Shorthop

Short links on your own domain, and the paying customers they bring, in one Cloudflare Worker you own.

Put a link in a LinkedIn post or on a printed QR code, then see the clicks, the visits and the Stripe payment it led to. Shorthop runs in your own Cloudflare account, so no shortener's plan decides whether your links keep working or how much history you keep. It stores no IP addresses and sets no cookies. For most people it fits in Cloudflare's free allowances.

<br>_{You don't need a terminal: Cloudflare's setup page asks only for an admin password. What each field means · Coming from Bitly, Rebrandly, Short.io or Dub? Bring your links}

Why people switch · What's new · Features · Screenshots · Install · Common trip-ups · Documentation · Costs · FAQ

Why people switch to Shorthop

What users of hosted shorteners keep running into, and what Shorthop does instead:

| What happens elsewhere | With Shorthop | |---|---| | Links and QR codes stop working when a plan lapses or an account is banned | Links live in your own Cloudflare account, on your domain. No shortener's billing sits between you and them. | | Free links get ads, or a page before the destination | A plain 302 to the destination, after one KV read | | Click history cut to 30 days on cheaper plans | Daily statistics stay in your own database until you delete them; individual clicks are kept for 90 days | | Exports locked to higher plans | Links (with every setting), statistics and payments as CSV or JSON, or everything as one backup, any time | | A monthly cap on changing where a link goes | Change any link whenever you like (Workers Free allows 1,000 saves a day). Every version is kept and can be restored | | Revenue tracking only on a top plan, or under a commercial license | Revenue from Stripe, Paddle, Lemon Squeezy, Dodo Payments, Creem, Gumroad, FastSpring and PayPal, matched to the link that brought each buyer. MIT-licensed | | Priced per seat | Admins, managers and users with their own permissions, at no cost (Cloudflare Access is free for up to 50 users) |

Why Shorthop

• Revenue per link. A short link takes someone to your site, and Shorthop follows that visit to the payment it led to. A link straight to a Stripe, Lemon Squeezy, Dodo, Creem or Gumroad checkout is credited too, with no website in between. Revenue is broken down by link, channel, campaign and landing page.
• Everything in your account. Links live on go.yourdomain.com, and every number stays in your Cloudflare account. Back it all up as one ZIP whenever you like.
• Cookieless. Nothing is stored in the visitor's browser and no IP addresses are kept. Unique visitors are counted with a daily hash that can't be traced back afterwards.
• Reports you can send. Send a sponsor or client a live, read-only page for one link, or a campaign report for a tag or a set of links, with revenue if you choose. They never see your login or your destinations.
• Free to run. One Worker on Cloudflare's free tier covers most personal use (100,000 requests a day). Install it with one button.

What's new in 2.0

• A new admin. Every page is rebuilt: analytics, links, websites, live hits and settings, in light and dark, with ⌘K to jump anywhere, c to create a link, and a layout made for phones.
• Revenue from links straight to a checkout: Stripe Payment Links, Lemon Squeezy, Dodo, Creem and Gumroad.
• Campaign reports: one read-only page for a tag or a set of links, optionally with revenue, for sponsors and clients.
• Leave another shortener in minutes: import from Bitly, Rebrandly, Short.io or Dub by file or straight from their API, and move the links onto your domain.
• Backups: everything in one ZIP, plus a weekly copy to R2.
• AI assistants: create links and read statistics from Claude Code, Cursor or VS Code through an MCP server, or install the skill with npx skills add jntegz/shorthop. The admin also has an API reference, and Workers AI can suggest slugs and previews if you turn it on.
• Live map and click heatmap: see where clicks come from right now, and the hours your audience clicks, so you know when to post. A new link.clicked webhook sends each click to your own tools.
• Bio pages: a link-in-bio page whose buttons are your own short links, so every tap is counted.
• Safety: a warning page before destinations Cloudflare flags as malware or phishing.
• Day to day: bulk actions, a warning when a destination is already shortened, a bookmarklet and a share target, and error messages that say what failed.

Earlier releases are in the changelog.

Features

Links

• Fast redirects: one KV read, then a 302. Analytics is written after the response, so it never slows down or breaks a click.
• Several domains: each short domain has its own slugs and stats. The admin can live on the primary domain or on a separate host.
• Admin at /_admin: create, edit, disable, expire, tag and search links, with custom slugs and a live preview of the short link. Select links to enable, disable, tag or delete them together, and rename or merge tags.
• Bio pages: a link can be a link-in-bio page instead of a redirect, with buttons to your own short links or any address, short texts, section titles, social icons, a share panel and your own colours.
• Smart routing: rules by device (iPhone & iPad, Android, desktop, other) and country, first match wins, with A/B splits across up to 10 weighted destinations. A simulator in the editor, and results per rule and variant on the link page. Bots and previews get the default destination; no cookies.
• Social previews: your own title, description and image for LinkedIn, Slack, X, iMessage and other link previews, with mockups while you edit. Workers AI can suggest slugs and write the preview (optional).
• UTM builder: one field per parameter, saved presets, and a preview of the URL visitors land on.
• QR studio: colours with a contrast check, dot and corner shapes, a logo, frames with a caption, a live scan test, SVG or PNG up to 4096 px, print sheets, and a ZIP of every link's code. Scans count as their own source.
• Password-protected links and click limits: visitors enter a password first, or a link stops after a set number of clicks, counted exactly by a Durable Object. Bots and previews don't count.
• Links that no longer work: mark one as retired and pick a replacement. Visitors get a page with a button to it, or are sent on to your site after a few seconds. Unknown slugs get your own 404 page, in light and dark.
• Unsafe destinations: a destination Cloudflare's security DNS flags as malware or phishing gets a warning page before the redirect. "I trust this destination" lifts it.
• Link history: every change is saved as a version with who made it, and any earlier version can be restored. Deleted links can be brought back for 90 days.
• Import and export: import from Bitly, Rebrandly, Short.io or Dub by their API or their CSV export (old click counts are kept), or any CSV. Export links as CSV, or as JSON with every setting for another Shorthop.

Sharing statistics

• A public page for one link at /_share/<id>.<secret>: clicks, daily visitors, countries, cities, sources, devices and more, read-only. Send it to a brand or sponsor as proof of the clicks a post or campaign got.
• Campaign reports: the same for a tag (links tagged later join in) or a chosen set of links, with a table per link and, if you turn it on, revenue per currency.
• You decide what they see: an optional end date, password, and the longest period viewers may pick. Viewers can switch between light and dark (or add ?theme=dark to the address). It never shows the destination or the link's history, and you can revoke it at any time.

Analytics

• Per click: country, region, city, device, OS, browser, referrer, source tag and language. Humans, bots and misses are counted separately.
• Live map: a globe of the latest human clicks, at city level, with the top countries and links.
• When people click: a weekday × hour heatmap in your own time zone, per link and for the whole account.
• Private by design: no IP addresses or cookies are stored. Unique visitors are counted with a daily hash whose random salt is deleted once the day is over. See visitor privacy.
• Any period: today, 7, 30 or 90 days, 12 months, all time or any dates, compared with the previous period.
• Kept for good: a daily job saves each day into D1, so stats outlive Analytics Engine's 90-day retention.

Websites

• One script tag: /_t/script.js (about 8 KB compressed) records visits, sources and channels, pages, goals, scroll goals and outbound clicks. It counts single-page-app navigation too.
• Works where your site lives: plain HTML, Next.js, WordPress, Shopify, Webflow, Framer, Wix, Squarespace, Ghost and anything else that lets you add a tag to the page head. The site's setup page shows the exact steps for each, with your values filled in, and checks live that the script arrives.
• Live view: who is on the site right now, where they came from and which pages they're reading, refreshed every 15 seconds.
• Peak hours: a weekday × hour heatmap of visits, sales or revenue in the site's time zone, with the busiest hours named, so you know when to post.
• Reading and scroll depth: median time on each page, average scroll and the share who read 75% or more, for everyone, buyers and non-buyers.
• Page speed: Core Web Vitals (LCP, INP, CLS) from real visits, per page.
• Goals and funnels: data-sh-goal="signup" on a button, data-sh-scroll when a section comes into view, or shorthop("goal", …) from code. Funnels of pages and goals show where people drop off, how long each step takes, and how many who finished went on to pay.
• Where visitors come from: channels (search, social, email, AI assistants, paid, referral, short links), sources, campaigns and UTM tags, landing and exit pages, locations, devices, networks and returning visitors. "Direct" is split into in-app browsers, checkout returns, shared links and typed visits.
• Cookieless by default, or recognising returning visitors with a first-party ID after consent, with an optional built-in consent banner. A site can respect Global Privacy Control and Do Not Track.

Revenue

• Payment providers: Stripe, Paddle, Lemon Squeezy, Dodo Payments, Creem, Gumroad, FastSpring and PayPal send verified webhooks; switch on the ones you sell with, follow the steps, and press Check connection. Other billing can send payments through the API.
• Buyers matched to their visit: each payment is tied to the visit that led to it (the checkout reference, the same customer, an email your server reported, or checkout timing), with how sure each match is. Revenue by channel, campaign, short link, landing page, country or device adds up to the total.
• Links straight to a checkout: a short link to a Stripe Payme