Domains & TLS

Platform subdomains

Every project serves <project>.buildfyio.com; every additional web or static app serves <project>-<app>.buildfyio.com. TLS is issued automatically — nothing to configure.

Adding a custom domain

1. Open the app's Domains section and add the hostname.
2. Create the DNS record at your registrar (table below).
3. Verification runs automatically for about an hour; after that use Check now. On verification the route goes live and a Let's Encrypt certificate is issued — usually within seconds.

Adding a bare apex automatically provisions its www. sibling (and vice versa) serving the same app — both hosts work once their DNS resolves.

Per-app domains

Domains attach to a specific app: put www.example.com on the site app and api.example.com on the API app of the same project. Each routes to that app's current production deployment.

Cloudflare

Strict-Transport-Security (HSTS)

Every host the edge terminates answers with Strict-Transport-Security: max-age=31536000 (static sites: two years), so a browser that has visited once refuses plain HTTP until the max-age expires. Project Settings → Security headers changes it per project:

• max-age — seconds. 0 makes the edge send no header at all (your app's own header, if any, passes through). Browsers that already stored the policy keep enforcing HTTPS until it expires.
• includeSubDomains — every subdomain of the host becomes HTTPS-only too, including ones not hosted on Buildfyio. Check that all of them have certificates first.
• preload — needed to submit the domain at hstspreload.org. Effectively permanent: removal from the browsers' built-in lists takes months to reach users. Requires includeSubDomains and a max-age of at least one year; the form refuses it otherwise and the edge never emits a preload it cannot honour.

Changes land on the edge within five minutes. Verify with curl -sI https://your-host/ | grep -i strict.

Certificate lifecycle

• Issued on first successful route registration; renewed automatically.
• The dashboard shows live TLS status; a freshly-verified domain usually flips to active within seconds.
• Deleting a domain removes its route and releases the hostname.