Starting the server took two commands. Ending it properly takes two minutes — and skipping those two minutes is how 'temporary' demos are discovered still running, forgotten and unpatched, months later. This page covers the clean shutdown, and then the honest verdict on when real hosting simply wins.
Every tunnel session should end the way it began: deliberately. Stopping the commands is step one; proving the door is actually closed is the step everyone skips. Then comes the bigger question this whole set has been circling. The tunnel trick is brilliant at its job — so where exactly is the line past which real hosting becomes the right tool, and sentiment about a clever trick becomes an expensive hobby?
The phone test is the proof. If the page still loads, something is still running — find it before you walk away.
Order matters. Stop the tunnel first: it is the public exposure, and while it lives, anything your machine serves on that port is visible to the world. Then stop the local server. Closing the terminal window usually ends both — usually. Tools started in the background, or a second copy you launched in another window and forgot, can survive a tidy-looking desktop. That is why the next step exists, and why 'I closed everything' is a claim to be tested rather than a fact to be assumed.
Pick up your phone, turn Wi-Fi off so you are on mobile data, and open the public URL. It must fail to load. This ten-second test is the entire audit — it checks the real path a stranger would take, not the reassuring view from your own network. If the page loads, a tunnel or server is still alive somewhere: another terminal, a background process, a second machine. Find it and stop it now, not tomorrow. Only a failed page load earns you the right to say the demo is over.
Sometimes a link travels further than intended — forwarded to the wrong group, caught in a public screenshot. The dead address itself is not the whole problem then. If your tunnel runs under an account, change that account's password and regenerate its token or credentials, because a leaked token lets someone open fresh tunnels as you long after today's address died. Treat the tunnel account like the key it is: when in doubt about who holds a copy, change the lock.
Hosting wins the moment any of these become true: the site must be up while you are asleep; it carries your own domain name; customers, orders or money depend on it; it holds logins, payments or real user data; more than a handful of people use it on an ordinary day. A modest hosting plan costs less than one lost client, lives in a building with backup power and people whose job is uptime, keeps the attack surface out of your home, and comes with support when it breaks at an inconvenient hour. That is not a defeat for the tunnel trick. It is the trick graduating.
Keep the two commands in your toolkit forever — for demos, tests, previews, classroom moments and five-minute shares, nothing else is as fast or as free. The professionals are not the people who never use tunnels. They are the people who use them on purpose, watch them while they run, and always, always switch them off. A demo tool used with discipline is a professional instrument. The same tool left running and forgotten is an incident report waiting for a date.
Watch the video for the two commands that start it all — and keep this page for the two minutes that end it properly.
Watch Full VideoSomething is still running: the server or tunnel in another window, a background process, or a second copy started earlier in the session. Check your running processes, stop what you find, and repeat the phone-on-mobile-data test. If you cannot find it, restart the PC — that ends every local process — then test again until the address fails.
No. An idle tool with no active tunnel exposes nothing at all. What matters is that no tunnel is running, and that the account behind the tool has a strong password and two-factor authentication switched on — because a signed-in tunnel account sitting on your PC is a standing key to your machine, and keys are guarded, not deleted.
For a purely static site, the free tiers of static hosting platforms cover most people honestly well. For a small business site, an entry-level hosting plan on your own domain is the honest step: a fixed address, real uptime, backups and support. Buy it when the first verdict sign on this page becomes true — not months after.