Deploy an internal drag-and-drop static site platform for your company using Workers for Platforms. Employees upload files and get a live URL -- every site is protected behind Cloudflare Access.
- Drag & drop deploy - Upload a folder or ZIP file and get a live URL instantly
- Protected by Access - Every site sits behind Cloudflare Access. Employees sign in with your company identity provider
- Subdomain routing - Each site gets its own subdomain:
site-name.yourcompany.com - Works on workers.dev - Test immediately after deploy, no custom domain required
- Deployment tracking - Tracks who deployed what and when, stored in D1
- Admin dashboard - View all deployed sites and deployment history at
/admin
- Workers for Platforms - Each deployed site becomes an isolated Worker in a dispatch namespace. The platform routes requests to the correct site Worker
- D1 - Stores site metadata (name, slug, owner, timestamps) and deployment history
- Cloudflare Access - Enforces company login. The platform reads the
Cf-Access-Authenticated-User-Emailheader to identify deployers
- dispatcher (Workers for Platforms) - Routes requests to deployed site Workers
- DB (D1) - Stores site metadata and deployment history
The platform needs an API token to deploy Workers into the dispatch namespace.
- Go to API Tokens
- Click Create Token > Create Custom Token
- Set permissions: Account > Workers Scripts > Edit
- Scope it to your account only
- Copy the token — you will enter it when prompted during the Deploy to Cloudflare flow
Click the Deploy to Cloudflare button above and follow the prompts. Paste your API token when asked for DISPATCH_NAMESPACE_API_TOKEN.
After deployment completes:
- Go to Workers & Pages in the Cloudflare dashboard
- Click on your newly deployed Worker (named
internal-sites-templateby default) - Go to Settings > Domains & Routes
- Under Worker URL, click Enable and confirm — this enables your
workers.devURL
Protect your Worker with Cloudflare Access so only company employees can access it.
- Go to Workers & Pages and select your Worker
- Select the Access tab
- Select Protect this Worker behind Access
- Choose All traffic to keep this Worker and all sites deployed by employees private by default
- Under Authentication policy, select
Emails ending in→@yourcompany.comto restrict access to your company email domain - Optionally review the session duration
- Select Apply Access
Every request now requires company login. The platform reads the Access identity header to track who deployed each site.
- Go back to Workers & Pages and select your Worker
- On the Overview tab, click the
workers.devlink to open the platform - Upload a folder or ZIP containing an
index.html - Click Deploy site
- Open the generated URL shown after deployment
Update SITE_DOMAIN in wrangler.jsonc to your domain. The platform switches to subdomain routing automatically.
a. Update config in wrangler.jsonc:
b. Add DNS records in your Cloudflare DNS settings:
| Type | Name | Content | Proxy |
|---|---|---|---|
| A | @ |
192.0.2.1 |
Proxied |
| A | * |
192.0.2.1 |
Proxied |
c. Redeploy:
npx wrangler deploy┌─────────────────────────────────────────────────────────────┐
│ Platform Worker (this template) │
├─────────────────────────────────────────────────────────────┤
│ yourcompany.com/deploy → Drag & drop deploy UI │
├─────────────────────────────────────────────────────────────┤
│ Deployed Sites (Workers for Platforms) │
│ ├── docs.yourcompany.com → Employee's site │
│ ├── handbook.yourcompany.com → Employee's site │
│ └── ... │
├─────────────────────────────────────────────────────────────┤
│ Cloudflare Access │
│ └── All routes require company identity provider login │
└─────────────────────────────────────────────────────────────┘
On workers.dev (testing mode), sites use path-based routing instead:
your-worker.workers.dev/deploy → Deploy UI
your-worker.workers.dev/sites/docs/ → Deployed site
npm install
npm run devLocal dev uses path-based routing automatically:
http://localhost:8787/sites/site-name/
| Problem | Solution |
|---|---|
| "Company sign-in is required" | Access is not configured. See Require company login in the Setup section above |
| "Could not create asset upload session" | Check that DISPATCH_NAMESPACE_API_TOKEN is set with Workers Scripts Edit permission |
| "Dispatch namespace not found" | Enable Workers for Platforms and run npx wrangler dispatch-namespace create internal-sites |
| 404 on deployed sites | Ensure uploaded files include index.html at the root |
| Database errors | Tables auto-create on first request. Check the D1 database in the Cloudflare dashboard |
View logs:
npx wrangler tailThe admin page (/admin) shows all deployed sites and deployment history. Protect it with Cloudflare Access so only admins can reach it:
- Go to Zero Trust → Access → Applications
- Click Create new application → Continue with self-hosted and private
- Under Destinations > Public hostnames, configure your Worker's domain:
- Subdomain: the name of your Worker (e.g.
internal-sites-template) - Domain: select your
*.workers.devdomain from the dropdown, or your custom domain if you have one configured - Path:
admin*
- Subdomain: the name of your Worker (e.g.
- Add an Access policy and configure who can access it — for example, restrict to specific admin email addresses
- Save the application
This scopes the policy to /admin* only, so employees can still reach /deploy freely without an additional login step.
- Cloudflare Account with Workers for Platforms enabled
- Node.js 18+
Apache-2.0
{ "workers_dev": false, "vars": { "SITE_DOMAIN": "yourcompany.com" }, "routes": [ { "pattern": "yourcompany.com/*", "zone_name": "yourcompany.com" }, { "pattern": "*.yourcompany.com/*", "zone_name": "yourcompany.com" } ] }