A Hosting Memo · May 2026

Where to put your private dashboards

Four platforms compared for personal-private static sites — the kind that need to be online, locked down, and cost nothing to keep there.

Cloudflare · GitHub · Netlify · Posit

Brief II

The brief

A site for an audience of two.

The use case is narrow but common: a static HTML dashboard, regenerated by a script (often nightly), that you and maybe one or two others need to view on phones and laptops. The shared requirement across the four platforms below is "stay private, stay free, stay simple." The differences only matter once those three are met.

Cost: ideally $0/month, including auth.
Auth: email allowlist, not bypassable JS.
Deploy: scriptable from a cron — no manual steps.
Bandwidth: a handful of viewers, kilobytes per visit.
Update cadence: 1-30 deploys per month is typical.
Audience: technically literate, not engineers.

Option I III

Option I · The default pick

Cloudflare Pages

Static hosting on Cloudflare's edge, paired with their Zero Trust auth product. The combination that, in practice, has no real downside for this use case.

cost

$0 · unmetered bandwidth, 500 builds/mo

auth

Cloudflare Access — email one-time-PIN, free ≤ 50 users

deploy

wrangler pages deploy from any script

limits

Static only. No server-side runtime.

domain

*.pages.dev or custom (free)

When to pick it Default for any private static site or dashboard. Pick something else only if you have a specific reason — most often, that you need a server-side runtime.

Option II IV

Option II · The classic

GitHub Pages

The first thing engineers reach for. Mature, stable, free — but its auth story is essentially "make it public and hope nobody finds it."

cost

Free for public repos. $4/mo (Pro) for private.

auth

None native. Bypassable JS gates only.

deploy

git push to gh-pages branch

limits

100 GB bandwidth/mo, 1 GB site, 10 builds/hr

privacy

Public-only on free tier; private requires Pro.

When to pick it When the site is genuinely public — open-source docs, project pages, a portfolio. Not the right tool when the content is sensitive and you need real auth.

Option III V

Option III · The cautionary tale

Netlify

Once the obvious choice for static sites. The 2025 move to credit-based billing made the free tier unworkable for anything with a daily cron.

cost

Free: 300 credits/mo · Personal: $9/mo, 1,000 credits

credit math

15 credits per production deploy. Daily cron = 450 credits ⇒ Free tier breaks mid-month.

auth

Identity / SSO on paid tiers; free tier has no native auth.

deploy

CLI, git push, or zip-API POST

limits

Once credits are exhausted, deploys hard-fail with HTTP 403.

When to pick it For a low-frequency static site (under ~15 deploys/month) where you specifically want Netlify's plugin ecosystem. Otherwise the credit math will catch up with you.

Option IV VI

Option IV · The data-science pick

Posit Connect Cloud

The SaaS sibling of the work-tier Posit Connect server. Its strength isn't static HTML — it's running Python and R apps as live apps with user auth.

cost

Free (public only) · paid tiers for private + auth

auth

Email auth on the Advanced (org) tier

deploy

Push-deploy from a GitHub repository

runtime

Python, R live — Shiny, Streamlit, Quarto, plumber

caveat

Free tier requires a public GitHub repo. No private hosting at $0.

When to pick it When the dashboard genuinely needs server-side compute — interactive Shiny, a parameterised Quarto report, a Python API. Static HTML is a poor fit; you're paying for a runtime you won't use.

At a glance VII

Side by side

The scoreboard.

Holding everything constant — single user, daily deploys, private dashboard, $0 target — the picture clarifies.

	Cloudflare Pages	GitHub Pages	Netlify	Posit Connect Cloud
Cost (private)	$0	$4/mo	$9/mo+	paid only
Real auth at $0	Yes — Access	No	No	No
Daily-cron friendly	Yes	Yes	Credits run out	Yes (paid)
Server-side runtime	Static only	Static only	Functions (paid)	Python / R
Setup friction	Wrangler login + Access	git push	Drag & drop	GitHub-tied

Verdict VIII

The recommendation

Default to Cloudflare Pages.Plus Access for auth.

For a private static site with a small allowlist of viewers, this is the only combination in 2026 that delivers genuinely free, genuinely private, and genuinely scriptable in one package. Everything else either bills you, leaks you, or solves a different problem.

The one-time setup — wrangler login, a Pages project, a Zero Trust application with one reusable policy — takes ten minutes. After that, every future dashboard is just another wrangler pages deploy.

When to revisit If a future site needs server-side Python or R — long-running Shiny, a parameterised Quarto, a plumber API — Cloudflare can't host it and Posit Connect Cloud (paid tier) becomes the right answer. For everything else, the default holds.