Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →notque/public-web-deploy
Publish a public website safely: DNS, web server, HTTPS, hardening, verify. Routes raw dev servers through nginx/Caddy/Apache/Cloudflare Pages.
Passed 21 of 22 test cases with the skill, and 19 of 22 without it.
and 2 more in the full report
2 fixed19 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
I just finished building my static website and pointed a domain name to my Ubuntu server's IP address. I need a comprehensive, step-by-step implementation guide to host this site publicly in production. Please outline the deployment workflow from domain name resolution verification through web server configuration, TLS certificate installation, OS and server hardening rules, down to the final probe checks to verify the site is safely accessible.
| Checked | Without skill | With skill |
|---|---|---|
| Recommends starting HSTS without includeSubDomains. | Missed | Passed |
| Recommends deploying Content-Security-Policy initially in Report-Only mode. | Missed | Passed |
| Specifies defining limit_req_zone and applying limit_req inside the served location block. | Missed | Passed |
The instructions your model reads when the skill loads.
Serve public sites through a real web server. Local preview binds 127.0.0.1; public sites go through nginx, Caddy, Apache, or Cloudflare Pages — fronted by HTTPS and hardened nginx config.
Never use
python -m http.server, Vite, Hugo, Next dev, Flask dev, or any raw dev server as an internet-facing public service. Local preview MUST bind 127.0.0.1. Public sites MUST go through nginx / Caddy / Apache / Cloudflare Pages.
Raw dev servers are single-threaded, unauthenticated, serve the whole working directory (dotfiles, .env, .git, source, backups), carry no TLS, no rate limiting, and no request filtering. They are correct for 127.0.0.1 local preview and wrong for any internet-facing service. A companion enforcement hook blocks public binds at the tool layer; this skill is the guidance that pairs with it.
Decide public vs private first. A public site is reached by HTTPS + hardened nginx — that is the security model. Reserve auth (basic-auth, SSO) for private/internal sites, decided explicitly. Adding basic-auth to a public site breaks it for its intended audience and adds no protection to content meant to be public.
Goal: The domain/subdomain resolves to the host before any web server work.
Steps:
example.com, subdomain app.example.com).A/AAAA record pointing at the host's public IP (or CNAME for managed platforms like Cloudflare Pages).dig +short A app.example.com
dig +short AAAA app.example.com
getent hosts app.example.com
Gate: dig +short returns the intended host IP. Proceed only when DNS resolves correctly — an HTTPS cert request fails if DNS does not yet point at the host.
Goal: A production web server (not a dev server) serves the site from a defined docroot.
Steps:
test cases passed, vs 19 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.