BuddyOSEngine

Buddy builds, hosts, operates and grows websites for small businesses on Cloudflare's network. This page describes what works right now, honestly, and what is still being built.

What BuddyOSEngine is

The goal is one place for everything a business website needs: building, hosting, domains, WordPress, files, staging, backups, analytics, forms, store and booking, with Buddy doing the work and one fair bill. Every module is included in every plan; heavy use is governed by fair-use allowances that ask before anything is cut off.

What works today

Sign in

Go to engine.ahmeego.com and choose Continue with Google. We only receive your name, email and profile picture. Your first sign-in creates a private workspace.

Build a site with Buddy

1. On Sites, choose New site.
2. Describe the business in plain words, then add its name, city, phone and email. Only facts you type are stated as facts on the site; Buddy will not invent licenses, reviews or awards.
3. Pick a layout recipe or leave it on Auto.
4. Choose Build with Buddy. Buddy studies top-selling themes for that kind of business in a real browser, then writes the pages. It usually takes 15 to 40 seconds.

Edit, photos, uploads

Open a site to edit any section. New sites come with original photos Buddy generates for that business. Next to every image field you can AI photo to generate a new one from a short description, Upload photo from your computer, or Find photo to search free, business-licensed photos. Credits for stock photos are added to your footer automatically. AI photos count toward your AI allowance.

Under Content & design, drag a section by its ⠿ handle (or use the arrows) to reorder it, and use Duplicate, Delete and Add section to shape the page. Section types include hero, text, features, steps, questions, pricing, contact form, links, embeds (YouTube, Vimeo, Google Maps, Calendly, GoHighLevel forms and calendars, Typeform, Mailchimp, Shopify), latest blog posts, products and booking. + Page adds a page. Save to update staging.

Blog

The Blog tab writes and lists posts. Posts appear at /blog/ with an RSS feed at /blog/feed.xml, are added to the sitemap, and a Blog link appears in the menu once a post is published. Buddy writes a draft from a topic using only the facts in your business profile. Import from WordPress brings posts over from a site address or a WordPress export file, with images, tags and dates, and redirects the old addresses.

Store

The Store tab holds products with price, a photo, inventory and a buy link. Products appear at /shop/. Paste a Stripe Payment Link, Shopify, PayPal or Square checkout link and visitors pay there; with no link, visitors send an order request that lands under Orders. Marking an order paid lowers inventory. Webhooks fire order.created.

Booking

The Booking tab sets services (length and price), weekly hours, your time zone, notice and buffer times. Visitors pick a free time at /book/; both sides get an email with a calendar invite and a cancel link, and a slot can never be booked twice. To take bookings on another website (WordPress, Shopify, GoHighLevel, Wix), paste the embed code shown on the tab. Webhooks fire booking.created and booking.cancelled.

Apps and integrations

The Apps tab connects analytics (GA4, Tag Manager, Meta Pixel, Microsoft Clarity), CRM (HubSpot, GoHighLevel chat widget and CRM), automation (Zapier, Make, n8n), commerce (Shopify Buy Button) and chat (Crisp, Tawk). CRM and automation apps receive every new lead, booking and order as a signed webhook. Admins can add custom head or body code. Apps only run on your staging and live addresses, never inside the dashboard, and the site's security policy is widened just enough for the apps you install.

Languages

The Languages tab adds any of 25 languages. Buddy translates every page, post, product and service; you can edit any translation. Each language gets its own addresses (/es/, /fr/about/), hreflang tags, a language switcher and right-to-left layout for Arabic and Hebrew.

Staging and going live

Every site has two copies. Staging is what you edit and preview; Live is what visitors get. Nothing you change reaches visitors until you choose Go live (builder sites) or Push staging to live (uploaded sites). The pipeline bar at the top of each site shows staging, live, address, SSL, last backup and health at a glance. Staging is never indexed by search engines.

Builder sites keep every saved version under Staging & deploys; restoring an old version creates a new one, so nothing is lost.

Host a site you already have

Choose New site → Upload a site, then drop a zip, a folder or individual files on the Files tab. Any static site works: hand-written HTML, a Next.js/Astro/Vite/Hugo build, or a static export of a WordPress site. Zips up to 50 MB (250 MB unpacked), files up to 25 MB, 5,000 files per zip. A single wrapping folder in the zip is removed automatically.

• Served: HTML, CSS, JavaScript, JSON, images (including SVG and AVIF), fonts, PDF, video, audio, WebAssembly.
• Skipped: server code (PHP, Node, Python) and hidden files. The upload tells you exactly what was skipped.
• /about serves about/index.html; a 404.html at the root is used for missing pages.
• Forms can post to /_engine/forms/<site id>/contact to land in your Leads tab.

Git deploy. On the Git & WebDAV tab, connect a GitHub or GitLab repository (a read-only token for private repos), the branch and the folder that holds the built site. Add the webhook shown there to the repository and every push deploys to staging, or straight to live if you turn on auto-publish. Other CI systems call the deploy hook after their build step, or upload files with a write API key: curl -X PUT -H "Authorization: Bearer $BOE_KEY" --data-binary @dist/index.html "https://engine.ahmeego.com/api/sites/$SITE/files?path=index.html".

WebDAV (SFTP-style access). Connect Finder (Go → Connect to Server), Cyberduck, Transmit or WinSCP to https://engine.ahmeego.com/dav/<site id>/, with your site name as the username and a write API key as the password. Changes land in staging.

On the dashboard origin, uploaded sites run in a sandbox so their scripts can never touch your account. On their own address they run normally.

Before anything goes live it is scanned for phishing pages, card skimmers, crypto miners and other code that could harm visitors. If something is found, nothing goes live and you are told exactly which file and why; contact support if it is a mistake.

Bring a site from another host

Choose New site → Bring my site and enter the address of your current site. Buddy reads the home page and up to 8 linked pages, rebuilds them on a faster design using your real wording, phone and email, generates new photos, and adds a 301 redirect from every old address (for example /about-us to /about/) so you keep your Google rankings. Nothing changes on your old site. When you are happy, point your domain here. You must own the site or have the right to copy its content.

Domains and SSL

Every site gets a free address, your-site.ahmeego.ai, plus a staging address, your-site--staging.ahmeego.ai, both with SSL. To use your own domain, open Domains, enter www.yourdomain.com and add the CNAME record shown at your DNS provider. Cloudflare verifies it and issues the certificate automatically, usually within minutes. Your email (MX) records are never touched. Root domains need CNAME flattening or ALIAS records; if your DNS host lacks them, connect www and forward the root to it.

Need a domain? The Domains page searches every major ending with real-time prices, registered at cost through Cloudflare Registrar with WHOIS privacy included. You pay at checkout and the domain is registered as soon as payment clears. Domains do not renew silently: you get reminders 60, 30 and 7 days before expiry. Renew pays for another year at cost; turn on Auto-renew and the saved card is charged 30 days before expiry.

Transfer a domain in from GoDaddy, Namecheap, Google/Squarespace or Wix: unlock it at the current registrar, copy the auth code, and enter both under Domains. The auth code is stored encrypted. A transfer adds a year and usually finishes within 5 days; your site keeps working throughout.

DNS and email forwarding

Domains bought here are managed under Domains → DNS & email. Add, edit and delete A, AAAA, CNAME, MX, TXT, SRV and CAA records, export the zone file, and turn on DNSSEC. One-click presets add the right records for Google Workspace, Microsoft 365, Zoho Mail, a DMARC policy, Google Search Console verification and certificate authority locks.

Email forwarding sends mail for addresses like hello@yourdomain.com to an inbox you already have. The destination confirms with a one-time email first. Forwarding is free; full mailboxes are on the roadmap, and the presets above connect a mailbox provider you choose.

Security, speed and redirects

The Security & speed tab controls how Cloudflare's edge answers visitors before your site is served. Changes take effect within 30 seconds.

• Password protection: lock staging for client review, or the whole site while it is being built. Signed-in workspace members skip the password on previews.
• Redirects: one per line, /old-page /new-page/, with an optional 302. A trailing * matches everything below a path.
• Blocks: by country or IP address range.
• Maintenance mode: visitors see a short message; staging keeps working.
• Bot shield and rate limiting: stop scrapers and floods; search engines are always allowed.
• HSTS and custom response headers.
• Purge cache for sites on their own domain.

SEO

The SEO tab scores the site and lists issues per page: missing or long titles, missing descriptions, images without alt text, heading order, missing sitemap or robots.txt, and broken internal links. For builder sites, Fix with Buddy writes the missing titles, descriptions and alt text into staging for you to review. Sitemaps, robots.txt, canonical links and structured data are generated automatically for builder sites.

Analytics, logs and health

The Analytics tab counts real visitors to your live site: visitors, page views, top pages, referrers, countries, devices and browsers, plus bots filtered out and average response time. No cookies and no IP addresses are stored; unique visitors use a salted hash that changes daily. Health checks run every 15 minutes (pages render, SSL is active, DNS points here), and you are notified when a site goes down and when it recovers. Sites on their own domain also show what Cloudflare's edge saw: cache hits, status codes, firewall actions and threats.

Real-user speed (turn on the Speed app) measures Core Web Vitals from real visitors: largest contentful paint, interaction to next paint, layout shift, first paint and server response, at the 75th percentile, for phones and computers separately, with the slowest pages listed.

The Logs tab lists every request for the last 3 days: time, path, status, response time, country, device, and which rule answered it (redirect, password, block). Every Monday Buddy emails a short report: visitors and leads against last week, what changed most, uptime and anything broken.

Backups

Every site is backed up nightly at 08:30 UTC and kept 30 days. Back up now takes a manual backup you keep until the site is deleted. A backup holds your content, every version, all leads and (for uploaded sites) every file, and a copy is kept in a second, separate store. Restore puts the backup into staging and takes a safety backup of the current state first, so a restore can itself be undone. Download gives you the backup as a file.

Lead forms

Contact forms on your site are protected by Cloudflare Turnstile, a hidden honeypot field and per-visitor rate limits. Submissions appear under Leads for that site.

Export your site

Choose Export to download your content, design and media. You are never locked in.

Usage and fair use

Usage & plan shows sites, AI credits, leads, storage, requests and domains. When you approach an allowance, Buddy asks before anything changes; nothing is switched off without warning.

Team members

Under Settings → Team, invite people by email. Invitations are single-use links that expire after 7 days. Roles: owner (everything, including billing and deleting the workspace), admin (everything except billing), editor (build, edit, upload, publish) and viewer (read only).

API keys and webhooks

Create keys under Settings → API keys. A key is shown once; we store only a hash. Send it as Authorization: Bearer boe_w_… to https://engine.ahmeego.com/api/. Read keys can only make GET requests. Write keys can build, edit, publish, upload and manage domains, but can never manage keys, team, billing or privacy, or delete a site. Useful endpoints:

Headless content API. Use BuddyOSEngine as the CMS behind your own front end (Next.js, Astro, a mobile app). No key is needed for live sites, and responses allow any origin: GET /api/public/sites/{slug}/content (business, pages, forms, posts, products and services), /posts, /posts/{slug}, /products, /products/{slug} and /services. Add ?lang=es for a translation.

Webhooks (Settings → Webhooks) POST JSON to your https URL for lead.created, order.created, booking.created, booking.cancelled, site.published, site.down, site.recovered, backup.failed, domain.registered and ticket.replied. Each request carries X-Boe-Signature: t=<ms>,v1=<hex>, an HMAC-SHA256 of t + "." + body with your endpoint secret. An endpoint that fails 20 times in a row is paused.

Plans and billing

Every module is on every plan; plans differ only by allowances. Launch $9/month (1 site, 2 domains), Grow $19 (3 sites, 6 domains), Business $39 (5 sites, 15 domains), Agency $99 (25 sites, 100 domains). Payment, invoices and card changes are handled by Stripe under Settings → Plans & billing. Domains are charged at registrar cost plus card processing. During alpha everything is free.

Getting help

Choose Support or Get help on any page. Buddy answers first, from these docs and your site's live status, in seconds. If that does not settle it, send it to a person in one click; the request includes the site, its health and recent activity so you do not have to explain twice. Platform status is always at /status. To report a site that is phishing or abusive, use /abuse.

How design research works

For each build, Buddy opens a real browser, finds best-selling templates for your industry on ThemeForest, Webflow and the Shopify Theme Store, and looks at their demos the way a designer would. It learns patterns (layout, type, spacing, photo style), never copies assets or text, respects every site's robots.txt, and stops if a site asks it to.

Security and privacy

• All traffic over HTTPS on Cloudflare; the dashboard cannot be framed and is not indexed.
• Each workspace's data is isolated; every change is written to an audit log.
• Uploads are type-checked by their contents, not their name, and scanned before going live.
• API keys and invitation links are stored only as hashes; webhooks are signed.
• Settings → Data & privacy downloads everything in your workspace, or deletes it permanently, including files and backups.
• Read the Privacy Policy, Terms and Acceptable Use Policy.

Roadmap

Next, in order: switching on free addresses, custom domains, domain purchase, transfers, renewals, DNS, email forwarding and paid plans; managed WordPress (PHP) with one-click migration from any host; then hosted mailboxes. See the status table above for what has shipped.