Redirect rules on Cloudflare

Two products for redirection

Cloudflare's redirect tooling now splits into Single Redirects and Bulk Redirects, both in the Rules product, and both free on every plan. They replace the older Page Rules 301 approach for new work.

Use Single Redirects for a handful of rules that can rewrite the path; use Bulk Redirects when you have thousands of old URLs to map and want to keep them in a spreadsheet, CSV, or API list rather than a pile of zone rules.

The dynamic rule that covers most cases

A classic redirect rule ("old folder to new root") is a Single Redirect with a wildcard:

• When: http*://*.example.com/old-folder/*
• Then: https://example.com/${1} (dynamic target uses ${1} and ${2} for the captured groups)
• Status: 301

The dashboard's "Create rule > Redirect Rule" flow builds these without writing code, and the expression builder accepts either a wildcard pattern or a custom filter expression. The equivalent dynamic rule with a custom expression (where you need more than a folder swap) uses the request fields directly.

When to use Bulk Redirects

Bulk Redirects read from uploaded lists, with limits per account across all lists (Free: 10,000, Pro: 25,000, Business: 50,000, Enterprise: 1,000,000 URL redirect entries). They are static: one source to one target, optionally with query-string preservation and host-weighting. That fits a migration redirect map (thousands of rows exported from a spreadsheet), where you do not need per-row logic.

Plan limits to know

• Single Redirects: 10 rules on Free, 25 Pro, 50 Business, 300 Enterprise (per zone). Regex is Business+ only.
• Bulk Redirects: rule count 15 (Free-Pro-Business), 50 (Enterprise); list count 5 (or 25 Enterprise); total entries as above.
• Redirect Rules, Cache Rules, Transform Rules, and others share the same Enterprise rule ceiling (300), so a "can I add one more redirect" question is really "how many rules does my plan allow in total".

Redirection order (and the gotcha)

Rules run in a lightly numbered order; a redirect rule matching a request forces the response before later rules (like security or header transforms) normally run. The documented gotcha: a Bulk Redirect runs after WAF. If a firewall/rate-limit rule blocks the request first, the bulk redirect never fires, and analytics still record the WAF event. Single Redirect rules run earlier in the pipeline. So if a redirect must fire even under a block, prefer a Single Redirect or review the WAF rules that could swallow the request.

Do not use Cloudflare redirect rules to replace origin 301 logic wholesale

Redirect rules are ideal for maintenance, launch-era URL changes, and domain moves. They are not a place to offload every 301 a CMS or framework handles correctly already, because:

• the origin can combine a 301 with other logic (headers, cookies, a hint on the old path),
• a CDN redirect bypasses any origin-side handling of that request,
• the HTTP 301 guide covers launch-time redirect maps and SEO guidance, and Site Insurance maps work better at the origin.

Keep one owner for the redirect map (the redirect map for migrations article) and implement the parts that need the widest coverage at the edge where it is cheapest.

Test and verify

Deploy the rule, then hit one matching URL and read the response line. Cloudflare's "Test" tab on a rule you are editing is also available. Confirm the status code (301 for a permanent move, 308 to preserve HTTP method), and that the rule survives an origin outage (an edge redirect answers without the origin at all, which is the point of putting the rewrite at the edge). For a wildcard pattern, test both a match and a near-miss (an extra segment or a missing slash) to catch a silent miss like /folder without the trailing slash not being captured.