Point your domain to Amazon S3 with Cloudflare

Step 2 of 3 · About 20 minutes, plus DNS waiting time

Cloudflare sits between your visitors and your S3 bucket. It answers DNS lookups for your domain, adds free HTTPS, and lets you create redirect rules without touching your hosting.

1. Make Cloudflare your DNS provider

Add your domain to Cloudflare. It will give you two nameservers ending in ns.cloudflare.com. Log in to the company where you registered the domain and replace its nameservers with those two. Until this change takes effect, records you add in Cloudflare do nothing, and browsers report DNS_PROBE_FINISHED_NXDOMAIN.

2. Add a CNAME for the root domain

In DNS → Records, add:

Type: CNAME
Name: @
Target: your bucket website endpoint, such as example.com.s3-website.us-east-2.amazonaws.com
Proxy status: Proxied (orange cloud)

Common error: "Content for CNAME record is invalid." The target must be a host name only. Remove http:// from the start and any / from the end.

Do not use an A record with an Amazon IP address. S3 IP addresses change without notice, and S3 needs the host name to find the right bucket.

3. Set the SSL mode to Flexible

S3 website endpoints only speak plain HTTP. In SSL/TLS → Overview, choose Flexible. Visitors still get HTTPS between their browser and Cloudflare; only the hop from Cloudflare to S3 uses HTTP. With Full or Full (strict), you will see Cloudflare 52x errors.

Optionally, turn on Always Use HTTPS under SSL/TLS → Edge Certificates so every visitor is moved to the secure address.

4. Add a CNAME for www

Add a second record: type CNAME, name www, target your root domain (for example example.com), proxied.

5. Redirect www to the root domain

A www record alone is not enough. When a request for www.example.com reaches S3, S3 looks for a bucket called www.example.com and returns 404 NoSuchBucket. A Cloudflare redirect rule sends visitors to the root domain before the request ever reaches S3.

In Rules → Redirect Rules, create a rule with a wildcard pattern:

Request URL: http*://www.example.com/*
Target URL: https://example.com/${2}
Status code: 301 – Permanent Redirect
Preserve query string: on

The trailing /* in the request URL is essential. Without it the pattern does not match the home page, which browsers request as /. Cloudflare may warn that the rule might not apply to your traffic; as long as the www record is proxied, it is safe to deploy anyway.

6. Clear old DNS answers when testing

If www still fails right after you add it, your computer may be holding an old "does not exist" answer. On Windows, run ipconfig /flushdns, and in Edge or Chrome clear the host cache at edge://net-internals/#dns. Testing on a phone using mobile data is a quick way to see what the rest of the world sees.

Next step

Your site is live at your own domain. Now help people find it: get started with Google Search Console.