTML preserved	Note
`*.static.hf.space`	verbatim	Hugging Face Space, `sdk: static`. Push with git.
`*.pages.dev`	verbatim	`wrangler pages deploy`. Unknown paths fall back to `index.html`.
`*.workers.dev`	verbatim	A Worker that returns the HTML string. Separate suffix from Pages.
`<user>.github.io`	verbatim	Add `.nojekyll`, or anything starting with `_` disappears.
`*.surge.sh`	verbatim	One command. Writes a `CNAME` into your build dir - delete it before the next deploy.
`*.netlify.app`	verbatim	Defaults to private. See below.
`*.lovable.app`	verbatim	It is an AI app builder, so this one surprised me.

The five things that actually cost me time

1. Netlify projects are private by default now. The deploy reports state: ready, the API says the site is fine, and the public URL returns 401 with no WWW-Authenticate header. Nothing in the deploy output hints at it. It is a per-project setting in the UI: Project -> Configuration -> Visitor access -> Public. I spent twenty minutes checking my zip before I checked the setting.

2. Public Suffix List membership decides whether these are separate sites at all. pages.dev, workers.dev, netlify.app, github.io, lovable.app, hf.space and static.hf.space are all on the PSL. surge.sh is not - every *.surge.sh is treated as one site. If anything you are doing depends on those subdomains being independent, check the list first; it is one grep.

3. github.io is one site per username, not per repo. Adding a second repo with Pages enabled does not give you a second independent site, so this host is a one-shot.

4. Cloudflare Pages soft-404s. A path that does not exist returns 200 with your index.html rather than a 404. Fine for a one-page site, worth knowing before you rely on 404s for anything.

5. Lovable will hand back your HTML byte for byte - if you ask precisely. I expected an AI builder to rewrite everything into React with its own design system. It did not: the <style> block, the <iframe> and every <a href> came through unchanged, and it added no canonical tag. Two things about driving it, though:

The composer is a contenteditable, and it ignores beforeinput with inputType: insertText - my 5 KB prompt went in as one character, silently. Dispatching a real ClipboardEvent('paste') with a populated DataTransfer worked first try.
The default mode is chat, not build. My first prompt produced a conversation with suggestion chips and no project at all. Saying "create a new project for this ... then publish it" in the message is what actually spawned one.

Verification is where the real trap is

Three pages I checked this week returned a normal-looking 200 to plain curl and zero of my links, for three different reasons:

npmjs.com returns 403 to a non-browser user agent.
pypi.org returns a ~3 KB "Client Challenge" page.
lobehub.com serves markdown instead of HTML when the user agent is not a browser - status 200, real content, <a href> count zero.

All three look identical to "the page is live but nothing linked". If you check deployed pages programmatically, send a browser user agent and count anchors, and be suspicious of a clean 200 with an empty result.

The page I was deploying

Each host got a different single-purpose page rather than a copy of the same one - eight identical sites would just be eight near-duplicates. Each embeds the generator from the free AI image generator so the page does something rather than describing something, and its free tier runs without an account, which is what made an embed viable at all. The prompts I seeded them with came from the prompt library.

Takeaways