I built a privacy-first URL shortener that runs on plain shared hosting
Every URL shortener tutorial reaches for Redis, a queue, or a paid link API. I wanted one that survives on the cheapest shared hosting a hobby project can afford: plain PHP and MySQL, nothing else. No background workers, no external services on the hot path, and still real click analytics. Here is how I built it, and you can try the result here: Free URL Shortener with Analytics . The constraints…
Building a privacy-focused URL shortener on budget hosting is the focus of this article. Inexpensive shared hosting typically provides only basic PHP and MySQL functionalities, lacking advanced features like Redis, Memcached, or cron jobs. Cloudflare CDN is employed for caching redirects. The design rule is straightforward: all redirect needs must be met via a single SQL lookup, and any additional features must not rely on extra infrastructure.
The data model comprises two tables: one for short URLs and another for click events. A UNIQUE KEY on the shortened URL code ensures that multiple users attempting to claim the same alias won't conflict, with the database rejecting the unsuccessful application. The redirect redirects via a request interceptor, operating on WordPress' init hook.
Any path matching the pattern /s/code is intercepted, resolved, and sent before rendering the page. A no-cache header is added to prevent caching of redirects, ensuring accurate click analytics.
No scheduled cleanup is required for expiry management. Instead, expiry enforcement is integrated into existing operations: on each redirect, expired links are deleted immediately with a 410 status code; during creation and analytics queries, any expired links are removed with a simple sweep query. This approach prevents expired links from redirecting even if they exist momentarily in the database.
Click analytics recorded only timestamp, referring domain (host name only), and device bucket derived from the user agent, maintaining user privacy by avoiding the collection of IP addresses, full user agents, or cookies.
To prevent abuse, Google Safe Browsing scans every destination URL during creation, rejecting any known phishing or malware sites before they become public short links. Cloudflare Turnstile adds an optional bot-protection layer to the creation form. These security measures are optional and fail-safe if not configured, ensuring the tool retains functionality even without these safeguards.
Despite being a privacy-focused project, the shortener is freely available online, offering custom aliases, time-limited links, and comprehensive analytics. Questions about its implementation are welcome in the comments section.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
