Attach and verify a custom domain

A Pages project starts life on a pages.dev hostname. That URL is fine for previews, but the real site needs your domain.

Add the custom domain through the project, in the Custom domains tab of the dashboard. This step does two things at once. Cloudflare creates or validates the required DNS record, and it provisions a TLS certificate for the hostname.

For a subdomain, the DNS side is a CNAME pointing at the project:

www.example.com  CNAME  my-site.pages.dev

When the zone is already on Cloudflare, the dashboard offers to create this record for you. An apex domain like example.com works too when the zone is on Cloudflare, because Cloudflare flattens the CNAME at the apex.

A resolving record is not enough

A DNS record that resolves is not enough if the project doesn’t know the hostname, or if the certificate is still pending.

Pointing DNS at pages.dev without registering the domain on the project gets you an error page, not your site. Adding the domain but testing before the certificate is ready gets you TLS failures.

So verify both layers before changing any links:

dig +short www.example.com CNAME
# my-site.pages.dev.
curl -I https://www.example.com
# HTTP/2 200

The dig answer proves DNS. The successful HTTPS response proves the certificate is active and the project accepted the hostname. In the dashboard, the domain’s status should read Active rather than Verifying.

Pick one canonical hostname

Decide which hostname is canonical, www.example.com or example.com, then redirect the other to it. Search engines treat them as different sites, and users paste both.

The redirect should be a permanent 301, and it should be configuration you wrote on purpose, not an accident of defaults.

Test it with curl -I:

curl -I https://example.com/pricing
# HTTP/2 301
# location: https://www.example.com/pricing

Check that the path survives the redirect. A redirect that sends every URL to the homepage throws away deep links.

Try this: connect a practice subdomain to a Pages project, inspect its certificate in the browser, and test the canonical redirect with curl -I from both hostnames.