Cloudflare Pages and Workers

Put anything a user or a client application will reach on a custom domain, never the free platform subdomain.

Corporate filters and security vendors block *.pages.dev, *.vercel.app and *.netlify.app as whole categories, because they are also where a great deal of phishing is hosted. The consequence is the worst available shape: it works for you, it works for most people, and it fails completely for whoever sits behind one of those filters — with no error you will ever see.

This is not a polish step to do before launch. A subdomain that reached real users is a subdomain in somebody’s bookmarks and somebody’s integration, and moving it later costs more than setting it up now.

Name https://plausible.io in both script-src and connect-src. Adding only script-src is the trap: the tag loads, runs, raises nothing a visitor would see, and every event POST is blocked.

A dashboard reading zero is indistinguishable from a site with no traffic, so the failure gets attributed to the audience rather than the header. Widen by naming the origin, never by relaxing a directive.

Check from outside after deploying, with a cache-buster — the edge served a stale copy for several minutes here, long enough to report a false negative.