Private · Static-site native · 5-minute install

Interactions for static sites.
Inside your Cloudflare account.

StaticLayer adds moderated comments, anonymous reactions and StrawPoll-style polls to any static website — no trackers, no comment SaaS, no third-party database. Deploy once into your Cloudflare account and the data is yours.

Try the live demo →

One widget · three ways to engage Get started — 5 min Security model

yoursite.com/blog/hello
CommentsModerated, nested threads with likes, pin & sorting.
ReactionsOne-tap anonymous emoji, proof-of-work protected.
PollsStrawPoll-style votes, privacy-first, embed anywhere.
Your sitestatic HTML Your WorkerCloudflare Your D1database

Owned by you — from first byte to final comment.

01 — What StaticLayer does

One widget. Three ways to engage.

Comments, reactions and polls share the same architecture: anonymous by default, proof-of-work protected, and running entirely inside your Cloudflare account.

Comments

Real conversations on static pages: moderated, nested, and safe by default — plain text only.

  • Nested replies (up to 3 levels) + owner “Author” badge
  • Likes, pin, report and newest / best sorting
  • One moderation queue for all your pages
Explore comments

Reactions

Anonymous emoji counts with real integrity — every click pays a tiny proof-of-work.

  • Cost-based anti-abuse, not identity
  • Difficulty escalates as a page gets busy
  • Fully themeable — choose the emoji set
Explore reactions

Polls

StrawPoll-style votes embedded anywhere — even globally on every page of your site.

  • No IP, no cookies, no identity
  • Single or multi-select, ranked results + leader
  • Optional one-vote-per-browser guard
Explore polls
02 — How it works

Deploy. Embed. Moderate.

Three steps, about five minutes, and no dashboard clicking sprees. The hard part is done by the CLI or the hosted installer.

01

Deploy StaticLayer

One command (npx staticlayer init) or the hosted browser installer creates the Worker, the D1 database and the secrets — in your account.

02

Add the widget

Two lines of HTML on any static page. The same snippet works on every page — thread = page URL. Works with Astro, Hugo, Jekyll, Next.js, plain HTML…

03

Moderate & publish

Comments land in a private admin queue. Approve, delete or reply from /admin.html — readers see only what you publish.

Read the quick start → Watch it happen in the demo

03 — Why StaticLayer

Why not a traditional comment SaaS?

It comes down to one question: who controls the data?

Traditional model

A third-party platform in the middle

  1. Your site
  2. Third-party comment platform
  3. Their infrastructure
  4. Their policies & dependencies
StaticLayer

Comments stay in your cloud

  1. Your site
  2. Your Cloudflare Worker
  3. Your D1 database
Your infrastructure

No third-party database

Comments live in the Cloudflare resources you control. There is no centralized comment platform.

No visitor tracking

Zero cookies, zero fingerprinting

The public widget does not use tracking cookies, local storage, fingerprinting or analytics.

Anti-spam, no CAPTCHA

Proof-of-Work + honeypot

Behavioural checks only — a tiny client-side puzzle, a hidden honeypot and a time gate. No friction for readers.

04 — Architecture

Four components. One owner: you.

Click each component to see what it does — and what it deliberately does not store.

05 — Security & privacy

Small surface. Explicit boundaries.

Designed with a minimal attack surface and defense-in-depth controls. No “military-grade” claims — inspect the code instead.

✓ Plain-text comments ✓ No raw HTML rendering ✓ Stateless HMAC admin session ✓ Signed CSRF binding ✓ Single-use PoW challenges ✓ Honeypot + time-gate anti-bot ✓ Anonymous likes · per-browser hash ✓ GDPR data export (CSV/JSON) ✓ D1 transactional anti-replay ✓ No visitor tracking ✓ Password-less admin (GitHub OAuth) ✓ No centralized comment database

Explanatory checklist of designed behaviors — not a claim of perfect security. Read the full security model.

Public runtime

Plain-text comments, prepared SQL, strict input limits.

Read →

Admin authentication

Stateless HMAC session, password or GitHub OAuth, absolute TTL.

Read →

No tracking

No visitor cookies, local storage, fingerprinting or analytics.

Read →
06 — Integrations

One widget. Every static site.

If it can embed JavaScript, it can use StaticLayer.

HT HTML AS Astro HU Hugo JE Jekyll NX Next.js GH GitHub Pages CF Cloudflare Pages
07 — FAQ

Quick answers

Does StaticLayer host my comments?

No. The runtime is deployed in your Cloudflare environment. There is no centralized comment database.

Do visitors need an account or email?

No. Visitors just write a nickname and a plain-text comment.

Does the widget track visitors?

No. The public widget does not use tracking cookies, local storage, fingerprinting or analytics.

How long does installation take?

About five minutes: one command (or the hosted browser installer), two lines of HTML, and a moderation approval. See the universal guide.

Get started All FAQ →