HTMLDrop

HTMLDrop

Sign inDrop
← Documentation

HTML hosting

Paste HTML, run client-side JavaScript, use CDN assets, and publish static pages.

Last updated May 28, 2026

HTML mode stores and serves your markup as provided — subject to validation, size limits, and automated moderation.

Publishing HTML

  1. Open /drop and ensure HTML mode is selected
  2. Paste code or upload an .html file or .zip bundle
  3. Preview in the split pane
  4. Click Drop It

Your page is served at /p/[slug] as static HTML.

JavaScript support

Hosted pages execute client-side JavaScript in the visitor's browser — the same model as Netlify Drop or GitHub Pages static hosting.

What works:

  • DOM manipulation, event handlers, client-side routing
  • Fetch calls to external APIs (subject to CORS)
  • Chart libraries, animation frameworks, and interactive demos

What does not work:

  • Server-side Node, Python, PHP, or database code
  • Environment secrets embedded in published HTML (never publish API keys)

Pages are public by default. Do not paste credentials, private keys, or personal data you are not authorized to share.

External CSS and fonts

Link to public CDNs with absolute URLs:

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/tailwindcss@2/dist/tailwind.min.css" />
<link href="https://fonts.googleapis.com/css2?family=Inter&display=swap" rel="stylesheet" />

If a CDN is unreachable, styles may not load — test in the preview before sharing.

ZIP project upload

Upload a .zip static site from the editor (HTML mode). HTMLDrop:

  1. Extracts the archive server-side
  2. Detects the entry file (index.html preferred)
  3. Stores assets in secure storage
  4. Serves files at /p/[slug]/… with correct MIME types

Relative paths such as ./styles.css and ./assets/logo.png resolve against your drop URL. Password-protected drops gate assets the same way as HTML.

Limits: 10 MB ZIP, 200 files, 25 MB uncompressed total. If multiple HTML files exist, the editor prompts you to pick the entry file.

API upload

POST /api/pages/upload accepts multipart/form-data:

  • file — ZIP archive (required)
  • entryPath — optional entry HTML path inside the ZIP
  • customSlug — optional slug (signed-in users)
  • slug — when set, replaces an existing bundle on edit

Duplicate a drop

POST /api/pages/[slug]/duplicate creates a new URL with the same content and settings (Pro+ when plan enforcement is enabled).

Validation and moderation

Before publish, HTML passes:

  • Size limits — oversized payloads are rejected
  • Structure validation — malformed input returns an error
  • Moderation scan — known abuse patterns are blocked

See Security for the full trust model.

Editing after publish

Signed-in users can reopen a page from the dashboard or visit /drop/[slug] to edit and re-publish. Each publish creates a new version you can roll back to.