The tunnel is only a pipe. What flows through it is decided by the small web server running on your PC — and most mistakes in this setup happen on this side of the pipe, in an ordinary folder you were not thinking about.
Before anything goes public, your site already exists — quietly, on your own machine, at a local address. Understanding this half is what separates a clean demo from an accidental data leak, because of one blunt fact: the local server will publish exactly the folder you point it at — all of it, to anyone who asks, by name. It has no opinion about which files were meant to be public.
A simple web server does not know which files are 'the website' and which are your private extras. If it is in the folder, it can be downloaded.
When the first command runs, the server listens on a port — a numbered door on your own machine — and answers at a local address such as localhost or 127.0.0.1 with that port number. In this state only programs on your own PC can reach it. This is your rehearsal stage. Every page, image and link should be checked here first, because the moment the tunnel opens, this exact folder becomes a public website and rehearsing in public is how embarrassing files get famous.
Whatever folder the server starts in becomes the root of the site. A file called report.pdf in that folder is now one guessable address away from anyone on earth. So the working rule of this entire method is simple: serve a purpose-built folder that contains only files meant to be public. Build the demo somewhere tidy, copy only the site into the serving folder, and start the server there — never in Downloads, never in Documents, never in a project folder that also holds your working files.
If a visitor asks for a folder that has no index page, many simple servers respond with a neat clickable list of every file inside it. For a clean demo folder that is a harmless convenience. For a folder that mixes site files with an exported database, a settings file or last year's documents, it is a table of contents for strangers. Before you open any tunnel, browse your own site like a snoop: open the root, open each subfolder, and see exactly what a stranger would be offered.
Two servers cannot listen on the same port at once. If the command fails with an error about the address being in use, something already holds that port — often an earlier copy of the same server you started and forgot, still running in another window. Close the old one, or start the server on a different port. If you change the port, remember the tunnel must be pointed at the new one too; a tunnel faithfully forwarding to a silent port is the number one reason a public link shows an error while everything looks fine on your screen.
A plain file server can only hand out files; it accepts no logins, no uploads, no commands. That simplicity is its safety. The moment you tunnel a real application instead — a CMS, a dashboard, a tool with its own admin login — its security becomes your security: its default passwords, its unpatched bugs, its admin panel, all now internet-facing. Static demo pages are the safe home use of this trick. Applications demand patching, strong passwords and a second thought, and admin panels should not be tunneled at all.
Watch the video to see the local server start and the site load on the PC itself first — the private preview stage before anything goes public.
Watch Full VideoBackups and zip archives of the site, database files, configuration files containing passwords, exported documents, and anything personal. Attackers routinely guess names like backup.zip on public sites and are regularly rewarded. If a file is not part of the public demo, it does not belong in the root folder — move it out before the tunnel opens, not after.
Your root folder has no index page, or the server was started in the wrong folder. Add a proper index.html or restart the server from the folder that contains it. Treat the listing as a free warning: everything on that list was downloadable by anyone who found the address while it was showing.
A plain static file server only serves downloads; it does not accept uploads or edits. The risk changes completely if you tunnel an application that has its own login, upload or admin features — then that application's security is your security, and it must be patched and password-protected like any public site on the internet.