Cloudflare Pages + Hugo: a free static site stack
Hosting a documentation site used to mean renting a VPS, configuring a web server, renewing TLS certificates, and scripting deploys. For a static site, that is overhead you do not need. Hugo on Cloudflare Pages gives you a build step, global hosting, HTTPS, and per-branch previews with no server to maintain and no bill. Here is how the stack fits together and where its edges are.
Why Hugo
Hugo compiles Markdown into a static site with one binary and no runtime dependencies, and a small site builds in milliseconds. Content is plain files in git: posts, docs pages, and redirects are all reviewable in pull requests, and the build is deterministic, so what you test locally is what deploys. Front matter keeps metadata like titles, dates, and descriptions next to the content where authors actually edit it. If your writers know Markdown and your reviewers know git, the whole publishing workflow fits inside a code review.
Why Cloudflare Pages
Pages is a static hosting product with a free tier: builds on every push, preview deployments for branches and pull requests, custom domains, and automatic TLS certificates. It integrates directly with GitHub and GitLab, so the deploy trigger is a git push, not an SSH command. Every pull request gets its own URL, which means a content change can be reviewed in a browser before it touches production. The free tier includes a generous monthly build allowance and support for custom domains, which is enough for a docs site or blog that builds a few times a day.
The workflow
The loop is short. Run hugo new site, commit the content, connect the repository to Pages, and set the build command to hugo --minify with public as the output directory. Pages runs the build on its own infrastructure, so you do not need a CI runner. Add a _headers file for security headers and a _redirects file for URL moves, both of which Pages applies automatically to every response. DNS for the custom domain is handled at Cloudflare: a CNAME to the pages.dev hostname, and TLS is provisioned and renewed without manual steps.
Limits worth knowing
The free tier has constraints. Builds are capped per month, so a site that rebuilds on every commit to a busy repository can exhaust its allowance — batch changes or accept the wait. The platform is tuned for static output; anything needing server-side logic requires a Worker or an external API. Custom headers and redirects cover most needs, but if you want per-page transformation, you are back to build-time scripting in Hugo. None of these are blockers for a docs site; they just define the shape of the stack.
Security headers and the site you are reading
A static host is also a good place to set baseline security headers: Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy via one _headers file, applied to every response. The site you are reading — the documentation and blog for the trustless credential broker — runs on exactly this stack: Hugo content in a git repository, deployed to Cloudflare Pages, with DNS and TLS managed by Cloudflare. The repository is public at https://github.com/ikkun1222/trustless, where the docs live alongside the code.
Static hosting is the rare case where the boring option is also the cheap one. If your docs site still lives on a server you patch by hand, ask yourself: what would a git push as your only deploy step save you each week?