subdomains
A subdomain is a separate address in front of your main domain, like shop.yourbusiness.com, that can run its own site or tool while still living under your brand.
A subdomain is the part of an address that sits in front of your main domain name, separated by a dot. In shop.yourbusiness.com, shop is the subdomain and yourbusiness.com is the root domain underneath it. A subdomain can point at an entirely different site, a different tool, or a different server, while still reading as part of your brand’s address.
Businesses use subdomains for all kinds of things: a booking page hosted by a third-party tool, a staging copy of a site used for testing before changes go live, or a separate app that needs its own address without living inside the main site’s file structure. Each one is created as its own DNS record, pointing wherever it needs to point, independent of the main site.
Because a subdomain is still technically part of your domain, it inherits some of the same trust a browser and a search engine place in the root address, which is exactly why it needs to be treated with the same care.
Why it matters to you
A subdomain that gets forgotten is a genuine security gap. Old staging sites, abandoned tools, or a subdomain pointed at a service you stopped using years ago can quietly sit there, still resolving, still reachable, and sometimes still running outdated software nobody is watching. That is a way in for exactly the kind of compromise a security review should catch.
Subdomains also matter for the protections that cover your whole domain. A setting like forced HTTPS that only applies to the main address and skips subdomains leaves an opening a more careful setup closes automatically.
How I set it up
When a site needs a subdomain, whether for a booking tool, a client portal, or anything else, I create the DNS record deliberately and document what it points at and why. I do not let subdomains accumulate quietly over time. If a tool gets retired, its subdomain record comes down with it, rather than sitting around as an unused door into the account.
The security headers I put in place, including forced HTTPS, are written to apply across every subdomain by default, not just the main address, so a new subdomain does not accidentally launch without the same protections everything else has.
What it looks like in practice
Most visitors never notice a subdomain is a separate address at all. It looks and feels like part of the same site, loads over the same secure connection, and carries the same brand. Behind the scenes, it is a distinct DNS record pointing somewhere specific, reviewed occasionally to make sure it still needs to exist and still points where it should.
Questions I get about this
- Do I need a subdomain for every new tool I add?
- No. Most small businesses run everything off one main domain and never need one. A subdomain is worth setting up when a separate tool, like a booking system or a client portal, genuinely needs its own address rather than a page on the main site.
- Is a subdomain as secure as my main website?
- It should be treated exactly the same way. A subdomain is still part of your domain, and a security setting that only covers the main address while leaving subdomains out is a real gap, which is why the protections I put in place are written to cover subdomains explicitly.
Where this fits in our work
Want this set up properly for your business?
This is the kind of thing I build every week. Grab a time and we will talk through what fits.