User Manual

Welcome to Hostilo.app. We are an AI-Native platform that allows you to instantly create, host, and manage websites. Our methodology is based on Single-File HTML and collaboration with AI Agents.

To start using Hostilo you need an account.

1. Registration: create a free account with email and password, or sign in with Google.
2. Magic link: forgot your password? Click Send Magic Link on the login page to get a one-time sign-in link by email.
3. Dashboard: tabs Projects (your sites), AI Library (ready prompts), Plan & limits, API & tools (API key and AI connections) and Account.

You don't need to write code yourself: prepare the page with AI (see the AI Library) and paste the result.

New site

1. In the Projects tab enter a site name (lowercase letters, digits and hyphens, e.g. my-portfolio).
2. Click Create & Edit. The editor opens and the site is live at name.hostilo.page.

The free plan has up to 5 sites, PRO up to 20. An AI app connected through the MCP connector can also create sites for you.

Open the AI Library tab in the Dashboard (or the public page hostilo.app/prompts). It holds ready prompts grouped by goal: lead magnets, service pages, events and promotions.

1. Pick a prompt and copy it.
2. Fill in your business details and paste it into ChatGPT, Claude or Gemini.
3. Copy the HTML the AI returns, paste it into the Hostilo editor and click Save.

Every site has a built-in code editor with a live result at name.hostilo.page.

Recommended format

• Single-file HTML: HTML, CSS and JS in one file.
• CSS: skip heavy frameworks; CSS variables (:root) and plain CSS load fastest.
• Mobile first: check the page on a phone before publishing.

Toolbar

• Save changes (Ctrl+S): publishes the page at once.
• History: the last 10 versions of the page; restore any of them with one click.
• SI: describe a change in plain words and the assistant edits the code (available when enabled for your account).
• More: Import (from a public URL or a local .html file), copy, Minify, Download .ZIP and clear.

Files and settings

The File Manager next to the code takes images, CSS and JS by drag and drop. Files go to the assets/ folder, so in your code use e.g. <img src='assets/logo.png'>; click a file to copy its path. The Settings tab of the site holds the custom domain, password protection, the contact form code and site deletion.

The easiest way to let AI publish for you. Connect Hostilo to Claude, Perplexity or another AI app that supports MCP connectors, then ask in plain words: the AI creates, edits and publishes your sites. No API key, no copy-paste.

Connecting in Claude

1. Open Claude → Settings → Connectors → Add custom connector.
2. Name: Hostilo, URL: https://hostilo.app/mcp. Click Add, then Connect.
3. A Hostilo window opens. Log in (with your 2FA code if enabled), check the permissions and click Allow.
4. In a chat, turn on the Hostilo connector and ask, e.g.: “Create a site called my-bakery with a landing page for my bakery and publish it.”

Other AI apps (e.g. Perplexity) work the same way: add a custom (remote) MCP connector with the same URL and sign in to Hostilo.

Gemini

Gemini CLI: gemini extensions install https://github.com/hostilo/hostilo-mcp, then type /mcp auth hostilo and sign in to Hostilo. Gemini on the web: where Google offers custom apps for your account, open Settings → Connected apps → add a custom app and paste https://hostilo.app/mcp.

What the AI can do

• List your sites and read the current HTML of a site.
• Create a site at name.hostilo.page (counts toward your plan’s site limit).
• Publish new HTML: the previous version is saved to history first.
• Browse and restore versions: the last 10 versions of every site.

Managing connections

Dashboard → API & tools → AI connections shows every connected app with its permissions and last use. Click the disconnect icon to revoke access immediately.

Using the connector counts as activity: on the free plan it keeps your account from expiring, just like logging in.

Troubleshooting

• “Authentication required”: the connection expired or was disconnected. Reconnect Hostilo in your AI app’s connector settings.
• Site limit reached: delete a site you no longer need or upgrade to PRO.
• Use exactly https://hostilo.app/mcp. The address mcp.hostilo.app is only a shortcut for people and does not work as a connector.

Working in Cursor, Windsurf or your own scripts? Use the REST API described in the next section.

The heart of Hostilo. Let your AI assistants (Cursor, Windsurf, Claude, ChatGPT) create and publish sites for you through the REST API.

Setup

1. In the Dashboard open API & tools and find API for AI Agents.
2. Generate an API Key (starts with hk_...). Treat it like a password.
3. Paste the rules below into your agent's .cursorrules file or system prompt.

Endpoints

Base URL: https://hostilo.app/api.php — auth header on every call: Authorization: Bearer hk_... — JSON in, JSON out — rate limit 60/min.

• GET ?action=list_sites — list your sites.
• POST ?action=create_site — body {"site_name":"my-page"} (lowercase, digits, hyphens, 3-30 chars, no domain). Returns site_id and url.
• POST ?action=update_site — body {"site_id":123,"html":"..."}. Publishes the HTML.
• GET ?action=get_site&site_id=123 — the current HTML of a site (whole page, up to 5 MB) with its URL.
• GET ?action=list_versions&site_id=123 — saved previous versions, newest first, with version_id.
• POST ?action=restore_version — body {"site_id":123,"version_id":"1760601600"}. Restores a version; the current one goes to history, so it can be undone.

Agent rules (paste into .cursorrules)

You can publish live websites on Hostilo via REST API.
Base URL: https://hostilo.app/api.php
Auth header on every request: "Authorization: Bearer hk_YOUR_KEY"

ACTIONS:
1. GET ?action=list_sites
2. POST ?action=create_site  body {"site_name":"kebab-name"} (3-30 chars, a-z 0-9 -)
3. POST ?action=update_site  body {"site_id":N,"html":"..."}

WORKFLOW: list_sites -> create_site (if new) -> update_site -> return the url.
HTML: single-file (inline CSS+JS), mobile-first, no build step.
Ensure html is valid JSON-escaped; on JSON error, re-encode and retry.

Automation: Make, n8n, Zapier, GPT Actions

The whole API is described in openapi.json (OpenAPI 3.1): every action, request and response fields, errors and examples. Each action also has its own address: https://hostilo.app/api/v1/<action>, e.g. GET /api/v1/list_sites or POST /api/v1/update_site. The /api.php?action= addresses keep working.

• Make: add the HTTP → Make a request module. URL e.g. https://hostilo.app/api/v1/update_site, method POST, header Authorization = Bearer hk_..., body type Raw, content type JSON. Map the HTML from an earlier module.
• n8n: add the HTTP Request node. Authentication: Generic Credential Type → Header Auth, name Authorization, value Bearer hk_.... Turn on Send Body and choose JSON.
• Zapier: use Webhooks by Zapier → Custom Request. Method and URL as above, data as JSON, header Authorization = Bearer hk_....
• GPT Actions (your own GPT in ChatGPT): Configure → Actions → Create new action → Import from URL: https://hostilo.app/openapi.json. Authentication: API Key, Auth Type Bearer, paste your hk_ key. Privacy policy: https://hostilo.app/privacy.

Ready to import: n8n workflow, Make blueprint (create or update a page from a webhook or a sheet; the key goes into credentials, never into the file). step by step.

Limit: 60 requests per minute per key. Errors come back as {"error":"..."} with status 400, 401, 403 or 429. GPT Actions accepts responses up to about 100 KB, so very large pages may not fit in get_site there.

Contact forms work without any backend. Open your site's Settings and copy the ready code from Contact Forms: it already contains this site's site_token.

<form action='https://hostilo.app/api_form.php' method='POST'>\n  <input type='hidden' name='site_token' value='YOUR_SITE_TOKEN'>\n  <input type='text' name='_honey' style='display:none'>\n  <input type='text' name='name'>\n  <input type='email' name='email' required>\n  <textarea name='message' required></textarea>\n  <button type='submit'>Send</button>\n</form>

• Messages arrive at your account email; the visitor's address is set as Reply-To.
• Extra fields (name, phone, company…) are added to the message automatically.
• The hidden _honey field blocks spam bots, and one address can send up to 10 messages an hour.
• Free plan: up to 50 messages a month. PRO: no monthly limit, a webhook (JSON copy of every message to Make, Zapier or your CRM) and CSV export.

Before publishing, check if the AI did a good job (or use the 'Auditor' prompt):

• ✅ WCAG 2.2: Is text contrast sufficient (min. 4.5:1)?
• ✅ RWD: Does the site look good on mobile (no horizontal scroll)?
• ✅ SEO: Does the site have meta title and description tags?
• ✅ EU AI Act: Is there a footer note stating the site was AI-generated?

PRO Plan: Custom domain, no 'Powered by Hostilo' footer, up to 20 projects, 1 GB of storage and up to 5 custom domains.

Connecting a Domain — Step-by-Step

Custom domains run on Cloudflare: the SSL certificate is issued automatically and your site is served from Cloudflare's global network.

1. In the Dashboard click Settings next to your site (or open the site in the editor and switch to the Settings tab). In the Custom domain section enter your domain (e.g. www.example.com) and click Connect. Status becomes Verifying and the panel shows the DNS records to add, including the TXT record with your code.
2. At your DNS provider add a CNAME record:
   • Type: CNAME
   • Host / Name: www (or the subdomain you entered)
   • Value / Target: domains.hostilo.app
   Add the TXT record from the panel as well: name _hostilo.example.com, value hostilo-verify=… (a code unique to your site). It proves the domain is yours; without it Hostilo does not connect the domain. One record covers www and the root domain. If the panel also shows a TXT record (name starting with _cf-custom-hostname), add it exactly as shown — it confirms that you own the domain.
3. www and without www work together: Hostilo connects both addresses for you (e.g. example.com and www.example.com), issues certificates for both and redirects the other one to the address you entered, keeping the path. No redirect rules needed. Add a record for each address:
   • www: CNAME www → domains.hostilo.app;
   • root domain (without www): CNAME @ → domains.hostilo.app. A regular CNAME is not allowed on the root, so use CNAME flattening / ALIAS / ANAME if your DNS provider offers it (Cloudflare does it automatically, also on the free plan).
   If your provider has no flattening, the www record is enough: the site works at www (even if you entered the root domain), and for visitors typing the root domain set a redirect to www at your registrar.
4. Return to the panel and click Check & activate. It usually takes a few minutes; DNS changes can take up to 24 hours.

Visitor Statistics

Click the chart icon next to a site in your Dashboard. Every plan shows page views and daily unique visitors for the last 7 days. PRO adds 30, 90 and 365-day ranges, countries, traffic sources (Google, ChatGPT, Facebook, direct…), devices, browsers, operating systems, top pages and CSV export.

Your AI can read the numbers too: MCP tool get_site_stats or REST action site_stats (GET /api?action=site_stats&site_id=ID&days=30).

Privacy: bots are excluded, no cookies and no IP addresses are stored, so your visitors do not need a consent banner for these statistics.

Your password, sign-in security, consents and account deletion are in the Account tab of the Dashboard.

Changing your password

1. Enter your current password, then the new one (at least 8 characters) and confirm it.
2. Click Change password. Other devices are signed out automatically.

Two-factor authentication (2FA)

Click Manage 2FA, scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password…) and enter the 6-digit code. Save the backup codes shown once: each of them lets you in a single time if you lose your phone.

Marketing consent

The Privacy & consents card turns marketing emails on or off at any time. Withdrawing consent removes your address from our marketing list at once.

Deleting your account

1. In the Account tab scroll to Danger Zone.
2. Confirm with your password (accounts created with Google confirm with their email address).
3. Click Delete Account. The data is erased immediately.