> Cloudflare Pages and Workers: what your AI agent should know — from The Handover, the-handover.org/services/cloudflare-pages
> © Captivated Ltd — free to use in your own work, not to redistribute as a collection. the-handover.org/licence

# Cloudflare Pages and Workers

What we tell an AI agent working on a project that uses Cloudflare Pages and Workers: 2 rules, 2 learned the hard way.

Build a full rootnote set for a Cloudflare Pages and Workers project: https://the-handover.org/build?areas=working-agreement,hosting&hosting=cloudflare

The vendor's own file for agents (what Cloudflare Pages and Workers is, where its documentation lives): https://developers.cloudflare.com/llms.txt. This page covers where it catches agents out.

### Platform subdomains are blocked as a category, so a subset of users silently fails

> Hard-won · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-16

Put anything a user or a client application will reach on a **custom domain**,
never the free platform subdomain.

Corporate filters and security vendors block `*.pages.dev`, `*.vercel.app` and
`*.netlify.app` **as whole categories**, because they are also where a great
deal of phishing is hosted. The consequence is the worst available shape: it
works for you, it works for most people, and it fails completely for whoever
sits behind one of those filters — with no error you will ever see.

**This is not a polish step to do before launch.** A subdomain that reached real
users is a subdomain in somebody's bookmarks and somebody's integration, and
moving it later costs more than setting it up now.

Full account: https://the-handover.org/docs/custom-domains-for-edge-deployments.md

### Plausible needs its origin in connect-src as well as script-src

*When also using Plausible.*

> Hard-won · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-15

Name `https://plausible.io` in **both** `script-src` and `connect-src`. Adding
only `script-src` is the trap: the tag loads, runs, raises nothing a visitor
would see, and every event POST is blocked.

**A dashboard reading zero is indistinguishable from a site with no traffic**, so
the failure gets attributed to the audience rather than the header. Widen by
naming the origin, never by relaxing a directive.

Check from outside after deploying, with a cache-buster — the edge served a
stale copy for several minutes here, long enough to report a false negative.