How to trigger a static-site redeploy safely

A deploy hook is a secret URL. Sending a POST request to it starts a build on Netlify, Vercel, or Cloudflare Pages.

Sometimes I write posts with a date in the future, to schedule them. On a platform like WordPress or others it’s a built-in feature.

But on a static site, we need to get creative.

Those posts are not published unless the build happens after their publishing date, set in the post frontmatter.

Do not put that URL in browser JavaScript or a public link. A hidden page is still public: anyone who reads the source, browser network log, or built JavaScript can copy the hook and repeatedly trigger builds.

For scheduled publishing, keep the hook in a secret store and call it from a scheduler. GitHub Actions, a scheduled Cloudflare Worker, or another server-side cron service can do this without exposing the URL.

A GitHub Actions step can look like this:

- name: Trigger deploy
  env:
    DEPLOY_HOOK_URL: ${{ secrets.DEPLOY_HOOK_URL }}
  run: curl --fail --request POST "$DEPLOY_HOOK_URL"

Add DEPLOY_HOOK_URL as an encrypted repository secret. Do not print it in logs.

If a person must trigger the build from a web page, call your own authenticated server endpoint. That endpoint should verify the user, rate-limit requests, and then read the real deploy hook from a server-side environment variable.

I use this pattern for scheduled Cloudflare Pages rebuilds.

Want me to talk about your product? You can sponsor this site.