Domains On The Account
Subdomains: a DNS label with a document root behind it
You want somewhere to put the staging copy, the API or the client portal, and the choice quietly affects cookies, certificates and rankings.
The short answer
A subdomain is a label beneath a domain you already own — app.example.com, staging.example.com — created as a DNS record and backed by its own document root on the hosting side. Nothing extra is registered and nothing extra is billed.
Treat it as a separate site rather than a folder. It gets its own certificate coverage, its own cache behaviour and its own cookie scope, and browsers and search engines both treat it as semi-independent from the parent name.
Creating one takes seconds from the panel, and the free SSL here covers it once it resolves.
By the HostingFast team · Reviewed 12 August 2026
100+
Terms defined here
2 min
Typical read time
Plain
English, no hand-waving
24/7
Engineers on shift
Two things happen when you create one: a DNS record is written so the label resolves, and a virtual host is created so the web server knows which directory to serve. From that point it behaves like any other site on the account, drawing on the same resource limits as everything else you host there.
The subtleties are all in the boundaries. Cookies set on the parent name can be scoped to reach subdomains or not; certificates cover a specific hostname unless the certificate is a wildcard; and caching rules, redirects and security headers apply per hostname, not per registration.
Subdomain or subdirectory, settled
For a section of the same site — a blog, a knowledge base, a set of landing pages — use a subdirectory. Everything you publish there builds authority into one hostname rather than splitting it across two, and that is a straightforward win requiring no argument.
For a genuinely different application — an API, a customer portal, a status page, a staging copy — use a subdomain. Separate hostnames give you separate cookie scope, separate caching rules and separate deployment, and those are real engineering benefits rather than SEO folklore.
Certificates and cookie scope
A standard certificate covers the exact hostnames listed on it. Add a subdomain and it needs its own certificate, issued automatically here once the label resolves, or a wildcard certificate covering everything one level down. Check with a browser or an https request before anyone else finds the warning.
Cookie scope deserves a deliberate decision. A session cookie set on the parent domain can be made available to every subdomain, which is convenient for a portal and a genuine risk if one of those subdomains runs software you did not write. Scope tightly by default and widen only where you have a reason.
Staging subdomains, done safely
A staging copy on a subdomain is the standard pattern, and the standard mistake is leaving it indexable and publicly readable. Put HTTP authentication in front of it, keep search engines out, and make sure any transactional email is either disabled or redirected to a mailbox you control.
Then use it properly. Clone, apply the update on the copy, measure the same URL before and after, and push only if the numbers and the behaviour both hold. That loop is the whole reason staging exists.
Subdomains on our plans
They are DNS records plus document roots rather than billable items, and they are created from the panel in seconds. Free SSL covers each one automatically, PHP releases are set per site, and staging copies are available for testing changes before they ship. WordPress plans carry up to 10 staging copies.
The number of separate sites you can run is set by the plan's website allowance: 1 on Sprint, 25 on Turbo, 100 on Nitro. Read Addon Domain, DNS and CNAME Record next.
One registration, several hostnames
Subdomains look trivial and quietly carry three decisions: where cookies reach, what the certificate covers and whether search engines see one property or two. This entry makes each of those explicit.
Free SSL covers each subdomain automatically once it resolves here, so an extra hostname never becomes a browser warning.
- Subdirectory for sections, subdomain for apps
- Certificate coverage per hostname
- Cookie scope as a security decision
- Staging behind authentication
Why HostingFast
Standard on every plan
Created in seconds from the panel
A DNS record and a document root, written for you, with no registration and no additional billing.
Free SSL for every subdomain
Certificates issue automatically once the label resolves here, and renew ahead of expiry without intervention.
Per-site PHP releases
An API on the current branch and a legacy portal on an older one can live under the same registration.
Staging copies included
Up to 10 on WordPress plans, so the staging subdomain is a clone you can push and roll back rather than a manual copy.
Wildcard SSL available
A wildcard certificate covers your domain and all its subdomains at once, which suits anyone running many of them.
DNS editing in the panel
Add, point and adjust the records yourself, without a ticket standing between you and a hostname.
Quick Start
From order to online
- 1
Choose the boundary deliberately
Sections of the site belong in a subdirectory. Separate applications belong on a subdomain. Decide before you publish, not after.
- 2
Confirm the certificate covers it
Load the new hostname over https as soon as it resolves. A missing certificate is a warning page, not a slow page.
- 3
Lock staging down on creation
HTTP authentication in front, search engines excluded and outbound email disabled or redirected. Do it at creation, not after the first accident.
Built In
Loaded onto every plan
- Subdomains created from the panel in a few seconds
- Free SSL covering each subdomain automatically
- Per-site PHP 8.x releases and extensions
- Its own document root for every subdomain
- Full DNS zone editing in the control panel
- Staging copies included, up to 10 on WordPress plans
- Wildcard SSL available for a domain and all of its subdomains
- Daily backups covering every hostname on the account
- Website allowances of 1, 25 or 100 sites by tier
- SSH access for deploying to any document root
Frequently Asked
What people ask us most often
Does a subdomain need its own certificate?
It needs coverage. A standard certificate covers the exact hostnames listed on it, so each new subdomain either gets its own certificate — issued automatically here once it resolves — or is covered by a wildcard certificate spanning everything one level down. Load the hostname over https to confirm before anyone else does.
Where should cookies be scoped?
As tightly as the application allows. A cookie set on the parent domain can be made readable by every subdomain, which is convenient for a portal and a real risk if any subdomain runs code you did not write. Scope to the specific hostname by default and widen only where there is a concrete reason.
Blog on a subdomain or in a subdirectory?
Subdirectory, in nearly every case. A /blog path builds authority into the hostname you already promote, while blog. splits it across two properties. Keep subdomains for genuinely separate applications, where the separate cookie scope and deployment path are the point.
How do I keep a staging subdomain out of search results?
Put HTTP authentication in front of it so nothing can crawl or read it, rather than relying on a robots directive alone. Disable or redirect outbound email at the same time, otherwise a test order sends a real confirmation to a real customer. Both take a minute at creation and are painful to fix afterwards.
Keep reading
Addon Domain
The other way to add a site to an account, with a separate name rather than a label beneath yours.
CNAME Record
Aliasing one hostname to another, and what that means for the record a resolver eventually reads.
How to Create a Subdomain
Creating a subdomain step by step, including the document root and certificate checks.
Web Hosting
Fast cPanel hosting on NVMe with SSL, migration and a first-year domain included.
WordPress Hosting
Managed WordPress with LiteSpeed and Redis, staging copies and daily backups included.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Somewhere to put the staging copy.
Subdomains in seconds with free SSL, per-site PHP and staging copies included, over NVMe behind a LiteSpeed cache.
View Web Hosting plans