The dark preview - host-check middleware for zorc-home and 1413designer (fa72c94)Hands-on

A Cloudflare Pages project answers on several hostnames; Access guards only the one you configured. Seventeen lines of middleware make every other hostname return 404, and on 10-10 two more sites got them.

Every Pages deploy is reachable at the project's default domain (project.pages.dev), at a per-deploy hash subdomain, at a branch alias, and at any custom domain you attach. Cloudflare Access policies are attached to hostnames, so a policy on 1413designer.zorc.app says nothing about abc123.1413designer.pages.dev. The content is identical on all of them.

A Pages Function in functions/_middleware.js runs before every request. The fix reads the Host header, compares it to a Set of allowed hostnames, and for anything else returns 404 with Cache-Control: no-store (so the edge never caches the refusal into a stale allow) and X-Robots-Tag: noindex (so a search engine that already found the hash URL drops it). Allowed hosts fall through with context.next().

Commit fa72c94 adds this file to interior-designer (1413designer.zorc.app) and the archived zorc-home (zorc.app, www.zorc.app). It mirrors PDB/output/functions/_middleware.js, the CG-3 rule. The pattern generalizes: any project with Access on a custom domain needs the same file, or the custom domain is a front door with the side doors open.

Worked example

Read the file, then test both doors from the terminal.

git -C /Users/tom/Claude/JARBUS show fa72c94 --stat --format=
git -C /Users/tom/Claude/JARBUS show fa72c94 | grep '^+' | grep -v '^+++' | head -17
curl -sI https://1413designer.zorc.app/ | head -3
# the project's *.pages.dev URL is in the Cloudflare dashboard, Workers & Pages > the project
curl -sI https://<project>.pages.dev/ | head -3
head -5 /Users/tom/Claude/PDB/output/functions/_middleware.js

• Two files, 17 lines each, nothing else in the commit.
• The Set of allowed hostnames is the whole policy; the rest is the 404 response.
• The custom domain should answer 302 to a cloudflareaccess.com login page - that is Access working.
• The pages.dev URL should answer 404 Not found with no-store. Before 10-10 it answered 200 with the site.
• PDB's copy, the original CG-3, for comparison.

Gotchas

• The file must sit at functions/_middleware.js in the deploy root; one directory off and it never runs.
• Old deployments still exist and still have hostnames; the middleware only ships with new deploys. Delete old deployments or they stay open.
• A 404 is better than a redirect here: a redirect to the custom domain confirms the project exists.