Domain is no longer accepting redirects (masked forwarding) from my other domain?

Please help... the business cards are already printed and we're about to go live.

I have two domains - one with my actual website, connected to cloudflare (domain A), and one that's just the domain- only a URL (domain B).
I set up domain forwarding (masked) a couple months ago so a few URLs from domain B connect to domain A. It had been working fine, but suddenly today domain B is "refusing to connect" whenever you try to access the site through the redirect.

It seems like domain A needs some sort of exception added so domain B is allowed to connect?
From what I researched, it seemed like I needed to set up a CNAME domain record.
So I tried setting up a CNAME : Name (domain A) Target (domain B), but wasn't able to. There's already a CNAME: Name (domain A) Target (domain A), leading to itself. I disabled that so I could make the rule I needed, but that just made domain a entirely inaccessible, so I reverted that.

What should I do? Is there a CNAME name I can use that'll allow the connection?

Only domain A is connected to Cloudflare - domain B exists solely as a URL on Godaddy. Should I try to connect domain b to Cloudflare and then make the rule in reverse?

Nnuvalewa Please help... the business cards are already printed and we're about to go live...

Laudian•5/12/25, 5:42 PM

Can you share the actual domains or at least the error message you see?

nuvalewaOP•5/12/25, 5:51 PM

Sure - wasn't sure if that was allowed!

domain a - the actual site - is mouthdigitalpr.com

domain b - just the url - is mouthglobal.ca

The error message is just this:

nuvalewaOP•5/12/25, 5:57 PM

Again - it had been working fine for a couple months at this point, the change is recent. I haven't changed anything DNS wise, which is what made me thing this might be some sort of automated security thing.

Laudian•5/12/25, 5:59 PM

Give me a minute or two please

rdm•5/12/25, 6:03 PM

Don't let me confuse this matter, but just an observation... Is this a CORS issue? I think it has another name.

chromewebdata/:1 Refused to display 'https://www.mouthdigitalpr.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Laudian•5/12/25, 6:06 PM

Yeah, x-frame-options SAMEORIGINx-frame-options SAMEORIGIN prevents the frame from loading.

Nnuvalewa Sure - wasn't sure if that was allowed! domain a - the actual site - is mouthd...

Laudian•5/12/25, 6:08 PM

Your website has a rule that tells browser that it shouldn't be included via an iFrame with other domains, which is exactly how GoDaddys "masked redirect" works.

tbh, I wouldn't use that feature if alternatives are possible. Can you just add a second domain to the website directly?

Laudian•5/12/25, 6:11 PM

My guess is that someone activated the "Managed HTTP Response Header Transform" for "Add security headers" on Cloudflare for the first domain.

LLaudian Give me a minute or two please 😉

nuvalewaOP•5/12/25, 6:15 PM

sorry, wasnt trying to rush - little panicky

nuvalewaOP•5/12/25, 6:22 PM

this setting? it looks like everything's disabled.
I wonder where that rule came from? Is there a way to disable it?

Or maybe I should add a page rule to make mouthglobal an exception?

Laudian•5/12/25, 6:23 PM

Which hosting company are you using for the website?

nuvalewaOP•5/12/25, 6:37 PM

Amazon hosts the site apparently (which I didn't even know), but I use wordpress to access and make edits to the site itself when I'm adding content. The domain is through godaddy, and security (obvs lol) through cloudflare.

Laudian•5/12/25, 6:42 PM

GoDaddy is using Cloudflare for their hosted WP sites, so it may be that they activated the Security Headers rule.

Or the headers are added by the site itself.

Laudian•5/12/25, 6:46 PM

You can try to add a new Transform Rule on Cloudflare to remove the x-frame-optionsx-frame-options header if you really are in a hurry.

nuvalewaOP•5/12/25, 7:01 PM

Definitely in a hurry, lol. Would that remove the URL mask, though? The URL needs to still be mouthglobal.ca.

So if GoDaddy is using Cloudflare for their WP sites, does that mean my site is essentially under two levels of Cloudflare security? There's the main dashboard that I can access, and there's a second hidden dashboard that goes through GoDaddy - and that's where the security rule is enabled?

For your suggestion - would that be a Request or Response header transform rule? I'm on the page for making a new transform rule.

nuvalewaOP•5/12/25, 7:01 PM

Thanks for all the help so far, btw

Nnuvalewa Definitely in a hurry, lol. Would that remove the URL mask, though? The URL need...

Laudian•5/12/25, 7:06 PM

That would be a response header transform. And no, it wouldn't remove the mask.

But just to be clear, GoDaddys "masked redirect" is incredibly phishy and blocked for a good reason. I would only remove the header as a temporary solution.

And for the GoDaddy thing, i'm not sure. It might be that the request goes through both CF accounts, or it might be that it only goes through GoDaddys account, I'm not entirely sure. It's different from provider to provider.

nuvalewaOP•5/12/25, 7:24 PM

I'll keep that in mind. So by phishy - it would make the site more open to vulnerabilities?

So what should the rule be? I imagine the then... would be "remove".

Would it be hostname as the field, operator "contains" (since there's a couple subdomain redirects as well), and value "mouthglobal.ca"?

Or would field be "URI"?

Laudian•5/12/25, 7:30 PM

I'd use If hostname equals www.mouthdigitalpr.comIf hostname equals www.mouthdigitalpr.com

Nnuvalewa I'll keep that in mind. So by phishy - it would make the site more open to vulne...

Laudian•5/12/25, 7:36 PM

It's phishy because just like you can create a "masked redirect" to your actual page, so can everyone else, with any domain they want.

So when someone visits the site, they have no way of knowing if the site they are on is legit or not. I won't go into more detail, but it's a bad practice for a lot of reasons.

Generally, there are better ways (though not as simple).

nuvalewaOP•5/12/25, 7:44 PM

should it apply to all incoming requests? i guess it kind of does either way...
so this would be removing the rule entirely rather than making an exception, huh

and then it would remove "x-frame-options", like you mentioned before, for the "then"?

Laudian•5/12/25, 7:45 PM

yes

nuvalewaOP•5/12/25, 7:49 PM

so this is my final rule. look good to go?

Laudian•5/12/25, 7:52 PM

Actually, you can add AND if Referer equals https://mouthglobal.ca/AND if Referer equals https://mouthglobal.ca/

it doesn't REALLY add security, but it's a bit better.

nuvalewaOP•5/12/25, 8:01 PM

Could i do CONTAINS and have just mouthglobal.ca as the value? I'm thinking of the subdomain redirects - ceo.mouthglobal.ca and services.mouthglobal.ca

or would that not work?

Laudian•5/12/25, 8:02 PM

sure

nuvalewaOP•5/12/25, 8:14 PM

ill try it out. i have it set to custom filter expression - rather than all incoming requests. is that fine? not sure what you were saying yes to earlier

nuvalewaOP•5/12/25, 8:15 PM

looks like its working!

Nnuvalewa ill try it out. i have it set to custom filter expression - rather than all inco...

Laudian•5/12/25, 8:21 PM

I prefer the custom filter expression, but all requests works as well.

Nnuvalewa looks like its working!

Laudian•5/12/25, 8:22 PM

Good!

nuvalewaOP•5/12/25, 8:30 PM

thanks for all the help! big appreciate

Domain is no longer accepting redirects (masked forwarding) from my other domain?

Similar Threads

Similar Threads

Similar Threads