Publishing Your Archive

There are two ways to publish your archive: using the archivebox server or by exporting and hosting it as static HTML.


1. Use the built-in web server

# set the permissions depending on how public/locked down you want it to be
archivebox config --set PUBLIC_INDEX=True
archivebox config --set PUBLIC_ADD_VIEW=True
archivebox config --set PERMISSIONS=public        # default visibility of newly created snapshots (was: PUBLIC_SNAPSHOTS=True)
archivebox config --set BASE_URL=https://archive.example.com
archivebox config --set SERVER_SECURITY_MODE=safe-subdomains-fullreplay

# create an admin username and password for yourself
archivebox manage createsuperuser

# then start the webserver and open the web UI in your browser
archivebox server 0.0.0.0:8000
open https://web.archive.example.com

This server is enabled out-of-the-box if you’re using docker-compose to run ArchiveBox. If hosting publicly, it’s essential to place an SSL termination server in front of ArchiveBox. The bundled compose file includes opt-in https (Traefik) and tunnel (Cloudflare Tunnel) profiles, or you can bring your own reverse proxy such as traefik, caddy, or cloudflared.

[!TIP] Advanced: You can use nginx to serve a static export directly from the filesystem. Do not proxy live replay paths back onto the admin origin; use ArchiveBox’s security-mode routing.


2. Export and host it as static HTML

archivebox list --html --with-headers > index.html
archivebox list --json --with-headers > index.json

# then upload the entire output folder containing index.html and archive/ somewhere
# e.g. github pages or another static hosting provider

# you can also serve it with the simple python HTTP server
python3 -m http.server --bind 0.0.0.0 --directory . 8000
open http://127.0.0.1:8000

Here’s a sample nginx configuration that works to serve your static archive folder:

location / {
    alias       /path/to/your/ArchiveBox/data/;
    index       index.html;
    autoindex   on;
    try_files   $uri $uri/ =404;
}

Make sure you’re not running any content as CGI or PHP, you only want to serve static files!

Legacy timestamp URLs remain available through compatibility symlinks, for example: https://demo.archivebox.io/archive/1493350273/wget/en.wikipedia.org/wiki/Dining_philosophers_problem.html



Security Concerns

[!CAUTION] Re-hosting untrusted archived content on the same origin as an authenticated application can compromise that application.

Make sure you understand the dangers of hosting untrusted HTML/JS/CSS. The default SERVER_SECURITY_MODE=safe-subdomains-fullreplay separates the admin, web, and API control planes from replay content, and gives each Snapshot its own replay subdomain. Admin cookies are scoped away from those replay origins.

This mode requires wildcard DNS and TLS for *.archive.example.com. If your deployment cannot provide wildcard subdomains, use SERVER_SECURITY_MODE=safe-onedomain-nojsreplay, which keeps one origin but disables JavaScript replay.

Do not serve ArchiveBox from a shared subdirectory such as myapps.example.com/archivebox/; it cannot provide the required origin isolation. If you do not need JavaScript-capable replay, you can also disable the relevant extractors with WGET_ENABLED=False and DOM_ENABLED=False.

More info: