Drag the slider below from your laptop out to a real web address.

Drag from "works on my laptop" to "a real product"

localhost:3000

Who can open it
Only you, on your machine
Where it runs
Your laptop
Rough cost
$0

What this stage adds: The app runs, but only where the code is. Close the laptop and it's gone.

Watch out: Nothing is exposed — and nothing is shareable.

Each stop is a bigger promise. Deploying is moving your app off your machine onto one that's always on, at an address anyone can reach.

On your laptop, the app runs on "localhost": only you can see it. Deploying is the act of putting it somewhere always on, so a link works for anyone, even when your laptop is shut.

Where your app runs, step by step

Localhost (your laptop)

Runs on
Your machine
Who can see it
Only you

Preview link

Runs on
The host's server, temporary
Who can see it
Anyone with the link

Production

Runs on
The host's server, permanent
Who can see it
Anyone, at a stable URL

Most hosts give you a throwaway link first. Cloudflare's docs: "Preview deployments allow you to preview new versions of your project without deploying it to production," and "every time you open a new pull request on your GitHub repository, Cloudflare Pages will create a unique preview URL."

The moment that matters is production. That's when real people can arrive, so anything you got away with in private stops being private: secrets placed in the frontend are now public (see API keys in the browser), and your access rules must already be right (see Row Level Security).

We speak from doing it: this very site is a vibe-coded project we deployed to Cloudflare, and production was the line where auth, access rules and secrets had to already be right, not a thing to fix later.

So "is it deployed?" really means "is it live for strangers, at an address that survives a redeploy?" A preview link is for showing a friend; production is a front door.

Try it with the rules off. In the sandbox, slide from localhost to production, then back. Notice how far along the line "anyone can see it" switches on, and what the panel says becomes risky at each stop.

Check yourself

0/3 got it

Saved on this device only. No account, no streaks.

Next in making it real: Domains and HTTPS.