How to Host a Presentation Online Securely

How to host a presentation online with controlled access

It is easy to send a presentation by email. It is harder to know what happens next. The client can open it, forward it, download it, or forget it under 40 newer messages. You then have to guess when to follow up.

This tutorial shows how to host a presentation online as a controlled link instead of an attachment. The example is a fictional “Magic Stories” pitch deck. You will pick a hosting option, prepare the file, and set up access. Then you will test the link as the recipient and read viewer activity without reading too much into it.

In short, for viewer data on each page, use a tracked document link from DocSend or Papermark. A tracked document link records each visit. If you host the deck yourself, put it on Cloudflare Pages behind Cloudflare Access. Access records who signed in. If your team already works in Google Slides, share the deck with named people. Use the Activity dashboard if your account supports it.

Choose how you will host the presentation

The right option depends on two questions: who can open the deck, and how much you need to know about the people who opened it.

Option	Who can open it	What you learn about viewers	Good fit
DocSend or Papermark tracked link	Anyone with the link, or only people who enter (or verify) an email that you allow	For each visit: email (if required), time spent, and how far into the deck the visitor got	Proposals, fundraising decks, sales decks
Cloudflare Pages behind Cloudflare Access	Only email addresses or domains that you allow, after a one-time code	Who signed in, when, from which country	A PDF or HTML deck that you want on your own domain
Google Slides shared with named people	Only Google accounts that you add	Viewer list in the Activity dashboard, for files owned by a work or school account	Teams that already work in Google Workspace
Static host with one shared password (Netlify, Vercel)	Anyone who has the password	Nothing for each person	Low-risk decks for a small known group

A shared password keeps casual visitors out, but it cannot tell you who opened the deck. Password protection is also a paid feature on both hosts. Netlify offers it on Pro plans, and Vercel offers it on Pro and Enterprise, not Hobby. If you need to see who viewed the presentation, pick one of the first three options.

Prepare the presentation file

For every host, clean the file before it leaves your computer:

• Export the slides to PDF. A PDF keeps fonts, images and spacing the same on every device. Keep the original slides file as your source.
• Remove the content that is not for the client. Speaker notes, hidden slides, comments, old pricing and internal file names often stay in the file after an export.
• Make sure that the document properties contain no private details. Author names, company names and template titles can be in the PDF metadata (the hidden data about the file).
• Use a plain file name. In a browser tab, magic-stories-presentation.pdf is easier to read than final-v7-new.pdf.
• Test every link in the deck. A link to an internal tool or an expired demo makes the whole deck look unfinished.

If the presentation includes a live demo or HTML slides, keep the demo in its own folder. Put an index.html at the top of that folder. Then you can host the demo next to the PDF.

Option 1: Share a tracked link with DocSend or Papermark

Tracked document tools do this exact job. You upload a PDF, create a link with access rules, and see each visit.

DocSend

1. Upload the PDF to your DocSend Content library.
2. Create a link for it. Under Viewing requirements, choose Require an email to view. If you need proof that the visitor controls that inbox, choose Verify email to view. Email verification is available on the Advanced, Advanced Data Rooms and Enterprise plans.
3. If you want a second layer of protection, add password protection. Turn Allow downloads off unless the client needs an offline copy. For time-limited offers, use Set an expiration date.
4. For a known buying group, use Allow or block viewers by email. Limit the link to their addresses or their company domain.
5. Turn on visit alerts. Open Settings > Notifications, and then enable As Visits Occur. Each alert includes the device and the approximate location of the visitor. It also includes the percentage of the document viewed and the time spent (DocSend notification settings).

With verification on, the visitor gets an email with a verification link. The visitor must open this link on the same device. Because of this, a forwarded link is much less useful.

Papermark

Papermark links support the same kinds of rules. A link can require an email and verify it with a one-time code. It can also have a password and an allow list or deny list of emails and domains. You can control downloads, which are off by default, and set an expiration date. Links also support view notifications, a watermark and screenshot protection (Papermark link settings).

Each recorded view includes the email and the country of the viewer, and the time spent. It also shows the number of seconds on each page (Papermark view tracking).

For the Magic Stories deck, a good setup has email verification on, downloads off, and notifications on. It also has an allow list with the domain of the client.

Option 2: Host the deck yourself on Cloudflare Pages with Cloudflare Access

Use this option if you want the deck on your own domain. Also use it for an HTML presentation instead of a PDF.

1. Build a small landing page

A landing page is the first page that visitors see. Put the PDF in a folder with an index.html file. This page says what the deck is and what you want from the reader:

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Magic Stories: concept presentation</title>
</head>
<body>
  <h1>Magic Stories: concept presentation</h1>
  <p>Please review pages 6 to 10 (launch schedule) before our call on Thursday.</p>
  <p><a href="magic-stories-presentation.pdf">Open the presentation (PDF)</a></p>
  <p>Questions? Reply to the email that brought you here.</p>
</body>
</html>

2. Upload the folder

In the Cloudflare dashboard, open Workers & Pages. Select Create application > Get started > Drag and drop your files. Name the project and drag in the folder. Then select Deploy site (Cloudflare Pages Direct Upload). The deck is now live at <project>.pages.dev. It stays public until you finish the next step.

If you want a custom domain, add it now. Cloudflare notes that you cannot add a custom domain that already has an Access policy on it.

3. Put Cloudflare Access in front of it

1. In the Pages project, go to Settings > General. Select Enable access policy. This setting alone protects only preview deployments, the test copies with their own addresses (preview deployment access).
2. To also protect the production <project>.pages.dev address, open the Access application that Cloudflare created. Remove the wildcard from its subdomain field. Then enable the preview policy again. Cloudflare describes these steps on its known issues page.
3. For a custom domain, create a separate Self-hosted and private application in Zero Trust. Use that domain as its public hostname (self-hosted applications).
4. Give the application an Allow policy. Use the Emails selector for named people. Use Emails ending in for everyone at the domain of the client (Access policies).
5. Under Zero Trust > Integrations > Identity providers, make sure that One-time PIN is enabled. Visitors enter their email address and receive a code. The code expires after 10 minutes. Visitors paste the code in. Cloudflare sends the code only to addresses that an Allow policy accepts (One-time PIN).

Our Cloudflare Pages password protection guide shows the Access setup in more detail.

4. See who opened it

In the Zero Trust dashboard, open the Logs section. Select Access authentication logs. Each entry shows the email of the user, the application and the time. It also shows the IP address and country, and whether Access allowed the visit (Access authentication logs).

These logs record sign-ins, not reading. They do not show which slides someone looked at or how long the person stayed. For total page views on the landing page, enable Web Analytics. It is under Workers & Pages > your project > Metrics (Cloudflare Web Analytics). If you need the reading time for each page, Option 1 is the better fit.

Option 3: Share from Google Slides

Use these steps if the deck is in Google Slides and the client uses Google accounts:

1. Click Share. Add the email address of each recipient. Give each recipient the Viewer role.
2. Keep General access set to Restricted, so that only the people that you added can open it.
3. If you do not want offline copies, open the sharing settings. Turn off downloading, printing and copying for viewers (Google Drive sharing).

To show who viewed a file, Google Docs, Sheets and Slides have an Activity dashboard. It works only for files that a work or school account owns. Also, each viewer can hide their own view history, so the list can be incomplete (Activity dashboard privacy).

Do not use File > Share > Publish to web for a confidential deck. With some account settings, this option can make the file visible to everyone on the web (Publish to web).

Test the link as the recipient

Your own browser is signed in to every tool that you used, so it hides access problems. Open the link in a private window or a separate browser profile. Then make sure that:

1. The page asks for an email, code or password before it shows anything.
2. No file name, preview image or page title shows private details before sign-in.
3. The tool refuses an email that you did not allow, or that address never receives a code.
4. An allowed email gets in, and the deck opens on a phone as well as a laptop.
5. Downloads work the way that you set them, and every link inside the deck works.

Five minutes of testing can prevent a week of confusion.

Send the link with context

A bare URL looks suspicious and is easy to ignore. Say what the page contains, how to open it, and what you want from the reader. If you use a shared password, send it in a separate message.

For example: I have shared the revised Magic Stories concept deck at the link below. Sign in with your work email and you will get a one-time code. Please review pages 6 to 10 before our call on Thursday, especially the launch schedule.

This message gives the reader a specific task. It also gives meaning to later activity data, because you know which pages matter to the decision.

Read viewer activity without overreading it

Treat activity as a signal. It does not tell you what the reader thinks. A visit shows that someone opened the link. It does not show agreement or budget approval, or that the person read every page.

Signal	Reasonable reading	Risky assumption
Link opened	Someone with access reached the deck	The deal is about to close
Several pages viewed	The deck received some attention	The reader read every page carefully
Pricing page viewed for a long time	Pricing is on the mind of the reader	The client approved the budget
File downloaded	The recipient wanted an offline copy	The recipient accepted the terms
Return visit	The deck is still relevant	The same person made every visit

Time zones, forwarding, shared devices and browser privacy settings can all affect the record. Read each event as limited evidence.

Follow up without sounding invasive

Use activity to choose the time of your follow-up. Do not use it to decide what to say about the behavior of the reader.

• Reply quickly to direct questions. A written question is worth more than any view count.
• If the client opened the deck but did not reply, wait for a reasonable review period. Then follow up on the topic: I wanted to check whether the launch options raised any questions.
• Never quote tracking details. A sentence such as I saw you spent two minutes on page nine makes tracking feel like surveillance.
• If no activity shows, first make sure that the email arrived. Sometimes the email is in spam, or the address of the recipient is not on the allow list.

Our guide on following up after sending a proposal gives more detail about timing and wording.

Collect feedback in one place

A presentation usually needs a response, not only a view. Ask for one clear action on the landing page or in your email:

• Approve or reject the proposed direction.
• Comment on named slides or sections.
• Book a call.

If you host the deck yourself, a form is the easiest way to collect answers. Google Forms gives you an embed snippet from the More menu > Embed HTML (embed a Google Form). An embed snippet is HTML code that you put in your page. On Netlify, after you enable form detection, a plain HTML form with a data-netlify="true" attribute collects submissions without a backend (Netlify Forms). Keep the form short. A name, a contact method and one comment field are often enough.

Tell viewers what you record and why, especially when you require an email. Keep activity records inside your team. Delete the records that you no longer need.

Update the deck without changing the link

Presentations change. A client finds an old date, the pricing changes, or you replace a slide before a meeting. Keep one link and update the content behind it:

• In DocSend, open the file in the Content library. Select Replace and upload the new version. Existing links show the new file. DocSend does not notify visitors, so if the change is important, tell them yourself (update content in DocSend).
• In Cloudflare Pages, open the project and select Create a new deployment. Then upload the updated folder. The production address stays the same.
• In Google Slides, everyone with access sees your edits immediately. If you need the old version for reference, edit a copy.

After every update, make sure that the access rules are still on and that old downloadable copies are gone. Also make sure that links and forms still work. Then send a short note: Pages 8 and 9 now include the revised schedule and budget.

Common mistakes when you host a presentation online

Avoid these mistakes:

• Do not choose public access out of habit. A proposal or strategy deck usually needs an email rule or at least a password.
• Do not use one password for everything. Use each shared password for only one deck or one client.
• Do not publish internal material. Hidden slides, notes and metadata stay in the file unless you remove them.
• Do not treat a shared password as proof of identity. It proves that someone had the password, not who that person is.
• Do not treat analytics as certain. Views are events, not opinions or authority to buy.
• Do not update the deck without a new test. A new upload can bring back downloads, break links or drop a page.
• Do not collect more data than you need. Ask only for data that you can explain and protect.
• Do not forget the next step. A deck with no clear request often gets no answer.

For sensitive client work, pick a host that connects access to an email address. Test the exact link in a private window. Use what you learn to choose the time of a helpful follow-up, not to watch the reader.

Free email addresses
for your AI agents

Each agent gets an address like myagent.x7k2@revdokumail.com. It can receive emails, send replies and store files.

• 3 free mailboxes, each with its own address
• 3,000 incoming and 500 sent emails a month
• 3 GB of storage for attachments and files
• Virus, malware, spam and prompt-injection filter
• Read and reply through API, MCP or CLI

Create free mailbox

You do not need a card.