about.rdap.org

Cybersecurity is the practice of keeping your data, accounts, and services from being accessed, stolen, altered, or knocked offline by someone who shouldn't have them. For a personal site or small online presence, that reduces to a short list of concrete jobs: protect your login credentials, keep your software current, serve traffic over HTTPS, and lock down the domain and DNS layer that everything else depends on. You don't need an enterprise security team to cover the basics — but you do need to treat your registrar account and your hosting account as the two most valuable things you own, because whoever controls those controls the site.

What cybersecurity actually protects

It helps to separate the assets from the threats, because most small-site incidents come from a handful of causes.

The pattern: each asset has one or two controls that remove most of the risk. You don't need all of them on day one, but skipping the account and domain layers is the mistake that's hardest to undo.

The threat categories a small site actually faces

• Credential theft — reused or weak passwords, or credentials leaked from another breached service. This is the most common way small sites fall.
• Phishing — fake login pages or "your domain is expiring" emails designed to capture your registrar or hosting password.
• Malware and backdoors — usually arriving through an outdated CMS, plugin, or theme.
• DDoS — flooding a site until it's unreachable; often handled by your host or a CDN rather than by you.
• Misconfiguration — an open admin panel, directory listing, or default credentials left in place.

Notice that four of the five are about access, not exotic exploits. That's why the basics work.

Core protections to apply first

Use strong, unique passwords and a password manager

Every account tied to your site — registrar, host, CMS, email — should have a different password. A password manager makes this practical. The goal is that one leaked password can't be replayed anywhere else.

Turn on multi-factor authentication

MFA is the single highest-value control for your registrar and hosting accounts. Even if a password is stolen, an attacker without the second factor can't log in. Prefer an authenticator app or hardware key over SMS where the service supports it.

Serve everything over HTTPS

An HTTPS/TLS certificate encrypts traffic between visitors and your site and prevents browser "not secure" warnings. Most hosts and registrars offer a free certificate; the important part is that it's installed and that HTTP redirects to HTTPS.

Update promptly and keep the surface small

Apply CMS, plugin, and theme updates as they're released, and delete anything you're not using. Fewer components means fewer places for a known vulnerability to sit unpatched.

Apply least privilege

Give each person (and each integration) only the access they need. Don't run your site day-to-day from an administrator account, and don't hand out admin rights for tasks that don't require them.

Secure the domain and DNS layer

This layer is easy to overlook and expensive to lose, because a hijacked domain can point anywhere.

• Protect the registrar account with a unique password and MFA. Your registrar account is the root of control over the domain.
• Enable the registrar lock (often called a transfer lock or clientTransferProhibited) so the domain can't be moved without your action.
• Keep registrant contact email secure — that inbox is often the recovery path for the domain.
• Enable DNSSEC where your registrar and DNS provider support it, so responses can be cryptographically validated and spoofing is harder.
• Watch for unauthorized DNS changes — if records you didn't touch appear, treat it as a compromise.

Porkbun is an ICANN-accredited domain registrar, which means it operates under ICANN's registrar rules — relevant here because those rules govern transfers, locks, and registrant contact requirements. Its site lists Stripe among its payment platforms. Beyond that, check your specific registrar's and DNS provider's current feature set for lock and DNSSEC support, since availability varies.

Warning signs and first steps if something looks wrong

Watch for: unexpected DNS records, visitors reporting malware warnings, unexplained admin accounts, a sudden traffic drop, or emails about transfers you didn't request.

If you suspect a compromise:

1. Change passwords on registrar, hosting, and CMS accounts, starting with the registrar.
2. Revoke active sessions and reset MFA where possible.
3. Check DNS records against what you expect and revert unauthorized changes.
4. Restore from a known-good backup if files were altered.
5. Re-scan and update the software before reopening the site.

Containment first, then recovery — don't try to clean a live, still-compromised site.

What to outsource vs. manage yourself

Hosting-level security, CDN, and WAF are usually worth outsourcing because they require scale and constant attention. Account hygiene, MFA, updates, and domain/DNS protection are things you should keep in your own hands regardless of size — they're cheap to do and costly to skip.

An IP address is a numeric label assigned to a device or network so data can be routed to and from it. On Windows you have two relevant kinds: a private (local) IP used inside your home or office network, and a public (external) IP that the outside world sees. To check your public IP, the fastest method is a browser-based lookup; if you want it always visible on your desktop, a small utility such as the IP Address Utility from rtmenu.com can display your external IP in a customizable window.

Private vs. public IP addresses

Your Windows PC normally holds a private address. The router translates traffic between that private address and the single public address your ISP gives your connection (a process called NAT). That's why "what is my IP" tools show the router's public address, not your PC's local one.

How to see your public IP on Windows

Method 1: Browser lookup (no install)

1. Open any browser.
2. Search for "what is my IP address" or visit an IP-lookup page.
3. The number shown at the top is your public/external IP.

Expected result: a single IPv4 (and sometimes IPv6) address. This reflects what external servers see.

Method 2: A dedicated Windows utility

The rtmenu.com IP Address Utility is described as displaying the IP address "as visible to the outside world (external ip address) in a customizable window," with a display format that "can be changed easily."

Typical flow for this kind of tool:

1. Install and launch the utility.
2. It queries an external service and shows your public IP in a small window.
3. Adjust the window's display format to suit how you want the address presented.

Expected result: your external IP stays visible without opening a browser each time — useful if you check it often (remote access, server work, troubleshooting).

Why your public IP changes

• ISP reassignment: Many ISPs hand out dynamic addresses that rotate over time or after a router reboot.
• Router restart: Power-cycling the router can trigger a new lease from the ISP.
• VPN or proxy: Connecting through a VPN replaces your visible IP with the VPN server's address; toggling a proxy does the same.
• Network switch: Moving to a different network (mobile hotspot, office, café) changes the public IP entirely.

Troubleshooting: the displayed IP looks wrong

• It shows a private address (192.168.x.x, 10.x.x.x): You're likely looking at your local IP, not the external one. Use a tool or page that explicitly reports the external/public address.
• It shows a VPN's location: Disconnect the VPN or proxy and re-check.
• It changed unexpectedly: Confirm whether your router rebooted or your ISP rotated the lease.
• IPv4 vs. IPv6 mismatch: Some tools report one or the other; check which family you actually need.

Quick decision guide

• Just need the number once: Use a browser lookup — no install required.
• Check it frequently on Windows: A tray/desktop utility that shows the external IP in a customizable window saves repeated browser trips.
• Need to confirm what a remote server sees: Always use an external lookup, since your PC's local IP won't match.

If you're new to Ahrefs and want to run your first SEO audit, the fastest path is: open Site Explorer, enter your target URL, review the Overview for a health snapshot, then dig into Organic Keywords, Top Pages, and Site Audit to find specific problems. From there, build a short prioritized to-do list instead of trying to fix everything at once.

This tutorial walks through that workflow using a realistic starting scenario, explains what the numbers mean, and shows how to turn findings into actions.

Before You Start: Pick a Narrow Scope

A common beginner mistake is auditing an entire large website on day one. The reports become overwhelming, and you can't tell which issues matter.

Instead, choose one of these starting points:

• A single important page (your homepage or a key product/service page)
• A small site (under ~50 pages, e.g., a personal blog or small business site)
• One section of a bigger site (e.g., /blog/)

For this tutorial, assume you're auditing a small business site with about 30 pages. The same steps scale up later.

You'll need an Ahrefs account to follow along. Ahrefs offers paid plans, and pricing and feature limits change over time, so check the current Pricing page for what's included in each tier before committing.

Step 1: Enter Your Target in Site Explorer

Site Explorer is Ahrefs' core tool for analyzing any website or URL.

1. Open Site Explorer from the top navigation.
2. In the search box, paste your domain (e.g., example.com).
3. Choose the Exact URL or Domain mode depending on scope. For a full-site view, use Domain or Prefix; for a single page, use Exact URL.
4. Press Enter.

You'll land on the Overview report. Don't try to absorb everything — focus on four numbers first.

Reading the Overview Snapshot

Important caveat: Ahrefs' traffic and keyword numbers are estimates based on its own data. They won't match Google Search Console or your analytics exactly. Treat them as directional, not absolute.

Step 2: See What You Already Rank For

Go to Organic Keywords in the left sidebar. This shows queries where your site appears in search results.

Sort by Traffic (descending) to see which pages bring the most estimated visitors. Then look for:

• Keywords ranking in positions 4–15 — these are often the easiest wins. A small content or on-page improvement can push them onto page one.
• Keywords with high volume but low position — potential opportunities if the topic is relevant.
• Irrelevant keywords — if you rank for something off-topic, it may signal thin or mismatched content.

Write down 5–10 of the position 4–15 keywords. These become your first optimization targets.

Step 3: Find Your Best and Weakest Pages

Open Top Pages. This ranks your URLs by estimated organic traffic.

Look for two things:

1. Your top performers — understand what topics and formats work. Can you create more content like this?
2. Pages with traffic but poor rankings — these may need on-page fixes (title, headings, internal links).

If a page gets zero traffic and targets a topic you care about, it's a candidate for a rewrite or consolidation.

Step 4: Run a Technical Site Audit

Now move to Site Audit. This crawls your site and flags technical and on-page issues.

1. Click Site Audit → New project.
2. Enter your domain and set crawl settings (default is usually fine for a small site).
3. Start the crawl and wait for it to finish.

Once complete, you'll see a Health Score and a list of issues grouped by category.

Which Issues to Fix First

Not all issues are equal. Prioritize in this order:

Ignore low-impact warnings (like minor meta description length) until the big items are handled.

Step 5: Turn Findings Into a To-Do List

You now have raw data. Convert it into a short, actionable list. Example:

1. Fix 3 broken links found in Site Audit.
2. Rewrite title tags on 5 pages with duplicate titles.
3. Improve 4 pages ranking in positions 6–12 by adding missing subtopics and internal links.
4. Remove or update 2 thin pages with no traffic.

Keep the list to 5–10 items max for your first audit. Finishing a short list beats starting a long one.

Common Beginner Mistakes

• Chasing every red flag. Site Audit flags many minor issues. Fix what affects rankings and users first.
• Trusting estimates as exact numbers. Ahrefs data is modeled, not measured from your analytics.
• Auditing a huge site too early. Start small to learn the interface.
• Ignoring search intent. A page can be technically perfect but still fail if it doesn't match what searchers want.
• Forgetting to re-crawl. After fixes, run Site Audit again to confirm improvements.

Where to Go Next

Once your first audit is done:

• Compare with competitors using Site Explorer's Competing Domains and Content Gap reports.
• Track keyword rankings over time with Rank Tracker.
• Explore backlink opportunities in the Backlinks and Link Intersect reports.
• Set up recurring Site Audit crawls so new issues surface automatically.

Your first audit isn't about perfection — it's about building a repeatable habit: enter a target, read the key reports, pick the highest-impact fixes, and act. Do that once a month and your site's health compounds.

A domain name is the human-readable address people type to reach a website or online service — like sedo.com. It works by mapping that readable label to a numeric IP address through the Domain Name System (DNS), so you don't have to memorize strings of numbers. You need a domain name if you want a stable, memorable address for a website, email, or brand. You can get one either by registering a new, unclaimed name through a registrar, or by buying an already-registered name on an aftermarket marketplace such as Sedo.

Domain name vs. URL, website, and hosting

These four terms get used interchangeably, but they describe different things:

A useful way to think about it: the domain name is the street address, hosting is the building on that land, the website is what's inside the building, and the URL is the directions to a specific room.

The parts of a domain name

Reading a domain from right to left:

• Top-level domain (TLD) — the ending, such as .com, .org, or a country code like .us. This is the broadest category.
• Second-level domain — the part you choose and that makes the name yours, such as sedo in sedo.com. The combination of second-level name + TLD is what you register.
• Subdomain — an optional prefix you control, such as blog.example.com or shop.example.com. Subdomains don't need separate registration; you create them through your DNS settings.

So in blog.example.com: blog is the subdomain, example is the second-level domain, and .com is the TLD.

How DNS turns a name into an IP address

Computers locate each other by IP addresses, not names. DNS is the system that translates one into the other. When someone types your domain into a browser, roughly this happens:

1. The browser asks a DNS resolver to look up the name.
2. The resolver queries a hierarchy of name servers until it reaches the authoritative name server for your domain.
3. That server returns the IP address (and other records) associated with the name.
4. The browser connects to that IP address and requests the page.

The key practical point: your domain and your hosting are linked through DNS records. You point your domain at a server by setting records such as an A record (maps a name to an IPv4 address) or a CNAME record (points one name to another). Changing hosts usually means updating these records, not moving the domain itself.

How domains are registered, owned, and renewed

Domains aren't bought outright in the way physical property is. They're registered for a fixed term — commonly one year at a time — through an accredited registrar.

• Registration gives you the exclusive right to use that name for the term you paid for.
• Ownership is tracked in a registry database, with your contact details (often privacy-protected) on record as the registrant.
• Renewal is required. If you let a domain lapse, it can expire and eventually become available to others. Most registrars offer auto-renew to prevent accidental loss.
• Transfer lets you move a domain between registrars, usually by unlocking it and using an authorization code.

Because renewal is ongoing, the real cost of a domain is the registration or purchase price plus the recurring renewal fee.

Registering a new domain vs. buying a premium or aftermarket domain

There are two distinct paths, and they differ in price, availability, and process:

Registering a new domain

• You search for a name that no one currently holds and register it through a registrar.
• Typically the lowest-cost route, with standard renewal pricing.
• Best when your preferred name is still unclaimed.

Buying a premium or aftermarket domain

• The name is already registered, and the current owner is offering it for sale — often through a marketplace like Sedo, which lists domains for sale and premium domains.
• Pricing is set by the market or the seller and can be far higher than a standard registration, reflecting the name's perceived value.
• Best when the exact name you want is taken and matters enough to your brand to pay for it.

Sedo operates as a marketplace for buying, selling, and parking domains, so both new registrations and aftermarket purchases can fit into the same workflow depending on what you need.

What this means for your next step

If you just need any available name, start with a registrar search and register it, then point its DNS records at your hosting. If the name you want is already taken and central to your plans, look at aftermarket listings and expect market-based pricing. Either way, plan for renewal from the start — a domain is a recurring commitment, not a one-time purchase.

RDAP (Registration Data Access Protocol) is the structured, HTTPS-based replacement for WHOIS. You use it to look up registration data for a domain name, an IP address or CIDR block, or an Autonomous System Number (ASN), and you get back a JSON record instead of free-form text. A private RDAP lookup tool such as client.rdap.org sends your query directly from your browser to the relevant registry's RDAP server over an encrypted HTTPS connection, so only that registry sees the query.

What RDAP is and why it replaces WHOIS

WHOIS returns unstructured text that varies by registry, which makes it hard to parse reliably and hard to extend. RDAP standardizes both the transport and the data model:

• Transport: HTTPS requests instead of a plain-text protocol on port 43.
• Format: JSON with defined fields, so responses can be parsed and validated programmatically.
• Access control: Because responses are structured, registries can return different levels of detail depending on who is asking, rather than exposing everything to everyone.

The practical effect for you: the same query type returns a consistent shape of answer across registries that support RDAP.

How RDAP differs from WHOIS

The coverage gap matters in practice. All generic TLDs now support RDAP, but only a few country-code TLDs (ccTLDs) have deployed it. If a ccTLD has not deployed RDAP, an RDAP lookup for that domain will not return a registry record.

What you can look up

An RDAP lookup tool supports several query types:

• Domain — registration data for a domain name.
• TLD — information about a top-level domain.
• IP / CIDR — allocation data for an IP address or a CIDR block.
• AS Number — data for an Autonomous System Number.
• Entity — a registered entity such as a contact or organization handle.
• Registrar — registrar records.

Note one structural limitation: there is currently no bootstrap registry for ICANN-accredited registrars, so registrar queries are sent to the registrars.rdap.org server rather than resolved through a bootstrap mechanism.

How to run a lookup and read the response

1. Choose the query type that matches what you have — domain, IP/CIDR, ASN, entity, or registrar.
2. Enter the value and submit. Your browser connects directly to the registry's RDAP server over HTTPS.
3. Read the JSON response. The record contains the registration data for that object, with fields defined by the RDAP data model.
4. Decide whether to follow the referral. If the "Follow referral to registrar's RDAP record" checkbox is checked, the sponsoring registrar may also see your query — but only if the registry provides a referral.

The privacy point is the reason to care about step 4. With the referral option off, only the relevant registry sees your query. Turning it on can add the registrar as a second party that sees it. If you want the narrowest exposure, leave the referral option unchecked and accept that you may not see the registrar's portion of the record.

When a lookup fails or looks wrong

Two distinct problems come up:

• No RDAP record for a ccTLD. This is a coverage issue, not an error in your query. The ccTLD has not deployed RDAP, so there is no registry RDAP server to answer. There is no RDAP equivalent to fall back on for that TLD.
• A response that looks incorrect. RDAP responses are the registry's or registrar's content. If something in the response is wrong, contact the relevant registry or registrar — the lookup tool is only relaying the query. To check whether a response is malformed rather than merely unexpected, you can run it through an RDAP Validator.

Quick reference

• RDAP = structured, HTTPS, JSON replacement for WHOIS.
• Supported queries: domain, TLD, IP/CIDR, ASN, entity, registrar.
• Privacy: your browser connects directly to the registry over HTTPS; only the registry sees the query unless you follow the referral to the registrar.
• Coverage: all generic TLDs support RDAP; only some ccTLDs do.
• Registrar queries: no bootstrap registry exists, so they go to registrars.rdap.org.
• Bad response content: report it to the registry or registrar, and validate it with an RDAP Validator first.