Docs

URL Redirects and Rewrites

Overview

The WAF performs exactly one kind of redirect: HTTP to HTTPS on your domain (see Forcing HTTPS).

It cannot create any other redirects or rewrites. That includes:

  • Apex to www (example.com to www.example.com) or the reverse
  • Path redirects (/old-page to /new-page)
  • Domain forwarding (old-domain.com to new-domain.com)

If you need one of these, set it up in one of two places.

Option 1: DNS-Level Forwarding

Many DNS providers offer a redirect or forwarding feature that works well for whole-domain cases like apex to www. Look for “URL forwarding”, “URL redirect”, or “domain forwarding” in your DNS provider’s control panel.

Note the tradeoff: a forwarded hostname points at the forwarding service instead of the WAF, so a forwarded apex is served only through www. If you want the site itself to load on both hostnames, point both at the WAF and skip forwarding.

One caution: make sure the forwarding service serves a valid SSL certificate for the redirected hostname. A forwarding record on your apex that does not handle HTTPS will show visitors a certificate error before the redirect happens. If you are seeing exactly that symptom (www works, the bare domain shows a certificate warning), see Troubleshooting Apex Domain SSL Errors.

Option 2: Application-Level Redirects

For path-based or conditional redirects, handle them in your application. Every web framework supports this: redirect_to in Rails routes, res.redirect in Express, Django’s RedirectView, and so on. Application-level redirects pass through the WAF like any other response, so no WAF configuration is needed.

This is the right choice whenever the redirect depends on the path, query string, or any request logic.

Need Help?

If you are not sure which approach fits your setup: