Personal project · efedkaya.com
From AI-assisted prototype to independent hosting.
Directed the brief, content, design iterations and hosting decisions for my personal portfolio, using ChatGPT and Codex for implementation and checks.
I wanted a website that explains my work clearly and gives me control over its domain, hosting and data practices. I started with an AI-assisted prototype in ChatGPT, refined it through prompts and review, then moved the site to my own Cloudflare account.
Turn the brief into a website
I set the audience, selected the work to feature and supplied the context behind each project. Through prompts and visual feedback, I shaped the layout, colours, navigation and copy. I also asked for clearer company attribution and a visible online résumé option, so visitors can understand my contribution and choose how to read it.
Own the domain and hosting
I registered efedkaya.com through Porkbun and chose Cloudflare for independent hosting and greater control over deployment and security settings. With AI assistance, the migration connected the domain, configured DNS and HTTPS, and moved the public site and supporting backend services into my own account. Registration remains at Porkbun; the live site does not depend on a ChatGPT subscription.
How my prompts shaped the work
I used prompts to set requirements, challenge drafts and request checks. Examples from the project brief:
“Keep the Coolumba and PKF credit clear.”
Separate my contributions from employer-owned software and business materials.
“Use my full name everywhere.”
Make identity consistent across page copy, metadata and structured information.
“Only collect necessary data.”
Review analytics fields, visitor consent and the separation of private credentials from the public site.
I reviewed the visible result and asked for further changes. ChatGPT and Codex translated the requirements into code and configuration and ran the checks documented in the project.
The technical implementation
I set the requirements and reviewed the result. ChatGPT and Codex assisted with the following configuration, backend implementation and verification work.
View DNS, hosting, security and release details
Domain and DNS
Porkbun remains the registrar. Authoritative DNS was delegated to Cloudflare by changing the domain’s nameservers. DNSSEC was enabled, the DS record was saved at the registrar, and resolver checks verified the chain. The www hostname redirects to the canonical efedkaya.com address.
HTTPS and browser protections
Cloudflare manages the TLS certificate. The launch configuration enabled HTTPS redirects, a TLS 1.2 minimum and TLS 1.3 support. Responses include a Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers.
Hosting and service separation
A Cloudflare Worker serves the static portfolio and its limited analytics endpoint, backed by a D1 database. A separate Worker and separate private state database hold notification functions and credentials. The notifier has no public route or preview URL.
Credential and account handling
Runtime secrets are kept in Cloudflare secret storage, outside frontend JavaScript and public assets. The public website has no OpenAI API key or Telegram bot token. I completed provider account setup and two-factor authentication; credentials and recovery information stay private.
Consent and data minimization
Optional analytics require an explicit choice and respect Global Privacy Control and Do Not Track. Accepted events use allowlisted paths and coarse device/source categories. The application does not store raw IP addresses, visitor identities or location. Temporary HMAC-derived network buckets support abuse controls, not visitor identification. Hosting-provider logs are addressed separately in the privacy policy.
Validation and abuse controls
Server-side checks validate Origin, JSON shape, allowed event types and request size. Parameterized SQL is used for database writes. Application quotas and an edge rate-limit rule constrain collection requests. Internal paths are blocked and public errors use fixed messages. These controls reduce risk; they are not a guarantee of security.
Search, accessibility and usability
The site uses consistent full-name identity, page descriptions, canonical URLs, structured data, internal links and an XML sitemap. Review covered responsive layouts, contrast, keyboard navigation, dialog focus and descriptive controls. These are implementation checks, not a claim of top search rankings or an accessibility certification.
Release and recovery
The migration record includes local tests, non-destructive hosted checks, dependency review, source backups and operating instructions. Cloudflare D1 Time Travel was exercised on a disposable fixture database, not restored against production. Source archives do not replace a backup of live data or account access.
What is live, and what still needs verification
The portfolio is public on its custom domain and independent hosting. Production scheduling, daily summaries and a live résumé-click alert were verified on October 15, 2026 through the private delivery records and Telegram acceptance. Healthy website checks and daily cleanup records were also observed. An outage/recovery alert and a full 30-day production retention cycle have not been tested.
What the work demonstrates
A public portfolio on my own domain and hosting account, with documented controls and a repeatable update process. The work demonstrates how I translate a goal into requirements, review AI-generated output and follow a project through launch.
My role: product direction, content, prompts, design feedback, provider choices and review of the result. ChatGPT and Codex assisted with code, configuration, testing and deployment. This is a personal project, separate from PKF Antares and Coolumba.