Sites - protection, rules, A/B, comments and migration

Beyond building and hosting, Sites has the platform layer you know from Vercel and Netlify. Configure it in the site tabs - Ochrona (protection), Reguły (rules), Komentarze (comments), Alerty (alerts) and Ustawienia (move) - or via the API, CLI and MCP.

Deployment protection

• Shared password - visitors enter the password and get a 7-day cookie. Only a scrypt hash is stored; 8 failed attempts per IP lock the form for 10 minutes.
• HostBase SSO - only signed-in members of the project's organization get in; everyone else sees a denial page.
• Scope: previews only (-dN- deployments and PRs) or also production and custom domains. SSR sites are protected through Traefik forwardAuth.
• Previews always send X-Robots-Tag: noindex, nofollow.

Maintenance mode and deploy freeze

Maintenance mode answers production with HTTP 503 + Retry-After and your message (a bypass token lets the team test). A freeze blocks production deployments (push, hook, redeploy, CLI) manually or in windows (e.g. Fridays 15:00-23:59, or a one-off sale period). Rollbacks and previews always work.

Redirects, rewrites, headers and edge rules

The panel editor validates patterns (:param, :rest*, *) and has a tester that shows the gateway's decision for a path, country, device and cookies - on unsaved configuration. _redirects/_headers files from your build keep working.

• Geo - country from the CF-IPCountry header (enable the Cloudflare CDN).
• Conditions - path, country, cookie, header, query parameter, mobile/desktop.
• Actions - redirect, rewrite, block, add headers, A/B traffic split between deployments or paths with a sticky hb_ab_<name> cookie (30 days) and an x-hostbase-ab header.
• Custom 404 and 500 pages (HTML).

{
  "redirects": [{ "source": "/old/:slug*", "destination": "/new/:slug", "status": 308 }],
  "rewrites": [{ "source": "/team", "destination": "/about" }],
  "headers": [{ "source": "/*", "headers": { "x-frame-options": "DENY" } }],
  "rules": [
    { "name": "PL", "when": { "path": "/", "country": ["PL"] }, "then": { "type": "redirect", "to": "/pl", "status": 302 } },
    { "name": "Hero A/B", "when": { "path": "/" },
      "then": { "type": "split", "name": "hero", "variants": [
        { "label": "A", "weight": 50, "deployment": "d4" },
        { "label": "B", "weight": 50, "deployment": "d5" } ] } }
  ],
  "skew_hours": 24,
  "images": { "enabled": true, "domains": ["images.example.com"] },
  "og": { "enabled": true, "brand": "moja.pl", "accent": "#3ecf8e" }
}

Skew protection

After a new production deployment, assets of the previous version (/_next/static/…, /assets/…) are still served for skew_hours (default 24, 0 = off, max 720), so open tabs do not 404 on old chunks. Static sites.

Images, OG and revalidation

• /_hb/image?url=/hero.jpg&w=800&q=75&f=webp - resize and convert (imgproxy: JPEG/PNG/WebP/AVIF). url is a site path or an https URL from the allow-list.
• /_hb/og?title=…&subtitle=…&theme=dark|light - 1200x630 Open Graph PNG (&format=svg returns SVG).
• On-demand revalidation for Next.js (ISR): POST …/revalidate {"paths":["/blog"]} purges the CDN for the paths and calls your app endpoint (header x-revalidate-secret), where you call revalidatePath/revalidateTag.

Preview comments

Every preview has a toolbar (add comment, click a spot on the page). Threads with replies, resolve, a panel list and team notifications. Signed-in (SSO) visitors comment under their name; guests enter a name (40 comments/hour/IP). Static-site previews.

Notifications and alerts

Deployment ready / failed, production version changes, new comments and bandwidth alerts (80% and 100% of a GB / 30 days limit) go to notifications and the organization channels: Slack, Discord, webhook, e-mail.

Import from Vercel, Netlify and Cloudflare Pages

Sites → Import (or CLI/API/MCP): provide the provider's API token, pick a project and get a site with the repository, build commands, env vars (values of hidden secrets are filled in manually), domains and redirects/rewrites/headers from vercel.json and netlify.toml. The token is encrypted, kept for at most 30 minutes and deleted after the import. Domains are added immediately but traffic only moves when you change DNS: the panel shows the records and verifies them (Zweryfikuj).

hostbase sites import vercel --token $VERCEL_TOKEN                 # list projects
hostbase sites import vercel --token $VERCEL_TOKEN --project prj_123 --name shop
hostbase sites cutover shop                                         # DNS records + verification
# API: POST /api/v1/projects/{ref}/sites/import/{list|preview|run}   # MCP: site_import

Token permissions: Vercel - account/team token (read projects); Netlify - Personal Access Token; Cloudflare - Account → Cloudflare Pages → Read. Private repositories import when the project's GitHub connection can read them.

Moving between projects and regions

Settings → Move site copies a site to another project - also in another region (e.g. Warsaw ↔ Stockholm): settings, env, env groups, pipeline, rules and protection (including the password hash), optionally domains, and the newest 1-5 deployments (rebuilt from stored sources; production last). The source stays until you decide.

hostbase sites move shop --to abcdefghijklmnopqrst --keep 2 --domains
# API: POST /api/v1/projects/{ref}/sites/{name}/move   # MCP: site_move

"Deploy to HostBase" button

For public READMEs: [![Deploy to HostBase](https://host.ulewicz.space/deploy-button.svg)](https://host.ulewicz.space/new/site?repo=https://github.com/o/r). Parameters: repo, branch, name. After sign-in and picking a project the wizard analyses the repository (live framework detection) and leads to the deployment.

API

GET|PUT   /api/v1/projects/{ref}/sites/{name}/platform        POST …/platform/test
GET|PUT   …/freeze        GET|PUT …/notifications        POST …/revalidate
GET|POST  …/comments      POST|DELETE …/comments/{id}
POST      …/move          GET …/cutover                  POST /sites/import/{list|preview|run}
# MCP: site_platform, site_rules_test, site_freeze, site_notifications, site_comments, site_revalidate, site_import, site_cutover, site_move