Before any hosting works, three pieces must click together: the name you rent, the records that point it, and the certificate that secures it. The chain, link by link.
Every 'my site is down' panic we've ever helped with lived in one of three places: the domain, the DNS, or the certificate. Hosting gets the attention, but this chain in front of it decides whether visitors ever arrive. It's three links, each simple once seen clearly.
A domain is an annual rental in the internet's namespace, controlled entirely by whoever holds the registrar account. Three rules cover ninety percent of domain trouble: register it in an account YOU control (never let an agency or host hold it 'for convenience'), secure that account like a bank login, and never let renewal lapse — expired domains of living projects get bought by squatters within hours. The domain is independent of hosting on purpose: it's the constant that makes every host replaceable.
DNS translates the name into destinations, record by record: A/AAAA records aim the website at a server, CNAME lets subdomains follow a platform, MX routes the domain's email (fully independent of the website — the fact that saves migrations), TXT carries verification proofs. Two operational truths: caching means changes take effect gradually (the TTL is your control dial), and the NS records decide which provider's panel is actually live — know which one that is before you need it urgently.
TLS encrypts traffic and proves the server speaks for your domain — mandatory table stakes now, since browsers shame plain HTTP and modern web features require HTTPS. The good news is that this link automated itself: Let's Encrypt issues certificates free, and any host worth using provisions and renews them silently. Your job is only to notice if automation breaks — an expiry warning means the machinery needs attention, not that you need to buy anything.
The one mistake that outranks all others
Losing control of the domain — a lapsed renewal, a lost registrar login, or a third party who registered it 'for' you. Websites are rebuildable; the address and the email attached to it are what a business actually loses. Own the account, enable 2FA, pay the renewal.
It's convenient and mostly fine — the meaningful rule is that the registrar account is yours, whoever runs it. Many prefer a separate registrar so hosting changes never touch the domain at all; that separation is cheap insurance, not a requirement.
The two are separate DNS names and both need records — plus a TLS certificate covering both, plus a redirect choosing one as canonical. When one variant fails, one of those three pieces is missing for it. Any decent host sets all of this up; it's worth two minutes of checking both variants after every setup.
For domain validation — the padlock — no: automated free certificates are the industry default and cryptographically identical to paid ones. Paid products add organization validation and warranties, relevant mainly where displaying verified legal identity matters. If a host charges extra for basic TLS, read that as a signal about the host.
