Skip to main content
.com domains from $2.99 — free WHOIS privacy on every name

Redirect runbook · Beginner · 5 min

How to set up domain forwarding — One Hop, the Right Status Code, and a Certificate

You need the spare name to land visitors on the real site in one hop, with a valid certificate, instead of a chain that costs a lookup and two handshakes.

View Web Hosting plansBrowse more How-To Library

The short answer

A forward is three things stacked: a DNS record that brings the name here, a certificate on that name so HTTPS does not fail before the redirect happens, and an HTTP status code that sends the visitor on. Get all three right and it costs one hop; get any of them wrong and it costs three or it fails silently.

Count what you actually built with curl -sIL -o /dev/null -w '%{num_redirects} %{time_starttransfer}\n' https://old.example/some/path. The number you want is 1. Anything more is a lookup, a TCP connection and a TLS handshake per extra hop, and mobile visitors pay for every one of them.

By the HostingFast team · Reviewed 24 August 2026

Beginner

Skill floor

5 minutes

Hands-on time

5

Steps in total

24/7

Support on call

You need the sending domain pointing at this platform and cPanel access. Five minutes of work, then a test that takes another two and is the only part people skip.

Redirects are reversible, but a 301 is cached hard by browsers, so treat the status code choice as the one decision on this page that is genuinely difficult to take back.

301 or 302, and what each does to caches

A 301 says the move is permanent, and browsers cache it aggressively — often until the profile is cleared. That is exactly what you want for a rebrand or a consolidated domain, and exactly what you do not want for a campaign name you will reuse next quarter. Search engines treat it as the instruction to consolidate.

A 302 says temporary, so nothing downstream commits to it. Use it while you are still deciding, then swap to 301 once you are sure. The mistake that is expensive in both directions is issuing a 301 you later regret, because you cannot recall it from the browsers that already have it.

Counting hops, because chains are invisible from a browser

In a browser, a three-hop redirect and a one-hop redirect look identical: the right page appears. On the wire they are not remotely the same. Run curl -sIL https://old.example/ and read every Location header in order — that is the chain, in full, with the status code that produced each step.

Typical chains happen by accident: http to https, then non-www to www, then old domain to new domain, three hops before a byte of HTML. Collapse them by sending the sending name straight to the final canonical URL in one move rather than letting each rule fire in sequence.

The forwarder needs its own certificate

This is the failure that surprises people. If somebody types https://old.example and there is no certificate for old.example, the browser aborts on the TLS handshake and shows a security warning. Your redirect never runs, because HTTP redirects are content and the connection failed before there was any.

So issue SSL on the sending name even though nobody will ever read a page there. AutoSSL will do it once the name resolves to the account, and you can confirm with openssl s_client -connect old.example:443 -servername old.example that the SAN list actually includes it.

Path and query string: decide, do not assume

Forwarding with path preservation sends old.example/pricing to new.example/pricing. Forwarding without it sends everything to the homepage. Both are legitimate; only one of them is right for your case, and panels default to whichever they default to.

Test with a deep path and a query string, not just the bare domain: curl -sIL 'https://old.example/pricing?utm_source=email'. Losing the query string silently is how a redirect passes a casual test and then destroys a quarter of campaign attribution.

Hunting down the right domain name before someone else takes it

The stack these steps were measured on

Every walkthrough here is run against the platform we operate — cPanel, LiteSpeed in front of NVMe, Softaculous, WP-CLI over SSH — so the field names in the instructions are the field names on your screen.

Every plan includes an SSL certificate that reissues itself before expiry, so the padlock on a forwarding-only name is never something you have to diarise.

  • Hops counted on the wire, not in a browser
  • The status code treated as a real decision
  • Verification commands, not hopeful refreshing
  • Engineers on support at any hour

Why HostingFast

Standard on every plan

Measured in hops

The page gives you the curl invocation that prints the redirect count, so the thing you are optimising is a number rather than an impression.

Status code as a decision

301 and 302 are described by what they do to caches and to search engines, not as interchangeable synonyms for the word redirect.

The TLS failure named early

A forwarding name with no certificate aborts before the redirect runs, and that is on this page before step one.

5 steps, no padding

Five actions, each with something observable at the end, including the deep-path test almost everyone skips.

Query strings tested

The final check uses a real path and a real query string, which is where silent attribution loss actually shows up.

Engineers on call

If a certificate will not issue on the sending name, support answers at any hour with the reason.

Quick Start

From order to online

  1. 1

    Decide permanent or temporary, and write down why

    301 for a rebrand or a name you are consolidating; 302 while the decision is still open. Note the reason somewhere, because in six months the only evidence of intent will be the status code itself.

  2. 2

    Bring the sending name onto the platform first

    Point its delegation or its A record here and confirm with dig A old.example @1.1.1.1. Nothing else on this page can work until the name resolves to an account that can answer for it.

  3. 3

    Issue SSL on the sending name

    Let AutoSSL pick it up, then verify with openssl s_client -connect old.example:443 -servername old.example and read the SAN list. Without this, half your visitors hit a browser security warning instead of a redirect.

  4. 4

    Create the rule, with path preservation set deliberately

    In cPanel Redirects, choose the type, set whether the path is carried across, and target the final canonical URL directly rather than an intermediate name. Include or exclude www consciously; the wildcard option covers both.

  5. 5

    Test all four entrances plus a deep path

    Run curl -sIL against http and https, with and without www, then once more with a real path and query string. Read the Location headers in order and confirm the count is 1 and the query string survived.

Built In

Loaded onto every plan

  • Free SSL on every plan, renewed before it can lapse
  • WordPress Toolkit, with updates applied for you
  • LiteSpeed caching in the server, not bolted on by plugin
  • cPanel, the control panel most of the industry already runs
  • DDoS filtering absorbed at the network edge
  • A renewal price identical to the one you signed up at
  • No setup fee on any plan, at any tier
  • Spam and virus screening on every mailbox as standard
  • WordPress and 400+ other applications in one click
  • Year one of the domain free when you order annually

Frequently Asked

What people ask us most often

Why does curl show two redirects when I only made one rule?

Because something else is firing first. The usual pair is an HTTP-to-HTTPS rule and then your forward, or a canonical www rule that runs before it. Read every Location header in order from curl -sIL and you will see which layer produced each one. Fix it by pointing the forward at the final canonical URL directly, so the second rule has nothing left to correct.

Does a 301 carry the query string across?

It depends entirely on how the rule was written, which is why this needs testing rather than assuming. Path-preserving forwards usually keep the query string; homepage forwards discard everything. Test with a real one — curl -sIL 'https://old.example/x?utm_source=test' — because losing utm parameters silently is the kind of bug that only shows up in a quarterly report.

Do I really need SSL on a domain that only forwards?

Yes. TLS is negotiated before any HTTP response exists, so a request to https://old.example with no valid certificate for that name fails at the handshake and the visitor sees a security warning, not your redirect. Since links, bookmarks and typed addresses all default to HTTPS now, a forwarding name without a certificate is effectively broken.

Should I forward the spare name or add it as an alias?

Forward it. An alias serves the same document root under a second hostname, so the whole site becomes reachable at two addresses and you rely on canonical tags to sort out the duplication. A single 301 gives one authoritative address, one set of URLs in logs and analytics, and no ambiguity for anything that crawls you.

Keep reading

Changing hosts? Run through our checklist first.

A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.

You'll get the checklist email, then occasional pointers on keeping a site running fast. Unsubscribe the moment you want out — the privacy policy covers the rest.

Serve the redirect from faster hardware.

NVMe behind a LiteSpeed cache, free SSL on forwarding names included, free migration, and a renewal price that never moves.

View Web Hosting plans