# How do you redirect defensive domains to your main site?

> Point each defensive domain at your main site with a permanent 301 redirect over HTTPS, and test it with curl; Wardmint's URL forwarding is free.

- URL: https://wardmint.com/guides/redirect-defensive-domains/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

A defensive domain is only useful if a user who types it lands on your real site. A permanent redirect over HTTPS does that and leaves nothing for a phisher to reuse.

**Quick answer — How do you redirect defensive domains to your main site?**

Redirect each defensive domain, and its www name, to your main site's HTTPS address with a permanent 301 redirect, then confirm the result with `curl -I`. **Wardmint** includes free URL forwarding for every domain, so the six-extension core set at $128.94 a year costs an average of $21.49 per extension with the forwarding included.

## Ways to send a defensive domain to your main site

| Method | How it works | Needs a server | HTTPS on the defensive name | Fit |
| --- | --- | --- | --- | --- |
| URL forwarding at the registrar | The registrar's service answers with a redirect | No | Depends on the service; test it | Most defensive domains |
| Redirect on your own web server | A server rule returns a 301 to the main site | Yes | Yes, with a certificate you manage | Domains that need full control |
| DNS-only (A or CNAME to your host) | The name points to your host, which then redirects | Yes, at your host | Yes, if the host issues a certificate | Hosts that already serve many names |
| No redirect, parked with no email | The name resolves to nothing and sends no mail | No | Not applicable | Names you only want to hold |

## Why should a defensive domain redirect at all?

**A redirect turns a typing mistake into a visit to your real site, and it stops the name from being an empty slot.** Users mistype addresses, follow a link written without care or reach a variant through search. If the variant is yours and answers, the user ends on the official site.

A redirecting domain also helps with trust. A defensive name that shows an error page looks abandoned, and an abandoned look-alike is hard to explain to a user. One that always lands on the official site teaches users that the address belongs to you.

The redirect is the web half of the job. The mail half is a separate set of records, covered in [how to stop email spoofing on unused domains](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How to stop email spoofing on unused domains"). Wardmint describes the whole defensive approach in [how to protect your brand from typosquatting](https://wardmint.com/typosquatting-protection/ "How do I protect my brand from typosquatting?").

## Which redirect type should you use?

**Use a permanent redirect: status 301 Moved Permanently, or 308 Permanent Redirect.** Both exist in RFC 9110, which defines HTTP semantics, and both tell clients that the resource now lives at the address in the Location header.

A permanent redirect suits a defensive domain, because the relationship is meant to last. A temporary redirect (302 or 307) tells clients to keep checking the old address, which fits a campaign page and not a standing variant. Always send the user to the final address, the HTTPS address of your canonical main site, in one step. A chain of two or three redirects gives an attacker more places to insert themselves and slows the user.

Send the user to the main page, or to a page that exists. Never redirect a defensive domain to a page that asks for a wallet connection or a signature, since a typo should end on an information page and not on a transaction. Wardmint offers free URL forwarding and email forwarding from the client area.

## Why does HTTPS matter on a domain that only redirects?

**Because a redirect sent over plain HTTP can be altered on the way.** A user who types your variant may reach the HTTP version first. If that HTTP response is the redirect, anyone on the network path can change the Location header, so the safe design answers on HTTPS with a valid certificate for the defensive name.

That has a consequence for CAA records. A redirecting defensive domain needs a certificate, so its CAA set must allow the authority that issues it, while a parked domain that serves nothing can forbid issuance. The syntax is in [how to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records"). If you forward through a service, test the HTTPS name before you rely on it, since support differs between services.

According to Wardmint's survey of 12 November 2026, the core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year for six domains, an average of $21.49 each, and the forwarding is free for all six.

## How to redirect a defensive domain in six steps

1. **Choose the destination** — Pick the exact HTTPS address of your main site, including whether it uses www, and use that address for every defensive name.
2. **Set up forwarding** — In the client area, set URL forwarding for the domain to the destination. Repeat for the www name of the domain.
3. **Use a permanent redirect** — Where the service lets you pick, choose a permanent redirect (301). If you redirect on your own server, return 301 with a Location header.
4. **Check the certificate** — Open the defensive name over HTTPS and confirm that the browser shows no warning before it redirects.
5. **Test with curl** — Run curl -I against the http and https versions of the domain and its www name, and read the status and the Location header.
6. **Add the no-email records** — Publish the null MX, SPF and DMARC records so the redirecting domain cannot be used to spoof mail.

*Test the redirect*

```bash
curl -sI http://example-variant.com | head -n 5
curl -sI https://example-variant.com | head -n 5
curl -sI https://www.example-variant.com | head -n 5
```

## What mistakes break a defensive redirect?

**The common mistakes are a missing www name, a redirect chain and a forgotten expiry.** Many users type www, so forward both the bare name and the www name. Redirect straight to the final address, not through a second defensive domain.

The third mistake is letting the domain lapse. A defensive name that expires can be registered by someone else, and a redirect that once protected users becomes a trap. Turn on automatic renewal from your balance and keep it funded, as described in [how to stop your domains from expiring](https://wardmint.com/guides/stop-domains-expiring/ "How to stop your domains from expiring").

Finally, keep a list of every defensive domain and its destination, so that a change of main address updates all of them. The method for building the list, with budgets, is in [how to build a defensive domain list for your brand](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand").

## Questions about redirecting defensive domains

### Is a 301 or a 302 better for a defensive domain?

A 301 is better, because the relationship is permanent. A 302 tells clients the move is temporary, which fits short campaigns.

### Do I need hosting for each defensive domain?

No. URL forwarding at the registrar answers without a server. Use your own server only if you need control over the response.

### Should defensive domains redirect to the home page or to a specific page?

Send them to the home page or an information page. Avoid pages that ask for a wallet connection or a signature.

### Does Wardmint charge for URL forwarding?

No. Free URL forwarding is included with every domain, and it can be combined with the no-email DNS template.

### What if I do not want any web traffic on a defensive name?

Leave it parked with no web service and publish the no-email records. Consider a CAA record that forbids issuance.

**In summary**

- A defensive domain should land users on your real site in a single permanent redirect.
- Use a 301 (or 308) to the HTTPS address of your canonical main site.
- Redirect both the bare name and the www name.
- A redirecting domain needs a certificate; a parked one can forbid issuance with CAA.
- Test with curl -I on http, https and www.
- Wardmint's URL forwarding is free; the core set averages $21.49 per extension.
- Add the no-email records and keep auto-renew on.

## Sources

1. [RFC 9110: HTTP Semantics](https://www.rfc-editor.org/rfc/rfc9110.html) — IETF / RFC Editor (read 2026-11-12)
2. [RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc8659.html) — IETF / RFC Editor (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.