Nearly every mature hosting product ships customer content on a domain that isn't its own: GitHub uses github.io, Shopify uses myshopify.com, Wix uses wixsite.com, Notion uses notion.site. We knew this pattern existed. We launched anyway with every client site on a subdomain of our main domain — acme.niptao.com — because it looked tidy and it was one less thing to set up.

This week we un-made that decision and moved all 28 published client sites to a separate domain, niptao.page. Here's why, and what the move actually involved.

What's actually at risk

The intuition people reach for is ranking dilution — that client content somehow waters down your own keywords. That's mostly wrong: search engines treat subdomains largely as separate sites. The real problem is that other systems don't.

Safe Browsing is the scary one. If one customer site ever gets flagged — hacked, phishing-lookalike, a bad report — the flag doesn't reliably stay contained to that one site. In the worst case it's the full-screen red warning on your marketing site and on other customers' sites at the same time. One incident, everyone punished.

Search engines police "parasite SEO." Since 2024, Google explicitly demotes third-party content hosted on a brand's subdomains, and it can act at the domain level. Dozens of templated small-business sites hanging off one brand domain is exactly the shape that policy looks for — even when the content is legitimate.

Everything shares one reputation. Email blocklists, security scanners, and one shared Search Console property all cluster at the domain. Your customers' fates get tied to yours, and yours to theirs.

These risks are manageable at 28 curated sites and hard to ignore at 2,000. The domain is cheap and the setup is easiest early — later it's a migration. Worth doing before scale, not after.

The fix is a $10 domain

We bought niptao.page ($10.20/yr) and made it the default home for every site we build: acme.niptao.page. Brand-adjacent, clearly ours, but a different domain as far as Safe Browsing, spam systems, and search are concerned. Paying customers were never the point here — they move onto their own domain anyway. The utility domain is for everyone on the way there.

In code, the whole change reduced to one rule: client hostnames are constructed in exactly one place, driven by one setting. The migration then became "change the setting, republish."

Moving 28 live sites took about half an hour

The move itself, in order:

  1. Republish every site under the new host. Our publish pipeline wires DNS and the CDN per site, so this was one command per site. The canary caught the one gotcha: a republish reused the old sitemap.xml with old-host URLs baked in. Regenerating the sitemap and metadata files had to be forced, not assumed — worth checking on any host move.
  2. One wildcard redirect instead of 28. We deleted every per-site DNS record on the old domain and replaced them with a single wildcard record plus a single edge rule: anything.niptao.com/path → 301 https://anything.niptao.page/path, query string preserved. Every old link anyone ever shared still lands somewhere real.
  3. Swap the sitemaps. Old submissions removed from the old Search Console property, 28 new ones submitted under the new domain's property.
  4. Skip Change of Address. Google's move tool works per property, all-or-nothing — running it on our main domain would have declared that niptao.com itself moved. For subdomain-level moves, permanent 301s plus swapped sitemaps are the whole signal.

Then a sweep: 28 of 28 new hosts returning 200, 28 of 28 old hosts redirecting. Total wall-clock, about thirty minutes — because the sites are static, the list was short, and hostname construction lived in one place.

The part we couldn't do yet

The gold standard is getting the shared domain onto the Public Suffix List — the registry that tells browsers and security systems "every subdomain here is its own site." That's what makes github.io isolation real: cookies, Safe Browsing, and reputation stop crossing between customers at all.

We prepared the submission and then read the fine print: the PSL asks for roughly 2,000–3,000 distinct users before listing. We have 28. So the entry sits staged in a fork, waiting for the number to be honest. Separate domain now, PSL when we've earned it.

If you're building anything that hosts customer content, the takeaway is the boring one: spend the $10 on day one. The best time to pick the second domain is before your first customer — the second-best time was our thirty minutes this week.