Put your results online for free, with sign-in

In plain words

You can share your test results on a web address that only the people you choose can open. It costs nothing, and you do not need a computer that stays switched on. The page is kept on Cloudflare, a company that offers this for free. Cloudflare asks each visitor to sign in with their email, and lets in only the emails on your list. This page walks you through it and gives you a command that checks the page is really locked.

You need the test tracking set up, a terminal, and a free Cloudflare account (cloudflare.com). The screens may be named a little differently from these notes, because Cloudflare changes them from time to time.

What you get, and what you do not

• You get: a web address, sign-in by email code (or Google, if you set it up), a list of who is allowed, and a page that works on a phone.
• It is a snapshot. The page shows the results as of the last time you published it. You can publish again by hand or let an automatic job do it every day.
• Cloudflare sits in the middle. It handles the sign-in and keeps the page. Their free plan covers a small team. Check their pricing page for the current limit.
• Each website has its own list. If different people may see different projects, publish each project as its own website.

If you need results that update live, or roles inside one page, use the sign-in server instead.

1. Make the page

node bin/manage.js site --out results-page --title "Shop test results"

You now have a folder called results-page. It refuses to be made if your files contain a password or key.

2. Create the website on Cloudflare, with a placeholder

You create it with a placeholder first, so the real results are never online before the lock is on.

1. Make a new, empty folder called placeholder, with one file inside called index.html that says only Coming soon.
2. In Cloudflare, go to Workers & Pages, then create a Pages project with Upload assets. Name it, for example, shop-results. Upload the placeholder folder and deploy.
3. Cloudflare gives you an address such as https://shop-results.pages.dev.

3. Lock it

1. In your Pages project open Settings, General, and turn on the Access policy. This creates an Access application.
2. Open that application. Make sure it covers shop-results.pages.dev itself and not only the preview addresses. (Cloudflare's own notes on this are on the Pages "known issues" page.)
3. Add a policy that allows only the emails you list. Anyone else is turned away.
4. Check how people sign in. The email code needs no set-up. You can add Google as well.
5. You choose how long Cloudflare remembers a sign-in.

4. Check the lock, as a stranger would

node bin/manage.js verify-protected https://shop-results.pages.dev

It asks for the page, and for the data file, without signing in. You should see:

OK    Protected: a stranger asking for https://shop-results.pages.dev gets 302 and is sent to https://yourteam.cloudflareaccess.com, and the data file is refused too.

If you see STOP: anyone can read this page, the lock is not on. Fix it before you publish. If you see NOT SURE, check the address and the Access rule.

5. Publish your results

Upload the results-page folder to the same Cloudflare project (Create deployment), or let an automatic job do it. The job rebuilds the page, checks the lock first, and only then publishes:

1. Copy templates/github-actions-publish-results.yml to .github/workflows/publish-results.yml in your project.
2. In your project's settings on GitHub add two secrets (a Cloudflare API token that may edit Pages, and your Cloudflare account number) and two variables (the project name, and your web address).

From then on the page updates whenever your test files change, and once a day.

Good to know

• The check protects you from a mistake. If the lock is ever off, the job stops before publishing anything.
• Search engines are told to ignore the page, and the page asks browsers not to keep a copy.
• A custom address such as results.yourcompany.com needs a domain, which costs about ten dollars a year. You only need it if you want that name. Add it when you want it.
• To remove someone: take their email off the list in Cloudflare. It works at once.
• To take the page down: delete the Cloudflare project.