Domain registration expiry
Days left on the domain registration. Once it lapses the name stops resolving and the whole site disappears, whatever the hosting is doing.
A domain is never bought outright: it is rented from the registry for one or more years at a time. When the paid period ends and nobody renews, the registrar first parks or suspends the name, then the registry moves it into a redemption period where restoring it costs a hefty fee, and finally releases it, often to a drop-catcher who resells it. From the first day of suspension the site, the e-mail and every subdomain stop working, however healthy the server is.
How SiteScan reads it
The expiry date comes from the registry over RDAP, or over WHOIS for zones such as .ru, .рф and .by. The row is green with more than 45 days left, amber at 45 days or fewer, and red once the date has passed. Some registries publish no dates at all (for example DENIC for .de); the row then says "Not checked" instead of guessing. A subdomain has no registration of its own, so for one the whole group is left out.
How to stay safe
- Turn on auto-renewal at the registrar and keep the payment card on file current.
- Make sure the registrar's notices reach a mailbox someone reads, not the address of a former employee.
- Renew for several years at once for the main domain.
The certificate expires on its own schedule: see certificate expiry and both dates in one article.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Domain registration”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data