The whole market, on their own pages.

The build

Stack

Astro · Cloudflare Workers · D1 · direct RMLS listing feed

Scope

Real estate site for a Bandon brokerage. Listings pull straight from the RMLS feed, so the page shows current inventory with no third-party IDX widget. Map, search, and dunes-distance context built in.

Result

Live with real RMLS listings, mobile-first, measured on the wall above.

What a rented widget costs you

An IDX widget is a business decision disguised as a technical one. The listings inside it are not on your site in any way search engines count, so the traffic they earn is not yours. The look is set by the vendor, so it drifts from your brand every time they redesign. It loads after everything else, so the slowest thing on the page is the one thing the visitor came for. And you pay for it monthly, forever, to have a worse version of your own inventory.

Pulling the feed directly costs more to build once and nothing after that. Every property becomes a real page at a real address on their domain. The search strip filters by price, type, beds, baths and area across nine South Coast towns, and it filters against the brokerage's own database rather than someone else's server.

How the listings work

The feed lands in D1, Cloudflare's SQL database, running at the edge next to the site itself. Pages render on demand from that data, so a price change or a new listing shows up without a rebuild and without anyone touching the site.

Their own listings lead. Below them sits the rest of the market, currently 1,326 properties, so a visitor who arrives looking for one house can see everything else without leaving. Grid and map views share one filter state. Each property has its own URL, its own photos and its own page, which is what makes it findable at all.

It fails soft. If the feed is unreachable the page still renders with the brokerage's own listings rather than showing an error where the inventory should be, because a real estate site that looks broken looks like a brokerage that is not paying attention.

The bug that only showed on the homepage

Two months after launch the security grade dropped from A+ to B on this site alone, with no code change to any header. The cause was worth the afternoon it took to find. Cloudflare applies the headers declared in a _headers file to static files only, never to pages the worker generates on demand. When the homepage converted to on-demand rendering so it could show live listings, it silently stopped receiving five of its security headers. Nothing had broken. The page had simply moved out from under the rule.

The fix was to set the headers in middleware, where every response passes through regardless of how it was made, and to gap-fill only so nothing already correct gets overwritten. The grade came back at A+ 130, higher than it had been before the regression.

That is the part of maintenance nobody sells and everybody needs. A rented site would have shown the same drop and nobody would have looked.