Domain registrar
The company the domain is registered through — who to contact to renew it, unlock it or move it.
The registrar is the company you rent the domain through: GoDaddy, Namecheap, OVHcloud, Gandi, a hosting provider or a local reseller. It sits between you and the registry that runs the zone (Verisign for .com, DENIC for .de, NASK for .pl) and is the only party that can change the registration on your behalf.
What you go to the registrar for:
- Renewal and auto-renewal, and the payment card behind it.
- Nameserver changes, when you move DNS to another provider.
- The transfer lock and the authorisation (EPP) code needed to move the domain to another registrar.
- Contact data and the verification e-mails registries require; an unanswered verification can get the name suspended.
What the row shows
The name comes from the registry's RDAP or WHOIS record. Some registries no longer publish it (DENIC for .de, for example), and then the row is not shown. It is informational: there is no good or bad registrar from the report's point of view.
Why it is worth checking
Many companies discover during an incident that the domain sits in a personal account of a former developer or agency. If the name in this row is not one your organisation has an account with, find out who holds that account and move the domain into a company-owned one. See also the transfer lock and the registry status.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Domain registration”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data