Redirect Your Apex Domain to Cloudflare Pages

Two Scenarios for Cloudflare Pages Custom Domains

Whether you can use Cloudflare's native solution or need a third-party redirect depends entirely on where your DNS is hosted, not where your site is hosted. Cloudflare Pages happily serves your site no matter who runs your authoritative DNS. The apex problem is purely a DNS problem.

Step-by-Step: Cloudflare Pages with Non-Cloudflare DNS

This is the most common case: you've shipped a Cloudflare Pages site but your domain's DNS is still at the registrar where you bought it. Here is the complete setup.

1. Open your Cloudflare Pages project in the Cloudflare dashboard, then go to Custom domains.
2. Click "Set up a custom domain" and enter www.yourdomain.com. Cloudflare verifies ownership and provisions an SSL certificate.
3. Copy the CNAME target Cloudflare gives you. It looks like your-project.pages.dev.
4. At your DNS provider, add a CNAME record: name www, value your-project.pages.dev. TTL: 1 hour or auto.
5. Add an A record on the apex: name @, value 65.21.184.101.
6. Add an AAAA record on the apex: name @, value 2a01:4f9:c012:a304::1.
7. Verify with curl -I http://yourdomain.com — you should see 301 Moved Permanently with Location: https://www.yourdomain.com/. Then load www.yourdomain.com to confirm the Pages site is live.

When NOT to Use ApexToWWW for Cloudflare Pages

We're a focused tool, not a hammer. Skip ApexToWWW if:

• Your DNS is on Cloudflare. Use CNAME flattening. It's native, faster, and one less external dependency. Add a CNAME on @ pointing to your-project.pages.dev and Cloudflare flattens it automatically.
• You want the apex to serve your site directly (no redirect, no www in the URL). For that you need ALIAS/ANAME records, which only some DNS providers offer. Cloudflare DNS does this transparently via flattening; if you can move DNS to Cloudflare, that's the cleanest path.
• You're already using Cloudflare Workers for routing logic. Bind a route on the apex and write the redirect in code — one fewer moving part.

ApexToWWW is the right answer when you can't or won't move DNS to Cloudflare — for example, your team owns DNS in Route53 with Terraform, your registrar's DNS is managed by IT, or you simply prefer to keep nameservers and CDN separate.

Meta-Note: This Site Runs on Cloudflare Pages

Other Platforms

The apex→www pattern is identical across most modern hosts. Same two records on the apex, only the www CNAME target changes:

• Vercel apex domain redirect
• Netlify naked domain setup
• Heroku custom apex domain
• GitHub Pages apex redirect
• Firebase Hosting apex domain

FAQ

Does CNAME flattening work with email MX records?

Yes. CNAME flattening only resolves the apex A/AAAA queries; MX, TXT, SPF, DKIM, and DMARC records are unaffected. You can run Google Workspace or Fastmail on the apex while Cloudflare flattens the CNAME for HTTP traffic. The classic "CNAME at apex breaks email" problem doesn't apply to flattened records.

Can I combine the Cloudflare proxy (orange cloud) with ApexToWWW?

No. If the orange cloud is on for the apex A/AAAA records, Cloudflare terminates TLS at its edge and the request never reaches the ApexToWWW server, so the redirect can't happen. Either set the apex records to DNS only (gray cloud), or use Cloudflare's CNAME flattening if Cloudflare is your DNS provider. You can absolutely keep the orange cloud on for the www record — that's between Cloudflare and your Pages project and works fine.

What if I use Cloudflare Workers instead of Pages?

Same shape. Bind your Worker to www.yourdomain.com via a route, then handle the apex with either ApexToWWW or CNAME flattening. Workers can also do the redirect themselves — a four-line script returning a 301 from example.com to https://www.example.com bound to the apex route is a perfectly good alternative if you're already paying for the platform.

Is ApexToWWW compatible with DNSSEC?

Fully. ApexToWWW is just A and AAAA records on your apex. DNSSEC is signed by your DNS provider over the zone contents and doesn't care what the records resolve to. Sign the zone as you normally would; the redirect works regardless.