Cloudflare Pages custom domain still redirects to the old site? Three places the redirect hides
Symptom: curl -I https://yourdomain.com returns 301 Moved Permanently, Location: https://other-domain/, Server: cloudflare, and no headers from your origin. The Pages project shows the domain as attached. Nothing in Pages settings looks wrong.
The redirect is not in Pages. It is in the zone, and Cloudflare has three separate places to put one. This is the order that found it for tezbase.com today, which had been redirecting to a sibling domain for months.
1. Redirect Rules (zone level)
Dashboard → your domain → Rules → Overview, filter by Redirect Rules. This is where "redirect all to other-domain" usually lives now. Ours looked like this:
Match: (http.host wildcard "*tezbase.com")
Action: 301 redirect to concat("https://tezbase.kz", http.request.uri.path)
Disable it rather than delete it: you get a one-click way back if the new site misbehaves. The change is live within seconds.
2. Page Rules (legacy)
Same zone → Rules → Page Rules. Older setups put a "Forwarding URL" rule here. The list loads slowly and shows "No data" only after it finishes; do not conclude it is empty from a half-loaded page.
3. Bulk Redirects (account level)
Account home → Bulk Redirects. These are not attached to a zone, so they do not show up in zone views at all. A list here applies to any hostname it names.
Two places that will not be it, but are worth 30 seconds: Workers Routes on the zone (a Worker can redirect anything) and Snippets, if the plan has them.
What the DNS looks like on a redirect-only domain
A yourdomain.com 192.0.2.1 (Proxied). That is the documented placeholder IP for "this hostname exists only so Cloudflare can apply rules to it". When you attach the domain to a Pages project, Cloudflare offers to replace that record with CNAME yourdomain.com your-project.pages.dev. Accept. The Pages "Verifying" status flips to active within a minute or two; the apex domain answered 200 for us before the www did.
Checking without the dashboard
nslookup -type=NS yourdomain.com # are the nameservers Cloudflare's at all
curl -sI https://yourdomain.com | grep -iE "^(HTTP|location|server)"
If Server: cloudflare and there is no cf-cache-status or origin header, the response was generated at the edge, which means a rule.
What you cannot do from wrangler
wrangler with OAuth login gets zone (read) but not zone (edit), so it cannot disable the rule for you; the dashboard or an API token with Zone → Rulesets → Edit can. Custom domain attachment for Pages is also dashboard or API only. We did both through the dashboard in about four minutes once we knew where to look.