# fuush

> fuush is free static webhosting. Sign in with an email magic link, upload a zip of your built site, and it's live at `your-name.fuu.sh` with automatic HTTPS. Custom domains supported via a single CNAME. No build pipelines, no card required, no signup hoops.

The service is operated by a small team as a community / hobby project and hosted on a fleet of dedicated and cloud servers. Sites run as static files served by Caddy with on-demand TLS for custom domains and a wildcard cert for the apex.

## How it works

1. Sign in at https://app.fuu.sh with your email (magic link).
2. Create a site — pick a name like `your-name` or accept a random one. You get `your-name.fuu.sh` immediately.
3. Zip the directory containing your built site (the one with `index.html` at the top) and upload it. Sites are extracted, validated, and live within ~30 seconds.
4. Optional: attach a custom domain. Verify ownership via a TXT record, then CNAME your domain to `your-name.fuu.sh`. HTTPS is automatic.

## Key features

- **Single-page app mode**: opt-in fallback to `/index.html` for unknown paths. Works with React Router, Vue Router, and any other client-router.
- **`_redirects` and `_headers` files**: drop them in your zip to declare redirects (3xx) and rewrites (200) per path, plus custom response headers (e.g. `Cache-Control`, `X-Frame-Options`).
- **Deploy history + one-click rollback**: every upload becomes a release row. Roll back to any prior release without re-uploading.
- **API + CI deploys**: token-auth API at `https://api.fuu.sh/v1/sites/{slug}/deploy` accepts a multipart zip upload. See `/docs` for the curl recipe.
- **MCP server** at `https://api.fuu.sh/mcp` for LLM agents. Same Bearer-token auth as the API. Tools: `list_sites`, `get_site`, `create_site`, `delete_site`, `deploy_zip`, `list_releases`, `set_spa_mode`, `set_description`, `add_custom_domain`. See `/docs#mcp` for the Claude Desktop config block.
- **Account recovery by domain**: forgot which email you signed up with? Visit `/recover`, enter a subdomain or custom domain you control, and we email a sign-in link to the owner.
- **Optional 2FA**: TOTP-based, with recovery codes.

## Limits

- 100 MB per zip (compressed and uncompressed).
- 25 sites per account.
- 5 sites per hour, 25 per day per account (creation rate).
- 10 uploads per hour per account.
- Banned executable extensions (`.php`, `.exe`, `.sh`, etc.) — static sites only.

## Pages

- [Home / pitch](https://fuu.sh/): one-screen explanation + sign-in CTA.
- [Pricing](https://fuu.sh/pricing): free. Documented limits.
- [Docs](https://fuu.sh/docs): full feature reference — SPA mode, `_redirects`, `_headers`, API deploys, custom domains.
- [Compare](https://fuu.sh/compare): honest comparisons vs Netlify, Vercel, GitHub Pages, Cloudflare Pages, Surge. Per-competitor pages at `/vs/netlify`, `/vs/vercel`, `/vs/github-pages`, `/vs/cloudflare-pages`, `/vs/surge`. fuush's edge: no build step, free for commercial use, email-only signup, drop-a-zip, no lock-in.
- [About](https://fuu.sh/about): who built it and why.
- [Privacy](https://fuu.sh/privacy): what we store (email, upload IPs for abuse triage, site contents). No tracker is injected into hosted sites or the dashboard; the fuu.sh marketing site uses privacy-friendly cookieless analytics (self-hosted Umami) only.
- [Terms](https://fuu.sh/terms): the rules.
- [Abuse](https://fuu.sh/abuse): report a hosted site that's breaking the rules.

## For AI agents: exact API calls

Machine-readable spec: https://api.fuu.sh/openapi.json. Auth: `Authorization: Bearer fuu_...`
(human creates one at https://app.fuu.sh/tokens, or use the device flow so no paste is needed).
Tokens may be SITE-SCOPED: a scoped token only lists/deploys its allowlisted sites
(403 token_not_scoped elsewhere) and cannot create or delete sites. Prefer scoped tokens for agents.

Validate a token:

    GET https://api.fuu.sh/v1/whoami
    -> 200 {"user_id": "8c9c...", "email": "user@example.com"}
    -> 401 {"error": {"code": "invalid_token", "message": "..."}}

List deployable sites:

    GET https://api.fuu.sh/v1/sites
    -> 200 {"sites": [{"id": "...", "slug": "my-site", "url": "https://my-site.fuu.sh",
                        "size_bytes": 12345, "is_active": true, "spa_mode": false,
                        "updated_at": "2026-08-01T12:00:00Z"}]}

Deploy (multipart, field name `file`, zip with index.html at its root, max 100 MB):

    POST https://api.fuu.sh/v1/sites/my-site/deploy
    curl -H "Authorization: Bearer $FUUSH_TOKEN" -F file=@dist.zip \
         https://api.fuu.sh/v1/sites/my-site/deploy
    -> 200 {"site_id": "...", "release_id": "...", "site_url": "https://my-site.fuu.sh",
            "size_bytes": 123456}
    -> 400 error.code in: zip_slip | zip_bomb | banned_extension | zip_empty
    -> 403 (token owner doesn't own the site), 404 (bad slug), 413 (>100MB), 429 (10/hr cap)

Get a token WITHOUT a human pasting one (device flow):

    POST https://api.fuu.sh/v1/device/start           (no auth)
    -> 200 {"device_code": "...", "user_code": "ABCD-1234",
            "verification_uri": "https://app.fuu.sh/device", "interval": 3, "expires_in": 900}
    Tell the human: "visit https://app.fuu.sh/device and enter ABCD-1234", then:
    POST https://api.fuu.sh/v1/device/poll  {"device_code": "..."}
    -> 202 (still pending, poll again after `interval`s) | 200 {"token": "fuu_..."} (once)

Deploys are idempotent-safe to retry. Static only — server-side code never executes.
MCP alternative: https://api.fuu.sh/mcp (streamable HTTP, same Bearer token) with tools
list_sites / get_site / create_site / delete_site / deploy_zip / list_releases /
set_spa_mode / set_description / add_custom_domain.
A copy-paste AGENTS.md snippet lives at https://fuu.sh/docs#ai.

## Common tasks

- **Deploy from CI**: `curl -H "Authorization: Bearer <token>" -F file=@dist.zip https://api.fuu.sh/v1/sites/<slug>/deploy`.
- **Make a React/Vue SPA work**: turn on SPA mode on the site's page after creation — unknown paths fall through to `index.html`.
- **Attach a custom domain**: add it on the site page, copy the TXT record to your DNS provider, wait for verification (≤30s), then add a CNAME to `<slug>.fuu.sh`.
- **Roll back a bad deploy**: site page → Deploy history → "Roll back to this" on any prior release. Instant — no re-upload.

## What it isn't

- Not a JavaScript hosting platform — no serverless functions, no edge compute, no build pipelines. It's a file_server with HTTPS in front.
- Not free in the "enterprise SLA" sense — it's a community project. No uptime guarantees, no support contracts. Email `support@fuu.sh` if something's broken and we'll usually fix it.

## Contact

- General: `support@fuu.sh`
- Abuse: `abuse@fuu.sh` or https://fuu.sh/abuse
- Source: https://github.com/baramustafa/fuush (private)