Cloudflare Deployment Checklist

Cloudflare Deployment Checklist

A checklist for deploying AstroWEBTheme on Cloudflare Workers or Pages with D1, R2, KV, CSP, and generated assets.

By · Updated

AstroWEBTheme targets Cloudflare Workers or Pages with the Astro Cloudflare adapter.

Use this checklist before deploying a production client site.

Configuration

Confirm these files are correct:

  • src/site/config/info.mjs
  • src/site/config/functions.mjs
  • src/site/config/security.mjs
  • src/site/config/content.mjs
  • src/site/config/pages.mjs
  • astro.config.mjs
  • wrangler.jsonc

wrangler.jsonc is generated by the project scripts. Do not hand-edit generated sections unless you know the generator will preserve them.

Bindings

Check required bindings:

  • D1 binding: DB
  • public R2 binding: PUBLIC_MEDIA_BUCKET
  • private R2 binding: PRIVATE_MEDIA_BUCKET
  • KV binding: KV_BINDING

Only enable bindings that the project actually uses.

Secrets

Secrets should live in Cloudflare, not in committed files.

Common secrets include:

  • SESSION_SECRET
  • PASSWORD_PEPPER
  • AUTH_TOKEN_PEPPER
  • MFA_SECRET_ENCRYPTION_KEY
  • TURNSTILE_SECRET

Build

Run:

pnpm run build

For focused checks, run:

pnpm exec astro build

Content Checks

Verify:

  • /
  • /docs/
  • /llms.txt
  • /rss.xml
  • /sitemap.xml
  • one collection page
  • one detail page
  • one tag page
  • one live D1 post when D1 content is enabled

Security Checks

Confirm production responses include:

  • Content-Security-Policy
  • cache headers for static assets
  • no-store headers for admin/API responses that need them
  • correct consent behavior for analytics and ads

Media Checks

If using R2:

  • verify R2 object keys
  • verify media_assets rows
  • verify public media URL configuration
  • verify alt text and captions
  • verify private media routes are protected

Agent Handoff

When handing a deployment to an AI agent, include:

  • deployment target
  • enabled bindings
  • content source mode
  • whether remote D1/R2 writes are approved
  • required verification URLs
  • known unrelated warnings or errors