In early 2024 a developer woke up to a $104,500 invoice from Netlify. The site in question was a static site — no backend, no database — on a free plan with a nominal $0/month cost. Someone had pointed a flood of traffic at it, roughly 190 TB of it, and the platform had dutifully served every byte and metered it as overage. Netlify's CEO eventually waived the bill after the story reached the front page of Hacker News, which is not a dispute-resolution process you should plan around.

The same shape of story exists for most metered platforms: the startup that burned $72,000 on Google Cloud in a few hours through a runaway loop, the Firebase apps rung up for thousands overnight by scripted traffic, the AWS bills generated by strangers hammering a bucket the owner thought was idle. Different products, one cause: the platform's worst case was money, and there was no ceiling.

The three kinds of "free"

Every hosting free tier belongs to one of three billing shapes, and the shape matters more than the numbers on the pricing page.

1. Free with no card and no meter. The platform does not have your payment details, so its only possible response to excess usage is refusal: an error, a throttle, a suspended service. Cloudflare's free plan, GitHub Pages, Supabase, Neon, Turso, and Render's free tier all work this way. The worst case is downtime.

2. Free with a hard cap. There may be a card on file, but spending stops at a limit by design. Netlify's post-2025 credit system is this — one useful thing to come out of that invoice. The worst case is downtime at the end of the month.

3. A free allowance on top of a metered account. Firebase's Blaze plan, Google Cloud, AWS. The free tier is a discount, not a boundary; past it, every request converts to money at market rate, without limit, at machine speed. The worst case is debt, and the size of the worst case is set by your attacker, not by you.

Nothing in category three is dangerous when idle. It becomes dangerous at the exact moment something unexpected happens — a traffic spike, a scraper, a bug in your own retry logic — which is precisely the moment you are not watching.

Why budget alerts do not save you

Every metered cloud offers "budget alerts", and the name does a lot of quiet misleading. An alert is an email. It does not stop, throttle, or cap anything. Google Cloud's own documentation is plain that a budget does not prevent spending; it notifies you about it. The $72,000 Google Cloud incident took under two hours end to end. Alert emails were sent. They were read the next morning.

Some platforms let you build a real kill switch — on Google Cloud you can wire a budget notification to a small function that detaches the billing account, taking your project down but ending the bleeding. That works, and if you keep anything on a metered cloud you should install it. But notice what it is: a do-it-yourself circuit breaker for a product that declined to include one.

The decision rule

Before putting anything on a platform, ask one question: what is the worst thing that happens if a stranger sends this service a million times more traffic than I expect?

If the answer is "it goes down" — fine. Downtime on a hobby project costs nothing. This is the correct default for anything personal: sites, dashboards, bots, experiments. It is also, not coincidentally, what you get from a machine at home behind a free tunnel: your worst case is that your own hardware is busy.

If the answer is "I get billed" — the platform needs to clear a much higher bar, and you need three things in place from day one: a spending cap if it exists, a real kill switch if it does not, and a genuine reason the capped alternatives will not do. "The tutorial used it" is not such a reason.

Where that leaves a home server

A self-hosted box has plenty of real risks — power, disk failure, your own attention span — and this site does not pretend otherwise. But it is worth naming the risk it does not have. There is no meter. A flood of abuse against a service in your house saturates your connection, annoys you, and ends. It cannot compound at $0.55 per gigabyte while you sleep.

Pair that with a front door whose free plan also cannot bill you — a tunnel through an unmetered edge — and the entire attack-cost equation belongs to someone else's balance sheet. If you're weighing that trade, the honest version of when home hosting stops being enough is its own article. That combination, not raw performance, is the strongest argument for the home-server-plus-free-edge setup this site keeps coming back to: it is the only architecture where the answer to "what is the worst case?" is fully known in advance.

Money buys availability, and sometimes availability is worth buying. But debt should require your signature. Choose platforms where it does.