Skip to content

Publish a Hosted Site

A Hosted Site is a small web experience served by Showcase. It can be used in a Showcase Web widget or opened directly from the site address.

Showcase accepts:

  • a single .html or .htm file; or
  • a .zip containing a multi-file site.

A bare HTML upload is installed as index.html, so a one-page prototype does not need to be wrapped in a ZIP.

Hosted Sites with a deployed version

Publish one HTML file

  1. Open Sites in the Showcase Editor.
  2. Select New site.
  3. Enter a short URL-safe name, for example visitor-survey.
  4. Create the site.
  5. Select Upload version and choose survey.html.
  6. Review the detected file type and select Deploy.
  7. Open the displayed site URL and confirm the page works.
  8. Add that URL to the appropriate Showcase Web widget.

Showcase stores the uploaded file as the site's root index.html and applies the same versioning, rollback, size limits, and browser security policy as a ZIP deployment.

Publish a multi-file site from ZIP

Use ZIP when the page has local JavaScript, CSS, fonts, images, or nested pages.

Your archive should look like:

index.html
assets/
  site.css
  app.js
  welcome.jpg

index.html must be at the archive root, not inside an extra folder.

  1. Test the site in a normal browser.
  2. Create a ZIP containing index.html and its assets.
  3. In Sites, open the site and upload the ZIP.
  4. Deploy the version.
  5. Test the deployed URL in the same browser engine/device used by the presentation.

Update without losing the current version

  1. Open the existing site.
  2. Upload the new HTML or ZIP as another version.
  3. Test it.
  4. Make it active only after the test passes.

Showcase keeps earlier versions. If the update fails in the presentation, select the previous known-good version and activate it. This is faster and safer than trying to repair production files in place.

Content Security Policy

Every Hosted Site is served under the same fixed Content Security Policy — there is no per-site or admin-configurable setting, and no way to allow additional origins. The policy sandboxes the page (scripts and forms are allowed, but the page gets an opaque origin with no access to Showcase's own cookies) and restricts connect-src, img-src, media-src, font-src and style-src to the site itself (plus data:/blob: for images, media and fonts). object-src and framing (frame-ancestors) are disabled outright.

The practical effect: a Hosted Site cannot call an external API or load assets from another domain. Bundle everything the page needs — scripts, styles, fonts and images — inside the site's own ZIP. If a prototype depends on an outside API, it has to be redesigned to work without one (for example, by having a connector or another part of Showcase fetch the data instead), not fixed by loosening the CSP.

If a request works when opening a file locally but fails when hosted, inspect the browser console and check:

  • CSP connect-src for API calls — same-origin only, always;
  • CSP img-src, media-src, or font-src for assets — same-origin, data:, or blob: only;
  • HTTPS mixed-content errors;
  • whether the asset is missing from the ZIP rather than blocked.

Common failures

Message or symptom Fix
File type not accepted Upload .html, .htm, or .zip only
ZIP has no root index Put index.html at the archive root
Page is blank Check browser console, relative file paths, and CSP
Assets are missing Preserve their relative paths inside the ZIP
Outside API is blocked Expected — Hosted Sites cannot reach external origins at all. Bundle the data with the site or fetch it another way
New version broke the presentation Reactivate the previous version