In short: A site can disappear for three trivial reasons: an expired domain, DNS changed by mistake or a certificate that was not renewed. Since 15 March 2026 public SSL certificates last no more than 200 days, from 15 March 2027 100 days and from 15 March 2029 47 days: automatic renewal is now essential.
When a site goes down because of a serious fault, the cause is often complicated. When it goes down because something expired, the cause is almost always trivial: nobody renewed the domain, someone changed a DNS record without telling anyone, the certificate expired overnight. These are problems you can avoid with an hour of housekeeping and a few alerts.
The domain
- Registrant and contacts. The domain should be registered to the company, with a contact email address that someone actually monitors. A domain registered to the supplier or to a former member of staff is a risk.
- Expiry and auto-renewal. Turn it on with a valid card and keep track of when the domain expires. Some registrars send reminders to addresses you no longer check.
- Transfer lock. Keep it on: the domain cannot be moved unless someone explicitly removes the lock.
- Protected access. A long password and two-factor authentication on the registrar's control panel. Whoever controls it controls your website and your email.
- One place where the credentials live, kept in a company password manager.
The DNS
DNS is the directory that translates the domain name into the server's address. A mistake here can make your website and email unreachable within minutes.
- Main records. A or AAAA (or CNAME) for the website, MX for email, TXT for verifications. Email also needs SPF, DKIM and DMARC: see SPF, DKIM and DMARC.
- A list of the records with their purpose and owner. A record nobody can explain either gets deleted nervously or stays there forever.
- Update times (TTL). Lower them before a migration so the switch happens faster.
- A reliable DNS service with multiple servers and role-based access. If you use a protection service in front of the site, check that the records are set to the right mode.
- Change history. Knowing who changed what, and when.
The SSL (TLS) certificate
The certificate enables HTTPS: it encrypts the connection and proves that the site is the one belonging to the domain. Without a valid certificate, browsers show a warning and customers leave.
Lifetimes are getting shorter
The CA/Browser Forum, the body that sets the rules for certificate authorities, has approved a schedule that reduces the maximum validity of public certificates:
- until 15 March 2026: 398 days;
- from 15 March 2026: 200 days;
- from 15 March 2027: 100 days;
- from 15 March 2029: 47 days.
The limit depends on the date the certificate is issued. The periods during which domain validation can be reused are getting shorter too. In practice, renewing by hand once a year is no longer sustainable and within a few years it will be impossible.
How to get organised
- Automatic renewal with the ACME protocol, used by many providers and by the certificate authorities that issue certificates at no cost. On managed hosting it is often already included.
- An independent check that warns you when a certificate expires in less than two weeks.
- A list of all your certificates: website, subdomains, shop, APIs, email. The forgotten ones are the first to expire.
- An owner for every certificate that isn't automated.
A quarterly checklist
- Does the domain expire more than six months from now? Is auto-renewal working?
- Is the transfer lock on?
- Does access to the registrar use two-factor verification?
- Is the list of DNS records up to date?
- Does every certificate renew itself? When does the next one expire?
- Do expiry alerts reach someone who reads them?
If it has already happened
- Expired domain. Renew it straight away: there is usually a short grace period before deletion. Ask your registrar about the terms.
- Expired certificate. Renew it and check the certificate chain too. Then test it from a browser and from a phone.
- Wrong DNS. Restore the previous record from the change history. The change can take minutes or hours to propagate.
Further reading: hosting for a WooCommerce shop · backups that actually work · website care and maintenance
Frequently asked questions
How long does an SSL certificate last today?
Under the schedule approved by the CA/Browser Forum (ballot SC-081v3), the maximum validity of public TLS certificates is 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. The issue date determines which limit applies.
What happens if the certificate expires?
Browsers show a full-screen security warning and most visitors leave the page. Payments and integrations that use HTTPS can also stop working.
What is a domain transfer lock?
A setting at the registrar that stops the domain from being moved elsewhere unless the lock is explicitly removed. It protects against unauthorised transfers.
What are DNS records?
They are the instructions that say where a domain's website (A, AAAA or CNAME record) and email (MX record) can be found, and they are also used by other services such as SPF, DKIM and DMARC for email.