Setting Up a Custom Domain and SSL for Your SvelteKit App

Deploying a SvelteKit app to a *.pandastack.app URL is fine for testing, but production apps need a real domain. Pointing DNS at the deployment, provisioning an SSL certificate, and handling the www vs apex domain split are steps that break more often than they should.

PandaStack automates SSL certificate issuance via Let's Encrypt and handles automatic HTTPS redirect, but you still need to configure DNS correctly and tell the platform which domain to expect. Here is the full process, including what to do when it does not work.

Build and deploy a SvelteKit static site

Create a SvelteKit app with the static adapter:

npm create svelte@latest my-site
cd my-site
npm install
npm install -D @sveltejs/adapter-static

Update svelte.config.js to use the static adapter:

import adapter from '@sveltejs/adapter-static';

export default {
  kit: {
    adapter: adapter({
      pages: 'build',
      assets: 'build',
      fallback: null
    })
  }
};

Build the app locally to verify:

npm run build

The output is in the build directory. Commit and deploy to PandaStack:

panda projects create \
  --name my-site \
  --repo github.com/yourname/my-site \
  --branch main \
  --type static \
  --build-cmd "npm run build" \
  --output-dir build

You get a live URL:

https://my-site-abc123.pandastack.app

Point your domain at the PandaStack URL

Log in to your DNS provider (Cloudflare, Namecheap, Route 53, etc.) and add a CNAME record:

www.yoursite.com.  CNAME  my-site-abc123.pandastack.app.

The trailing dots are significant — they indicate a fully qualified domain name. Some DNS providers add the trailing dot automatically; others require you to type it.

Wait 30–60 seconds for DNS to propagate (or up to 24 hours if you changed an existing record with a long TTL). Verify propagation:

dig www.yoursite.com

The answer section should show a CNAME pointing at my-site-abc123.pandastack.app.

Add the domain to your PandaStack project

Tell PandaStack to provision an SSL certificate for the domain:

panda projects domain add <project-id> www.yoursite.com

PandaStack issues a Let's Encrypt certificate using the ACME HTTP-01 challenge. This requires the domain to resolve to the PandaStack URL before the certificate is issued, so make sure the CNAME is in place first.

The process takes 30–60 seconds. When complete, visit https://www.yoursite.com in a browser. The app loads over HTTPS with a valid certificate.

HTTP requests (like http://www.yoursite.com) automatically redirect to HTTPS with a 301 status code.

Handle the apex domain (yoursite.com without www)

Most DNS providers do not allow CNAME records on the apex domain (the root, like yoursite.com) because the DNS spec requires the apex to have an A record (IPv4 address) or AAAA record (IPv6).

Some providers (Cloudflare, Route 53) support ALIAS or ANAME records, which act like CNAMEs but are allowed on the apex. If your provider supports this, add an ALIAS record:

yoursite.com.  ALIAS  my-site-abc123.pandastack.app.

If your provider does not support ALIAS records (Namecheap, GoDaddy), you have two options:

1. 1Use only the www subdomain: Redirect yoursite.com to www.yoursite.com using your DNS provider's redirect feature (often called "URL forwarding").
2. 2Switch to a DNS provider that supports ALIAS records (like Cloudflare, which is free and widely used).

Once the apex domain resolves, add it to PandaStack:

panda projects domain add <project-id> yoursite.com

PandaStack issues a second certificate for the apex. Now both yoursite.com and www.yoursite.com work.

Debug: domain added but SSL certificate not issued

If you add the domain but see a certificate error in the browser, the Let's Encrypt challenge failed. Common causes:

DNS not propagated yet: The CNAME record was created but has not reached Let's Encrypt's DNS resolver. Wait 5 minutes and try again. Check propagation with dig or an online tool like [whatsmydns.net](https://www.whatsmydns.net).

CNAME points at the wrong target: Verify the CNAME points at my-site-abc123.pandastack.app (your actual PandaStack deployment URL, not a generic placeholder).

Cloudflare proxy is on (orange cloud icon): Cloudflare proxies traffic by default, which breaks the ACME challenge. Disable the proxy (click the orange cloud to turn it gray) during certificate issuance, then re-enable it after the cert is provisioned.

Typo in the domain: You added www.yoursite.com but the CNAME is for wwww.yoursite.com (extra w). Double-check the spelling.

Run panda projects domain list to see the certificate status. If it says "pending," the challenge is still in progress. If it says "failed," check the dashboard Domains tab for the error message.

Redirect www to apex (or vice versa)

Some teams prefer www.yoursite.com as the canonical URL; others prefer yoursite.com. Pick one and redirect the other.

PandaStack does not handle this automatically — you need to configure it in your DNS provider or at the edge. The simplest approach is to add both domains to PandaStack and use Cloudflare page rules to redirect:

1. 1Add both yoursite.com and www.yoursite.com to PandaStack
2. 2Turn on Cloudflare proxy (orange cloud) for both DNS records
3. 3Create a page rule: redirect yoursite.com/* to https://www.yoursite.com/$1 (301 permanent redirect)

Now all traffic lands on www, and the apex redirects.

If you use a different DNS provider, check their docs for "URL forwarding" or "301 redirect" features.

Update the SvelteKit base path for subdirectory hosting

If you want to serve the app at yoursite.com/app/ instead of the root, set the base in svelte.config.js:

export default {
  kit: {
    adapter: adapter(),
    paths: {
      base: '/app'
    }
  }
};

Deploy the updated config. The app now serves at https://www.yoursite.com/app/, and all internal links are prefixed with /app/.

PandaStack serves the static files from the CDN root, so you do not need to configure nginx rewrites or path stripping. The app handles its own routing via the SvelteKit adapter.

Renew SSL certificates automatically

Let's Encrypt certificates expire after 90 days. PandaStack renews them automatically 30 days before expiration. You do not need to do anything — renewal happens in the background and is transparent.

If a renewal fails (because the DNS record was deleted or the domain was removed), you will get an email notification. Re-add the domain or fix the DNS issue and the platform will retry the renewal.

Remove a domain

If you no longer need the domain (switching to a different one, deprecating the project), remove it:

panda projects domain remove <project-id> www.yoursite.com

This revokes the SSL certificate and stops routing traffic to the project. The DNS record still exists (in your DNS provider), so delete that separately.

Troubleshooting checklist

If the domain is not working:

1. 1Verify the CNAME record with dig www.yoursite.com. It should return a CNAME pointing at my-site-abc123.pandastack.app.
2. 2Wait for propagation. DNS changes take up to 5 minutes (or 24 hours if the old TTL was long).
3. 3Check the certificate status with panda projects domain list . It should say "issued."
4. 4Disable Cloudflare proxy temporarily if the certificate is stuck in "pending."
5. 5Test with curl to see the exact HTTP response: curl -I https://www.yoursite.com.
6. 6Check the PandaStack logs in the dashboard under Domains for error messages.

If none of these work, the issue is likely DNS misconfiguration. Double-check the CNAME target and the domain spelling.

Why custom domains matter for SEO and branding

A *.pandastack.app URL works for demos and staging, but production apps need a real domain for:

• SEO: Google indexes your content under your domain, not the platform's subdomain.
• Branding: Users see your company name in the URL, not a hosting provider.
• SSL trust: Modern browsers warn users about unencrypted sites. A custom domain with automatic SSL removes that friction.

Setting up a domain takes 5 minutes if DNS propagation is fast. Plan for 30 minutes if you hit issues or need to switch DNS providers.

References

• [SvelteKit static adapter documentation](https://kit.svelte.dev/docs/adapter-static)
• [Let's Encrypt ACME challenge](https://letsencrypt.org/docs/challenge-types/)
• [PandaStack custom domains guide](https://docs.pandastack.io)