Redirect Your Apex Domain to Firebase Hosting

Firebase's Official Approach

When you connect a custom domain in the Firebase Hosting console, Google issues you a pair of A records that look like this:

A    @    151.101.1.195
A    @    151.101.65.195

This works out of the box. Firebase serves your site directly from its global edge on the apex domain, and provisions a managed SSL certificate within minutes. For most sites this is fine. But there are a few real limitations of Firebase's apex direct setup:

• The IPs can change. Firebase has rotated edge IPs in the past during infrastructure migrations. When this happens, anyone hardcoding the old 151.101 addresses has to update their DNS or risk an outage. Google notifies customers, but missed emails happen.
• No IPv6 on the apex. Firebase's apex A records are IPv4 only. Visitors on IPv6-only networks resolve via NAT64 or fail. There are no AAAA records for the apex direct configuration.
• No HTTP/3 on the apex. The IPs Firebase issues for apex domains do not currently negotiate QUIC / HTTP/3. The www CNAME path does, because it routes through the full Firebase edge.

None of this breaks Firebase. But if you want IPv6, HTTP/3, and a stable apex configuration that survives Firebase IP changes, the cleaner pattern is to put your site on www and redirect the apex.

The ApexToWWW Approach — Step by Step

This setup keeps your Firebase site on www.yourdomain.com using the recommended CNAME path, and uses ApexToWWW to handle the apex 301 redirect. Total time: about 5 minutes plus DNS propagation.

1. Step 1. Open the Firebase Console, go to Hosting, and click Add custom domain. Enter www.yourdomain.com.
2. Step 2. Firebase will display a CNAME target (or, depending on the flow, an A record target) for your www subdomain. Copy this value.
3. Step 3. In your DNS provider, add a CNAME record: host www, value the target Firebase provided.
4. Step 4. Add an A record: host @, value 65.21.184.101.
5. Step 5. Add an AAAA record: host @, value 2a01:4f9:c012:a304::1.
6. Step 6. Wait for Firebase to verify www and provision its SSL certificate (usually a few minutes, occasionally up to 24 hours).
7. Step 7. Test: curl -I https://yourdomain.com → you should see HTTP/2 301 with a Location header pointing at https://www.yourdomain.com/.

DNS Records Summary

Comparison: Firebase A Records vs ApexToWWW

When to Use Firebase's A Records Instead

The ApexToWWW pattern is not always the right choice. Stick with Firebase's apex A records if:

• You want apex as the primary URL. Some teams prefer example.com as their canonical domain (no www at all). In that case you want Firebase serving content on apex directly — no redirect needed.
• You're OK with occasional DNS updates. Firebase IP rotations are rare, and Google notifies customers in advance. If your team has alerting on this, the maintenance overhead is low.
• You don't need IPv6 or HTTP/3 on apex. Most users hit www through bookmarks, links, and search anyway, so the apex performance ceiling matters less.

Otherwise, the redirect pattern wins on every dimension that matters — protocol support, IP stability, and zero ongoing maintenance.

Other Hosting Platforms

The same pattern works for any platform that prefers a CNAME on www:

• Cloudflare Pages apex redirect
• Netlify apex domain redirect
• Heroku apex domain redirect
• GitHub Pages apex domain redirect

Frequently Asked Questions

Does this work with Firebase App Check?

Yes. App Check protects your Firebase backend services (Firestore, Realtime Database, Cloud Functions) by verifying request origin, not by inspecting your DNS. Since the apex redirect happens outside Firebase entirely — ApexToWWW issues a 301 before the request ever reaches Firebase — App Check is unaffected. Your tokens are issued on the www origin where your app loads, just as they would be without the redirect.

What about Firebase Cloud Functions?

Cloud Functions called via Firebase Hosting rewrites work normally on the www origin. If you use a rewrite like "source": "/api/**", requests to https://www.yourdomain.com/api/foo reach your function as expected. Direct requests to https://yourdomain.com/api/foo get 301'd to https://www.yourdomain.com/api/foo first, which works for GET but can break POST bodies on some clients. Best practice: always call your API at the www origin from your frontend code.

SSL certificate renewal?

Both halves of the setup auto-renew. Firebase manages the certificate for www.yourdomain.com through Google's managed SSL infrastructure. ApexToWWW provisions a certificate for yourdomain.com via Let's Encrypt and renews it automatically every 60 days. There is nothing to monitor or rotate manually.

Preview channels and custom domains?

Firebase Hosting preview channels generate ephemeral URLs like yourproject--branch-abc123.web.app. These are independent of your custom domain and continue working the same way regardless of how your apex is configured. The ApexToWWW redirect only affects yourdomain.com; it doesn't interact with preview channels at all.