Bulk URL redirects without the code

Keeping a website's links alive during domain moves, reorganizations, or acquisitions usually means maintaining a growing pile of redirect rules. Historically, Cloudflare users had two options: Page Rules (capped at 125 redirects per zone) or Cloudflare Workers, which required writing and deploying code. The new Bulk Redirects product removes that ceiling and the coding requirement, letting administrators upload and activate hundreds of thousands of redirects through the dashboard in minutes.

Redirects as mail forwarding

A URL redirect is a mapping from an old location to a new one. The mechanism is familiar to anyone who has used postal mail forwarding: the system keeps a register of old and new addresses, then reroutes anything addressed to the former to the latter. On the web, that register is a two-column table — the traffic being looked for and the destination it should be sent to. When a marketing team posts a vanity URL across dozens of sites and the backend later changes, only the intermediary redirect map needs updating, not every external reference.

Redirects serve a range of practical purposes beyond vanity URLs:

  • Security: forcing all HTTP traffic to HTTPS is itself a redirect. Cloudflare offers a "Always use HTTPS" toggle for this.
  • SEO and memorability: shorter URLs tend to rank slightly better in search results, per industry studies.
  • Market consolidation: redirecting country-specific domains like www.example.fr to the appropriate path on the main site.
  • Acquisitions: pointing a purchased company's old pages to relevant content on the acquiring site.
  • Migrations: preserving uptime and existing inbound links when a site moves platforms or domains.

How redirects were done before

Redirects are traditionally the job of the reverse proxy that sits in front of the origin server. In an on-premises NGINX setup, an administrator could edit the server config directly. As workloads moved to hosted platforms, that low-level access disappeared, pushing administrators toward edge services like Cloudflare that implement redirection in the cloud.

Cloudflare's existing mechanisms both had limitations. A Forwarding URL Page Rule matches a specific URL and issues a 301 or 302 to a target, but the 125-rule ceiling forces larger users elsewhere. Cloudflare Workers can scale redirects indefinitely using a code-based map, as in the Workers examples library's bulk redirect snippet, but the approach requires comfort with writing and maintaining code.

Two building blocks: lists and rules

Bulk Redirects is an account-level product available on all plans, built from two components. The Bulk Redirect List — effectively the "edge dictionary" — stores the redirect entries uploaded by the administrator, either manually or via CSV. Each entry holds three core fields: the source URL, the target URL, and the status code.

  • Status codes: support now includes 301 (Moved Permanently), 302 (Found), and the newer 307 (Temporary Redirect) and 308 (Permanent Redirect).
  • Custom ports: target URLs can specify a destination port, e.g., www.example.com:8443.

A list by itself does nothing — it is just a lookup table. To activate it, the administrator references it from a Bulk Redirect Rule. The default rule setup is a name, description, and list selection; an Advanced options toggle exposes two more fields for finer control:

  • Expression: conditions that must be true for the rule to execute, e.g., ip.src.country == "GB" and http.request.full_uri in $redirect_list. This can restrict redirects by geography, ASN, or bot score.
  • Key: the field from the request used for lookup in the list. The key should always match the field used in the expression — either both http.request.full_uri or both raw.http.request.full_uri. Using the raw variant matters when URL lists contain percent-encoded characters that would otherwise be normalized before lookup.

Wildcards replaced with explicit flags

Bulk Redirects deliberately avoids asterisk wildcards, which are ambiguous (does *.example.com/a/b also match the bare apex? what about paths containing a star?) and more expensive to implement and test. Instead, two per-redirect options provide equivalent functionality with clearer semantics:

  • Include subdomains: a source URL of example.com/a will redirect traffic for b.example.com/a and c.b.example.com/a as well.
  • Subpath matching: a source URL of www.example.com/foo matches itself and its subpaths like www.example.com/foo/a, but not similar-looking URLs such as www.example.com/foobar.

Two additional flags preserve parts of the original request:

  • Preserve path suffix: copies the URI path from the incoming request onto the end of the target URL. Redirecting example.co.uk to www.example.com/a sends requests to example.co.uk/target to www.example.com/a/target.
  • Preserve query string: forwards the query string independently of any other option.

API automation

For teams that prefer automation, the entire workflow can be driven through the API with three calls:

  1. Create the redirect list
  2. Populate it with URL redirects
  3. Enable the list via a rule inside the account-level http_request_redirect ruleset

The list ID returned by the first call is used to POST redirect entries into the list. The third step requires locating the account's existing redirect ruleset by phase name or creating it on first use; subsequent updates are straightforward ruleset edits.

Where account-level management matters

Multi-zone customers feel the Page Rules pain most acutely: navigating into each zone to configure a redirect one at a time is slow and tiresome. With an account-level product, an administrator managing 400 zones can create one list with 399 entries, each pointing at the primary example.com and enabled with Subpath matching and Include subdomains. The same applies to SSL for SaaS setups where each custom hostname on a zone gets its own list for that customer's redirects.

Plan entitlements

Bulk Redirects entitlements scale with the highest Cloudflare plan on the account:

  • Free: 15 edge rules, 5 lists, 20 URL redirects total
  • Pro: 15 edge rules, 5 lists, 500 URL redirects (an account with one Pro zone and two Free zones would qualify)
  • Enterprise: 25 lists and 10,000 URL redirects by default, negotiable on request

Bulk Redirect Rules draw down from the same edge rule allowance as other ruleset-based features.

What's next

Future releases will address list editing and in-list search. A separate "Dynamic URL Redirects" product is slated to handle the more complex cases Bulk Redirects is not built for: device-specific targets, country-specific behavior, and regular expressions in either the source or target of a redirect. For now, the prescriptive from-to model covers migrations, domain consolidation, and uptime maintenance at a scale that no longer requires a developer.