⚯Domain, encryption and third-party servers

The domain is the address of your website — the part between the slashes, for example your-business.de.

Do you need your own? For anything business-related: yes. An address containing a provider’s name looks provisional and cannot be taken with you if you change provider.

What a domain costs: a few euros a year for the usual endings. That is rarely the issue.

When choosing: short, easy to say, without hyphens, .de for Germany. The test is the phone — if you have to tell someone the address on the phone and spell it out, it is too complicated.

Five things, in this order:

1. The company name, if it is available. That is almost always the right choice.
2. Short. Every character is one that someone can mistype.
3. No hyphens, if it can be avoided. On the phone you have to explain them.
4. No umlauts or accents. Technically possible, in practice a source of errors in mail programs and old systems.
5. .de, if you work in Germany. Other endings seem foreign to local customers.

What you should not do: choose an address with search terms instead of a name — painter-dresden-cheap.de no longer looks reputable today and has long since brought no advantage with search engines.

Before registering, check whether the name is free in terms of trade mark law.

With the provider where it was registered — often the same one that hosted the old website. There is an interface there in which the entries are set.

This is the question that holds up moves most often, so clarify it early:

• Who has the login details? Not infrequently the nephew who built the first site eight years ago.
• In whose name is the domain registered? It should be in your business’s name, not a service provider’s. If not, have that changed — it is your property.
• Is it still active? A domain whose invoice went nowhere is quietly switched off.

If nobody can get in any more, the provider will help — with proof that you are the owner.

Set an entry in the domain management — that is all there is to it, but it has to be right.

The procedure:

1. Store the domain in Aurora Hive Sites. You receive the details to be entered.
2. Sign in to your domain provider and set the entries there.
3. Wait. Up to 48 hours, usually considerably less.
4. Check whether the site appears at the address — and whether the padlock is shown in the browser.

If you are unsure: the provider will do it on request. Tell them which entry should point where; that is routine for them.

Only do this once the site is finished. A domain pointing to a half-finished site gets indexed by search engines exactly like that.

It shows that the connection is encrypted — so nobody can read along with what passes between visitor and website.

Yes, you have it. The certificate is obtained automatically and renewed automatically; you do not have to do or pay anything.

It matters for three reasons:

• Forms. Without encryption, names and messages would be transmitted in plain text.
• Browser warnings. Without a padlock, browsers show “Not secure” — visitors turn back at that.
• Search engines rate unencrypted sites lower.

If the padlock is missing right after switching the domain: wait. The certificate arrives as soon as the address is reachable.

Almost always because of one of three things:

• The domain has only just been switched over and the certificate has not been issued yet. Wait an hour.
• You are opening the site without a prefix or with the wrong one — for example www. where only the bare address has been set up. Both spellings should work; if only one does, an entry is missing.
• An old redirect at the domain provider still points elsewhere.

What you can check without getting technical: open the address in a private window. If it works there, the cause was your browser cache.

If the warning remains for longer than a day, an entry is wrong — then the domain provider can help.

Yes, if only the website entry is changed. Website and email depend on different entries of the same domain and are independent of each other.

Even so, this is the most dangerous point in a move, because an intervention that is too heavy-handed hits both. Two rules:

• Only change the entries responsible for the website. Not “delete all entries and create them anew”.
• Note beforehand what is there. A screenshot of the entries takes ten seconds and saves the evening.

If you do not want to do it yourself: this is exactly when it is worth calling the provider. Tell them that the email must remain untouched.

Both should work, and one of the two is the main address — the other redirects to it.

Which one you make the main address is a matter of taste. Without www is shorter and more common today; with www is more familiar to older customers. All that matters is that you decide and stick to it.

Why it matters at all: for search engines, both spellings are initially two different addresses. If both deliver the same page without one redirecting to the other, your site splits its own effect with itself.

Check both spellings once in the browser. If one does not work, an entry is missing.

One is the main address; all the others redirect to it. That is the only sensible arrangement.

What you should not do: run the same website under two addresses. For search engines those are two websites with identical content, and both are rated lower than one would be.

There are still reasons to keep several addresses:

• Catching spelling variants and common typos.
• The old company name after a renaming.
• A second ending, so that nobody else takes it.

You set up the redirects at the domain provider, not here.

No — not of its own accord. Fonts, icons and design files are delivered from your own address.

That is not a detail but a deliberate decision with legal consequences: as soon as a page fetches something from a third-party server when it is opened, the visitor’s IP address is transmitted there — without them having been asked. Websites have received formal warnings for exactly this.

Third-party requests only arise where you build them in:

• an embedded video (hence the recommendation to use the cookie-free variant),
• an HTML section with third-party code,
• a counting tool or chat window from a third-party provider.

Whatever you build in belongs in the privacy notice.

Only if your site stores or reads something that is not technically necessary. For an ordinary company website without counting tools and without embedded third-party content, that is not the case — then you do not need one.

A banner becomes necessary as soon as you:

• use a visitor counting tool that sets identifiers,
• embed videos in the ordinary (not cookie-free) form,
• include maps, chats or buttons from third-party providers.

A banner nobody needs does harm. It costs visitors and suggests that you collect more than you do. The better order is: first check what is really necessary, then build it in — not a banner just in case.

That depends on who you are:

• Public bodies — yes, for years.
• Companies in consumer business that offer certain services electronically — since June 2025 under the German Accessibility Strengthening Act (BFSG). Micro-enterprises (fewer than 10 employees and at most €2 million annual turnover) are exempt for services.
• Pure information sites of a trade business — as a rule, no.

Regardless of the obligation, the essentials are worthwhile for everyone, because they help everyone:

• Sufficient contrast — helps in sunlight just as much as with impaired vision.
• Alt texts on images.
• Clear labels on form fields.
• Usability with the keyboard.

Those are four things that cost nothing. Everything else depends on your obligations — if in doubt, have it checked legally.

Yes. Content, pages, images and settings are backed up regularly.

What that means for you and what it does not:

• A server failure does not cost you your website.
• A section deleted by mistake is not automatically brought back by it. Restoring a backup means bringing back an entire state — including everything that has happened since.

So for everyday use: copy out whatever you want to keep beforehand. For two paragraphs of text that is quicker than any restore.

And the best protection against data loss is anyway this: do not delete — remove it from the menu.

Then the website is temporarily unreachable — as with any provider. What helps here is the design: a published site is finished HTML that is delivered, not a program that computes on every request. So there is less that can fail.

What you can do yourself:

• Your phone number must be findable without the website too — in the business directory, in the Google listing, in your email signature.
• Do not count on a hundred per cent. No provider in the world delivers that; anyone who promises it means something other than what you understand.

If your site is unreachable, first check whether it is your connection: open the same address via the mobile network.

A published website is static HTML — technically it could be placed anywhere. Whether and how that works in your case depends on your contract; ask about it before you build on it.

More important than the technical question are two practical ones:

• Who then maintains what? Editing continues via Aurora Hive Sites; only the delivery would be elsewhere. That adds an extra step every time you publish.
• Why, actually? If the reason is “our IT wants everything in-house”, that is a legitimate but expensive wish — with your own encryption, your own backup and your own availability.

The more common and usually better answer to the wish behind it is: use the export. That way you have your content in your hands at any time without taking over operations.

Not automatically — they are two different things. The website delivers pages; you get email mailboxes from a mail provider, often the same one where the domain is registered.

Why it is still mentioned here: a company address at info@your-business.de comes across differently from one at a free email service — and the difference is bigger than most people think. Anyone writing on business matters from a free provider’s address is read differently.

When you set up the domain anew: create two addresses straight away, info@ and your personal one. No small business needs more.

The address on the website should be the one you actually read — not the one that looks nicer.

Via the export. A website can be output as finished HTML and then sits on any web space — it works there as it did, just without the editing interface.

What you also take with you: images and files from the media library, blog posts as text, form entries, member and donation data as a file.

What does not come along: the ability to edit. An exported website is a snapshot, not a system — every further change then happens in the HTML.

And the domain belongs to you anyway: switching means making the entry point somewhere else. That is the same step as when you came here.

Yes — via the preview, whose address you can pass on. The recipient needs no account and cannot change anything.

Useful for:

• Agreement within the team, without creating an account for everyone.
• The view of someone who does not know the business. That is the most valuable feedback of all: anyone who knows everything does not notice what is missing.
• Feedback from the customer, if you are building the website for someone else.

Ask for specific feedback, not a verdict. “Can you find the phone number?” achieves more than “How do you like it?”.

The preview address is not secret. It is not meant for anything confidential.

As long as you have not published it and not switched the domain over, it is practically invisible: search engines find pages via links, and nobody links to a preview address.

What you should not do: switch the domain over early and then hope nobody looks. Search engines are fast, and a half-finished state that has been indexed stays in the search results for weeks.

The clean order remains: finish building, check, publish, then switch the domain over.

If you want to keep a page out of search permanently — for example directions for an internal appointment — remove it from the menu and do not link to it anywhere.