Firebase Hosting Headers: Cache, Security, CORS Config
The headers block in firebase.json controls cache TTL, security policy, and CORS. Copy the minimum config that ships fast and safe, and skip the patterns that silently break your whole site.
Articles tagged with #Hosting
The headers block in firebase.json controls cache TTL, security policy, and CORS. Copy the minimum config that ships fast and safe, and skip the patterns that silently break your whole site.
Vercel renamed Edge in 2025 and Fluid compute killed most cold starts. Here is when the Edge runtime still wins for a content site, when a Node function is better, and when static beats both — with June 2026 limits and latency numbers.
ISR or plain SSG for your content site on Vercel? The real trade-off in build time, freshness, function cost, and rollback, with current 2026 Vercel limits and config you can copy.
The exact Vercel settings to ship a content site from a Turborepo monorepo: per-app Root Directory, turbo build, turbo-ignore with --fallback, and shared packages without a publish step. Verified June 2026.
Vercel, Cloudflare, and Netlify all cap function and asset size. Find the bloated dependency, trim it, and add a CI guard so it never recurs.
CF Pages ships old deps after a version bump because it restored a stale dependency cache. Commit the lockfile, clear the cache, pin Node.
Deploy a static Astro site to Firebase Hosting the right way: the firebase.json config, cache headers, clean URLs, and the SPA-rewrite trap that breaks your 404s.
Ship a static site (Astro, Vite, Hugo, plain HTML) to Firebase Hosting in about 10 minutes — free SSL, custom domain, cache headers, and the macOS port-5000 fix. Verified June 2026.
Deployed but visitors still see the old page? Fix it with this firebase.json cache-header config, a curl diagnostic, and the correct rollback command (verified June 2026).
Point your domain at Firebase Hosting with the exact TXT, A and AAAA records, dig verification commands, and fixes for the Needs setup loop and stuck SSL.
Firebase's Spark free tier gives 10 GB storage + 10 GB/month transfer (a 360 MB/day soft cap). Use this page-weight math, real Blaze rates, and budget config to know if you fit.
A reproducible 10-step pre-launch checklist for Firebase Hosting (June 2026): firebase.json, custom-domain DNS, SSL timing, cache headers, redirects, sitemap, and a rehearsed rollback.
Firebase Hosting rewrites map URLs to a Cloud Function, Cloud Run, or a single-page app. The three patterns that actually work as of June 2026, the modern functionId syntax, and the traps each one hides.
Pages work locally but 404 on Firebase Hosting. Diagnose it in ten minutes with the exact request priority order, firebase.json snippets, and curl commands that pinpoint the cause.
Vercel is famous for Next.js, but it also runs Astro content sites well. Use this June 2026 pricing math, vercel.json setup, and image config to decide.
A Vercel "Build failed" is almost always one of seven causes: Node version, missing env var, type error, dependency drift, OOM, wrong output directory, or timeout. Match the log line, paste the fix.
A pre-launch checklist for content sites going live on Vercel as of June 2026 — base URL, env vars, www-vs-apex DNS, SSL, analytics limits, sitemap, leaked vercel.app scan, instant rollback, and spend caps.
Point an apex + www domain at Vercel with the exact per-project DNS records, dig/curl verification, the CAA fix, and a Cloudflare-in-front setup that does not break SSL. Current as of June 2026.
Ship Astro on Vercel with the exact Astro 5 astro.config.mjs, Node 22 pin, vercel.json cache headers, CLI commands, and DNS + SSL verification — no detours.
Vercel Hobby is free but strictly non-commercial; Pro is $20/seat/mo with $20 usage credit. Verified June 2026 limits table, the exact commercial-use rule, and a spend-cap setup.
Firebase Hosting is Google's static + edge CDN. Here is when it fits vs the newer App Hosting, the free-tier limits, a baseline firebase.json, and deploy commands.
Vercel is a framework-native platform built around Next.js, Astro, and SvelteKit. Get the mental model, real June 2026 pricing and limits, a sample vercel.json, and a 5-minute deploy.
A clear rule for when to buy a domain, plus 2026 registrar prices, WHOIS and trademark checks, and the day-one settings that prevent expensive regret.
Pages work in dev but 404 in prod — almost always a build.format, trailingSlash, or output-mode mismatch with the host. Copy-paste fix path.
Moved to a new domain but pages still emit the old canonical — fix hard-coded URLs, CDN cache, sitemap, 301s, and Search Console.
SSL pending for hours after adding a domain on Vercel/Cloudflare/Netlify? It's almost always DNS, a CAA record, or a blocked HTTP-01 challenge. Here's the order to check.
Vercel / Firebase / Cloudflare say the deploy shipped, but visitors still see yesterday's HTML. The 5 ranked causes and a 10-minute client-to-origin diagnostic.
You changed DNS and some users see the new IP, some the old. Here's why regional inconsistency is normal, plus a measurable fix and verification path.
Works locally, fails in prod. Env var not set on the host, or wrong client prefix (PUBLIC_ / VITE_ / NEXT_PUBLIC_). Diagnose and fix in ~10 minutes.
Fix firebase deploy --only hosting: CLI version, expired auth, wrong public path, or Spark quota.
Homepage works but /about or a refreshed /blog/post returns 404 on Firebase Hosting? It's almost always firebase.json rewrites. Verified fixes for SPA, SSG, Astro, and Next.js as of June 2026.
Share to LinkedIn / X / Slack and no image shows. Fix the meta tag, image size, or cache in minutes.
Your vercel.json / _redirects 301 deployed but fires a 404 or the old page. Diagnose with curl -I across Vercel, Netlify, and Cloudflare Pages — file location, rule order, file shadowing, CDN cache, trailing slash, rewrites vs redirects.
You changed robots.txt but Google still crawls or indexes the same URLs. The fix is almost always a cache layer or a duplicate file — here is how to find which one.
Your /rss.xml or /feed.xml 404s: the endpoint isn't in the build, the filename mismatches the link tag, or a host rewrite is hiding it. Per-stack fixes for Astro, Next.js, Netlify, Vercel.
/sitemap.xml or /sitemap-index.xml returns 404, or Search Console says 'Couldn't fetch'. Five ranked causes with checks you run against dist/.
Images, CSS, and fonts 404 in production but work locally. Five web-verified causes and fixes: missing dist/ copy, base path, case mismatch, content hash, CDN cache.
Production URL loads to an empty page with no UI error. Open DevTools before navigating, read the first red console line, and map it to the fix — base path, hydration, CSP, build target, or a stale Service Worker.
/foo 308s to /foo/ then 308s back to /foo. One rule across framework, host, and links kills the redirect chain. Astro/Vercel/Next.js config included.
Build is green but production 500s. Diagnose FUNCTION_INVOCATION_FAILED, missing env vars, Edge runtime, and timeouts with real vercel logs commands.
Build sits at "Building" with no new logs. Cancel it, read the last log line, then fix the real cause: a hung fetch in static generation, an install deadlock, OOM, or a postbuild hook.
Deploy Next.js on Vercel in 2026: auto-detection, env vars, custom domains, next/image allowlist, function regions, and the App Router gotchas that cost indie devs half a day.
When a Vercel deploy goes red, the build log already names what broke — if you know where to look. Three log positions, plus the six most common failure modes and exact fixes.
Firebase Hosting vs Vercel, compared on free-tier limits, pricing, serverless, and one rule most guides skip: Vercel's free Hobby plan bans commercial use. Verified June 2026 figures.