Your website is down or your domain expired: what to do in the first hour

A customer messages to say your website isn’t loading. Or your email has gone quiet for two days. Or you typed your own address and got a parking page full of ads. This is the moment the phone also tends to ring with someone offering to fix it for a fee. Ignore them. Recovery is almost always something you can do yourself in an hour, and the order below prevents you from paying for the wrong thing.

First rule: do not pay anyone who contacted you. Not the caller, not the email with your domain name in the subject line, not the letter. You will renew or fix things by logging in to the accounts you already have. If you’re not sure which those are, the ownership checklist is where to find out.

The three-minute diagnosis

A website is three separate things: the domain (the name), DNS (the directions), and hosting (the files). Any one of them can fail alone. Check them in this order:

1. Is the domain still yours? Type it into the ICANN lookup (or CIRA’s lookup for a .ca). Look at the expiry date and the status lines. An expiry date in the past, or a status like redemptionPeriod or pendingDelete, means the domain is the problem. On a .ca, cross-check the date with your registrar account or last invoice: CIRA renews every .ca automatically at expiry, and your registrar then has up to 45 days to cancel that renewal if it isn’t paid, so a lookup can show a year you haven’t paid for. Skip to the next section.

2. Is DNS pointing anywhere? If the domain is fine, the “directions” may have been wiped. This happens after a registrar transfer, after a builder subscription ends, or when a designer’s account closes. Log in to wherever your DNS lives (the registrar, or Cloudflare) and check that the records still exist. If the zone is empty, you need to re-enter the records; if you kept the copy this site keeps telling you to keep, that’s ten minutes.

3. Is the hosting alive? Domain fine, DNS fine, still no site: the host is down or the account lapsed. For Cloudflare Pages, open the dashboard and check the project still exists and the last deployment is there; the free plan doesn’t expire. For a paid host or builder, log in and look for an unpaid invoice or a suspended account. For a designer’s hosting, this is the day you find out whether you can log in at all.

Email uses the same three pieces, so an email outage follows the same checks. If both site and email died on the same day, it is almost always the domain or the DNS, not two separate failures.

If the domain expired: the clock you’re on

An expired domain is not gone. It moves through stages, and the earlier you act the cheaper it is.

1. Grace period (up to about 45 days, set by your registrar). The site and email stop working, but you can renew at the normal price by logging in to your registrar. Some registrars give you far less than 45 days before moving on, so treat this as “this week,” not “sometime.”
2. Redemption (30 days). The registry has deleted the domain but holds it for you. Your registrar can still recover it, for the renewal price plus a redemption fee that is typically many times the renewal. Expensive, but still far cheaper than losing the name.
3. Pending delete, then release. The domain is dropped and anyone can register it. Domains with any history at all are often picked up within seconds by automated buyers, who then offer to sell it back at a price of their choosing. This is the outcome everything above is designed to prevent.

What to do: log in to the registrar the lookup named, go to the domain, renew. If the registrar says it’s in redemption, pay the redemption charge; it’s unpleasant, but the alternative is buying your own name back from a stranger. If you can’t log in because the account was someone else’s, contact the registrar’s support with proof you own the business, and do it today, because the clock doesn’t stop for account-recovery emails.

What not to do: buy a “similar” domain to tide you over (customers, Google, and your printed materials all know the real one), or pay a third party that emailed offering to “recover” it. The only company that can restore a domain in redemption is the registrar it expired at. A .ca works the same way: CIRA says that once a domain enters redemption, it can no longer be moved to another registrar. Until then, including the auto-renew grace period right after expiry, a move is still possible, but your registrar may set that window shorter than 45 days, so if you want to leave, start the transfer early.

After you’re back online

1. Turn on auto-renew for the domain. The cost of a domain accidentally renewing a year early is one renewal fee. The cost of it lapsing is everything above.
2. Check the card on file at the registrar. Expired cards are the number-one reason auto-renew fails, and the failure email goes to whatever address was on the account, which may be the designer’s.
3. Make sure the registrar’s emails reach a human who works for the business. Not the ex-employee, not the agency, not an address at the domain that just expired (which can’t receive mail while the domain is down — a trap that catches people every day). The account security guide covers recovery addresses properly.
4. Write the renewal date down in the ownership checklist and download the reminder file. A calendar alert thirty days ahead makes a repeat of this much less likely.
5. Find out what else is on a timer. The bill audit surfaces every renewal date in an hour, which is the cheapest insurance there is.

If the site is down but nothing expired

Rarer, and usually simpler:

• A change you made broke it. On Cloudflare Pages, roll back to the previous deployment from the project’s deployment list; the editing guide shows where.
• The host is having an outage. Check the provider’s status page (search “provider name status”). There’s nothing to fix; wait it out, and consider whether a host with regular outages is one you want.
• DNS was changed by someone. If records changed and you didn’t change them, treat it as a security incident: change the registrar and DNS account passwords, turn on two-factor authentication, and check whether the account’s email address was altered. The security guide walks through it.

Keep recovery usable

Use the backup register and restore exercise to record what the copy includes, where protected access instructions live, and whether a sample restores successfully. A copy inside the same inaccessible account may not survive that account’s loss. Keep recovery instructions outside the affected device and preserve required records before cancelling a service.