How to Set Up Domain Forwarding and URL Masking

Domain forwarding sends visitors from one domain to another. URL masking does the same while keeping the original address visible in the browser. They look like variations of one feature and they behave very differently. One is a standard redirect, the other loads the destination inside a hidden frame.

Use forwarding. Masking causes more problems than it solves, and this page explains why.

Setting up forwarding

In cPanel, open Redirects, choose the domain, enter the destination, and select the type.

Permanent (301) tells browsers and search engines the move is permanent. Ranking signals pass to the destination and browsers cache it. This is what you want in almost every case.

Temporary (302) says the original will return. Nothing is passed on, and browsers ask again each time. Use it only when the move genuinely is temporary.

Choosing 302 by accident is common and quietly wasteful. The destination never inherits anything from the old address.

Redirect to the matching page, not the homepage

If content moved rather than disappeared, send each address to its equivalent.

Sending everything to a homepage is better than a 404 and considerably worse than a real match. A visitor following a link to a specific article and landing on a homepage has to find it again, and most will not.

cPanel's wildcard option forwards everything under a domain to the equivalent path on the destination, which is the right choice when an entire site moved with its structure intact.

Why masking is worse than it looks

Masking keeps the short domain in the address bar by loading the destination inside a frame. Everything after that follows from the frame.

The address bar stops meaning anything. Every page shows the same URL, so a visitor cannot bookmark or share the page they are actually on.

Search engines see one page. The masked domain has a single thin document; the real site is inside a frame and is not credited to it. If the point was to build the short domain's presence, masking achieves the opposite.

The back button misbehaves, because navigation happens inside the frame rather than at the top level.

Analytics collapse. Every visit is attributed to one URL.

Some sites refuse to load in a frame at all, for good security reasons, and simply show nothing.

If you want a short domain to be the real address, host the site there. Masking is a way of appearing to do that while breaking most of what makes a URL useful.

What forwarding is genuinely good for

Alternate spellings and typos. Registered variations pointing at the main domain, so mistyped addresses still arrive.

An old domain after a rename. Forward it permanently and keep renewing it: old links and printed material keep working for years.

A short domain for print or radio. A memorable address that redirects to a longer real one.

Consolidating. Several domains from an earlier strategy pointed at one place.

In every case the destination is the real site and the forwarded domain is a signpost. That is the right relationship.

Prerequisites

The forwarded domain must point at this server: its nameservers set here, or there is nothing to process the redirect. Adding a redirect for a domain that resolves elsewhere does nothing at all, and this is the usual reason a forward appears not to work.

Each forwarded domain also needs its own certificate if it will be reached over HTTPS. A visitor typing the https:// form of a domain with no certificate sees a browser warning before the redirect ever happens: check the SSL status page after adding one.

Forwarding within a site

The same Redirects tool handles paths, which is how you retire a page without losing its inbound links:

/old-page.html → /new-page.html

Use a permanent redirect so the new page inherits the old one's standing. This is worth doing every time you rename or remove a page, instead of leaving a 404 behind.

When it does not work

Nothing happens. The domain does not point at this server. Check its nameservers.

Certificate warning before the redirect. No certificate for the forwarded domain. Run AutoSSL for it.

Redirect loop. The destination forwards back to the source, directly or through a chain. Check both ends.

Works for the domain, not for paths. Wildcard forwarding was not enabled.

Search engines still index the old domain. The redirect is a 302 instead of a 301. Change it and give it time.

For redirecting individual pages in place of a whole domain, the tool and the trade-offs are different. How to Redirect a Domain or Page goes into it.

Check which kind of forward you actually got

Panels offer several things under similar names, and they behave completely differently for search engines and for visitors.

curl -sI http://old.example.com/ | head -3
curl -sI http://old.example.com/some/page | head -3
curl -s http://old.example.com/ | grep -io '

A permanent redirect returns a status in the three hundreds and a destination header. A temporary one does the same with a different number. Masking returns a page containing a frame, with no redirect at all.

The third is the one to identify quickly, because the address bar keeps showing the old name while the content comes from elsewhere. That breaks bookmarking, sharing, certificates and search indexing simultaneously, and it does so silently.

Forwarding needs the domain to reach you first

A forward configured in the panel does nothing if the domain is not resolving to this server, which is the most common reason it appears not to work.

dig old.example.com A +short
curl -s ifconfig.me; echo
curl -sI http://old.example.com/ | head -1

If the address returned is not this server, the request never arrives and no rule here can act on it. The forward has to be configured wherever the domain currently points, or the domain has to be pointed here first.

This is why forwarding a newly registered domain frequently seems broken. The registration is complete, the panel entry is correct, and the delegation has not been changed. Updating your domain nameservers covers that step.

Forwarded domains still need their own certificate

A visitor typing the secure form of the old address gets a warning before any redirect happens, because the connection is established before the response.

echo | openssl s_client -connect old.example.com:443 -servername old.example.com 2>/dev/null \
  | openssl x509 -noout -subject -ext subjectAltName | head -5

The old name must appear in the certificate. If it does not, the browser refuses before the redirect is ever sent, and the visitor sees a security warning on a domain you thought was simply forwarding.

This is easy to miss because testing with the plain address works perfectly. Test both forms of every forwarded name, since links from elsewhere increasingly default to the secure one.