{"id":"6a0b1eae3534181e53490b57","title":"2026 05 18 Issue 274","path":"how-to/committee/release-notes/2026-05-18-issue-274","contentMarkdown":"# 18-May-2026 — Cloudflare edge apex/www redirect for environment domains [ref #274](https://github.com/nbarrett/ngx-ramblers/issues/274)\n\n## [build 648](https://github.com/nbarrett/ngx-ramblers/actions/runs/26038096516) — [commit 4c65c42](https://github.com/nbarrett/ngx-ramblers/commit/4c65c4244d8cdf2215116833d511074efa1a65a4)\n\n_____\n\nWhen a Facebook Page link is tapped on a mobile device, Facebook strips the protocol and the `www`, leaving a bare address such as `ekwg.co.uk/social`. The bare apex domain `ekwg.co.uk` had no DNS record at all, so those links failed for everyone on a phone: an error page on Android, \"page not found\" on iPhone.\n\nThis release adds an **apex / www redirect** capability that fixes it. It 301-redirects the bare apex (or `www`) variant of a domain to the host the site is actually served on, so `ekwg.co.uk/social` now reaches `https://www.ekwg.co.uk/social` in a single hop, with the path and query string preserved. The redirect runs at Cloudflare's edge and never reaches the application.\n\n**What the feature provides:**\n\n- A Cloudflare Dynamic Redirect rule (301) plus a proxied placeholder DNS record, so the apex resolves and redirects.\n- Automatic reconciliation during environment setup: attaching a custom domain now sets up its apex/www sibling redirect, and removing a domain cleans up after itself.\n- An **Apex / www redirect** control on the Environment Management screen for applying the redirect to an existing environment.\n- A `subdomain apex-redirect ` command-line equivalent.\n\n## Setting it up\n___________\n**Note that this functionality can only be reached by \"multi-site\" administrators**\n___________\n\nOpen **Admin → Environment Management**, select the environment, choose **Modify Environment**, and find the **Apex / www redirect** box under Custom Domains. Enter the hostname the site is served on (for EKWG that is `www.ekwg.co.uk`) and press **Set up redirect**.\n\n### What is needed first: the Cloudflare token permission\n\nThe redirect is created as a Cloudflare **Single Redirect** rule, so the Cloudflare API token must be allowed to manage those rules. Without that permission the run fails at the redirect-rule step.\n\nTo add it, open the Cloudflare dashboard, go to **My Profile → API Tokens**, edit the token in use, and add one permission row:\n\n- **Scope:** Zone\n- **Permission group:** Single Redirect\n- **Access:** Edit\n\nConfirm the relevant zone (for example `ekwg.co.uk`) is included under Zone Resources, then Continue and Save. Editing a token's permissions does not change its secret, so no other configuration needs updating.\n\n### Unhappy path: token without the permission\n\nThis is the result when the token has **not** yet been given the Single Redirect permission. The run fails at the redirect-rule step with `Failed to update dynamic redirect rules: Authentication error`. Nothing is created: the redirect rule is attempted before any DNS change, so a failed run leaves no half-finished state to undo. Adding the permission described above and running it again is all that is required.\n\n![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/3b1c82c6-e149-4811-8aa7-ec64efd095d9.jpeg)\n\n### Happy path: token with the permission\n\nWith the **Single Redirect → Edit** permission on the token, the same run completes end to end: the token verifies, the Cloudflare zone resolves, the 301 redirect rule is created, and the proxied apex DNS record is added. `ekwg.co.uk`, and any path on it, now redirects to `https://www.ekwg.co.uk`.\n\n![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/e38492d9-3218-4bee-9a01-85f40ade6e7f.jpeg)","contentHtml":"

18-May-2026 — Cloudflare edge apex/www redirect for environment domains ref #274

\n

build 648 — commit 4c65c42

\n
\n

When a Facebook Page link is tapped on a mobile device, Facebook strips the protocol and the www, leaving a bare address such as ekwg.co.uk/social. The bare apex domain ekwg.co.uk had no DNS record at all, so those links failed for everyone on a phone: an error page on Android, "page not found" on iPhone.

\n

This release adds an apex / www redirect capability that fixes it. It 301-redirects the bare apex (or www) variant of a domain to the host the site is actually served on, so ekwg.co.uk/social now reaches https://www.ekwg.co.uk/social in a single hop, with the path and query string preserved. The redirect runs at Cloudflare's edge and never reaches the application.

\n

What the feature provides:

\n\n

Setting it up

\n
\n

Note that this functionality can only be reached by "multi-site" administrators

\n
\n

Open Admin → Environment Management, select the environment, choose Modify Environment, and find the Apex / www redirect box under Custom Domains. Enter the hostname the site is served on (for EKWG that is www.ekwg.co.uk) and press Set up redirect.

\n

What is needed first: the Cloudflare token permission

\n

The redirect is created as a Cloudflare Single Redirect rule, so the Cloudflare API token must be allowed to manage those rules. Without that permission the run fails at the redirect-rule step.

\n

To add it, open the Cloudflare dashboard, go to My Profile → API Tokens, edit the token in use, and add one permission row:

\n\n

Confirm the relevant zone (for example ekwg.co.uk) is included under Zone Resources, then Continue and Save. Editing a token's permissions does not change its secret, so no other configuration needs updating.

\n

Unhappy path: token without the permission

\n

This is the result when the token has not yet been given the Single Redirect permission. The run fails at the redirect-rule step with Failed to update dynamic redirect rules: Authentication error. Nothing is created: the redirect rule is attempted before any DNS change, so a failed run leaves no half-finished state to undo. Adding the permission described above and running it again is all that is required.

\n

\"\"

\n

Happy path: token with the permission

\n

With the Single Redirect → Edit permission on the token, the same run completes end to end: the token verifies, the Cloudflare zone resolves, the 301 redirect rule is created, and the proxied apex DNS record is added. ekwg.co.uk, and any path on it, now redirects to https://www.ekwg.co.uk.

\n

\"\"

\n"}