Ever stared at your link in bio and thought, “this thing is doing a lot of work for a stranger’s site”? Yep, same.
Mine pointed to a third-party hosted page. Three of my links inside it ran through their redirect domain before reaching the real destination. I’d been on autopilot with the setup for years, and my link in bio was easily the highest-tap link in my whole creator stack.
So I built one. It lives on my own blog. It’s free, the source is a route inside my affiliate-platform Cloudflare Worker, and the page your followers tap is on a domain I own. I’m calling it Bio Builder.
This post is what I figured out while building it. Not a tutorial. Just the choices I made and why.
What Bio Builder does
It’s a small web app. Any creator can build a hosted link in bio page in about a minute. You email yourself an edit link any time you want to change something. There’s an iframe embed if you want the bio to live on your own blog instead of staying on the hosted URL.
The free tier:
- 8 links across 4 audience sections
- 4 social accounts
- 4 themes (Warm Builder, Midnight, Sunset, Minimal) plus custom colors
- Real outbound links with a per-link affiliate nofollow checkbox
- Optional Amazon storefront card with the Associates disclosure built in
- A footer affiliate disclosure on every generated bio
Try it at jenbuiltit.com/bio-builder.
Four architectural choices I’d make again
One Worker, not a new service. Bio Builder is a route inside my existing affiliate-platform Cloudflare Worker. Same D1 database, same Resend sender already handling my other emails, same deploy. Adding a new product means a new route file, not a new piece of infrastructure to maintain.
An embed, not a script-tag widget. The hosted bio is a real URL on my domain. When you embed it on your own site, you’re embedding the URL inside an iframe. The CSS travels with the page, so the bio looks identical on every host. Auto-resize happens through a tiny script listening for messages from the iframe. No host-CSS conflicts to debug, ever.
Locked-down by default, with one targeted exception. The Worker sends strict security headers everywhere. The bio-view endpoint is the one place where the iframe-blocking header is relaxed, since by definition it needs to be iframable. Default lockdown plus one targeted exception is a pattern I’m using on more and more of my Workers.
No accounts, no passwords. You submit your bio with an email. To edit later, you request a magic link. The link is one-use, expires in 15 minutes, and proves you’re the owner. Lower friction for new users and one less attack surface to maintain.
Hosted on a third party vs. living on your own blog
| What your followers tap | Hosted on a third party | Lives on your blog |
|---|---|---|
| URL they see in the browser bar | a stranger’s domain | your domain |
| Where the click data goes | the third party’s analytics | your analytics |
| Affiliate parameters in outbound links | sometimes preserved | always preserved |
| FTC disclosure | sometimes, sometimes buried | built in, visible |
| Where the SEO value of the visit lands | the third party’s domain | your domain |
| Visual consistency across host sites | depends on the host’s CSS | identical (iframe) |
What I’d do differently next time
A few honest ones from this build:
- Ship rate limits from commit one. I didn’t, and the create, edit, and preview endpoints went out without throttling. Caught them on a follow-up security audit and fixed quickly, but they should’ve been in from the start. Standing rule for me now.
- Use a safe JSON-into-script helper from day one. I had a config blob interpolated into an inline script tag on the edit form. Harmless for the owner-only edit flow, but a latent self-XSS. Replaced with a helper escaping the angle brackets, ampersand, and the rare line-separator characters JSON treats as whitespace.
- Don’t trust continueOnFail for new nodes. My n8n feedback alert had it on, and the Gmail send silently errored with “invalid syntax (item 0)” because of nested-quote expression issues. The webhook returned ok:true anyway, the Airtable row was created, and the Gmail step failed without telling anyone. Always look at the node output directly during a new wire-up.
FAQ
Can I use Bio Builder if I don’t have a blog?
Yes. The hosted bio page works on its own at jenbuiltit.com/bio-builder/view/[your-id]. The blog embed is a nice extra when you’re ready, not a requirement.
How is this different from a typical hosted link in bio tool?
The hosted page lives on a domain I control. The embed lets your version live on a domain you control. Outbound links go straight to the destination URL with affiliate parameters intact, no redirect domain in the middle. The FTC disclosure is always visible, not buried. Beyond those, the feature set is intentionally small because the free tier should solve the main problem.
Does it cost anything to run?
Effectively no. Cloudflare Workers free tier handles 100k requests/day. D1 free tier handles up to 5GB. Resend’s free tier handles 100 emails/day. For Bio Builder traffic at any reasonable scale, the monthly cost is $0.
How long did it take to build?
The v1 took about a day with Claude Code doing the heavy code lifting under my direction. The embed architecture and the magic-link edit pattern had been on my mind for a while, so the build itself was mostly assembly. Polish (OG image, mobile fixes, em dash hunting, rate limits, security hardening) took another few hours once I started using it.
Is the source code open?
Not yet. The route file is in my private affiliate-platform repo. I might extract the patterns into a public Workflows & Blueprints post later if there’s interest.
Try it
If you want a link in bio living on your own blog instead of a stranger’s, head to jenbuiltit.com/bio-builder. Fill out the form (about a minute), drop in your links and socials, get a hosted URL plus an iframe embed code. Free, no card, no payment.
The simplest upgrade you can make to your social bio this week is pointing the URL your followers tap at your own domain.
More blueprints coming, including a pattern doc for this kind of hosted-page-with-embed setup. Subscribe if you haven’t already, and in the meantime, go forth and own your traffic instead of borrowing it.
