# 18-May-2026 — Cloudflare edge apex/www redirect for environment domains [ref #274](https://github.com/nbarrett/ngx-ramblers/issues/274)

## [build 648](https://github.com/nbarrett/ngx-ramblers/actions/runs/26038096516) — [commit 4c65c42](https://github.com/nbarrett/ngx-ramblers/commit/4c65c4244d8cdf2215116833d511074efa1a65a4)

_____

When a Facebook Page link is tapped on a mobile device, Facebook strips the protocol and the `www`, leaving a bare address such as `ekwg.co.uk/social`. The bare apex domain `ekwg.co.uk` had no DNS record at all, so those links failed for everyone on a phone: an error page on Android, "page not found" on iPhone.

This release adds an **apex / www redirect** capability that fixes it. It 301-redirects the bare apex (or `www`) variant of a domain to the host the site is actually served on, so `ekwg.co.uk/social` now reaches `https://www.ekwg.co.uk/social` in a single hop, with the path and query string preserved. The redirect runs at Cloudflare's edge and never reaches the application.

**What the feature provides:**

- A Cloudflare Dynamic Redirect rule (301) plus a proxied placeholder DNS record, so the apex resolves and redirects.
- Automatic reconciliation during environment setup: attaching a custom domain now sets up its apex/www sibling redirect, and removing a domain cleans up after itself.
- An **Apex / www redirect** control on the Environment Management screen for applying the redirect to an existing environment.
- A `subdomain apex-redirect <env> <hostname>` command-line equivalent.

## Setting it up
___________
**Note that this functionality can only be reached by "multi-site" administrators**
___________

Open **Admin → Environment Management**, select the environment, choose **Modify Environment**, and find the **Apex / www redirect** box under Custom Domains. Enter the hostname the site is served on (for EKWG that is `www.ekwg.co.uk`) and press **Set up redirect**.

### What is needed first: the Cloudflare token permission

The redirect is created as a Cloudflare **Single Redirect** rule, so the Cloudflare API token must be allowed to manage those rules. Without that permission the run fails at the redirect-rule step.

To add it, open the Cloudflare dashboard, go to **My Profile → API Tokens**, edit the token in use, and add one permission row:

- **Scope:** Zone
- **Permission group:** Single Redirect
- **Access:** Edit

Confirm the relevant zone (for example `ekwg.co.uk`) is included under Zone Resources, then Continue and Save. Editing a token's permissions does not change its secret, so no other configuration needs updating.

### Unhappy path: token without the permission

This is the result when the token has **not** yet been given the Single Redirect permission. The run fails at the redirect-rule step with `Failed to update dynamic redirect rules: Authentication error`. Nothing is created: the redirect rule is attempted before any DNS change, so a failed run leaves no half-finished state to undo. Adding the permission described above and running it again is all that is required.

![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/3b1c82c6-e149-4811-8aa7-ec64efd095d9.jpeg)

### Happy path: token with the permission

With the **Single Redirect → Edit** permission on the token, the same run completes end to end: the token verifies, the Cloudflare zone resolves, the 301 redirect rule is created, and the proxied apex DNS record is added. `ekwg.co.uk`, and any path on it, now redirects to `https://www.ekwg.co.uk`.

![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/e38492d9-3218-4bee-9a01-85f40ade6e7f.jpeg)