To have or not to have a www domain name, that is the question

In your domain, machines that serve World Wide Web (WWW) files automatically get the host name "www", so your fully qualified domain name (FQDN, a name with both host name and domain name) is www.example.com. Regardless of whether other hosts have web servers, the names of other hosts in the domain will also be changed to include "www", which makes it easier to manage hosts in the network system.

Historical background

Although people often confuse the terms "domain name" and "host name", there is a difference between them, and it is not just a semantic difference. I will briefly introduce the two terms to show the difference:

As an IT administrator, your network system is your domain. You need to name this domain and register it in the Domain Name System (DNS). For example, you can name it "example.com". Under the domain are hosts, and each networked device can be counted as a host.

In your domain, machines that serve World Wide Web (WWW) files automatically get the host name "www", so your fully qualified domain name (FQDN, a name with both host name and domain name) is www.example.com. Regardless of whether other hosts have web servers or not, the names of other hosts in the domain will also be changed to include "www", which makes it easier to manage hosts in the network system.

To use the web server in the domain "example.com", you need to use the host named www.example.com. By the way: in the early days of the Internet, there was no such thing as virtual hosts. All web servers had to serve the same website (at least the same IP address). As long as the host name can point to the correct IP address, it doesn't matter what name you use.

"Naked domain names", that is, domain names without "www", such as "example.com", are called "root domain names" (the origin) in the DNS protocol. In the mid-1990s, as the World Wide Web became more and more popular, some administrators began to point the root domain name to the same IP address as the web server host. In this way, web visitors can access the web page by simply typing "example.com" in their browser instead of the full host name "www.example.com".

Then came SEO

Starting with the root domain "example.com" and the hostname "www.example.com" being able to point to different IP addresses, and after January 1997, to different pages at the same IP address, people who knew something about SEO started telling us that we had to pick a canonical hostname, and that the other name had to point to that canonical hostname, with an HTTP 301 response code.

That made sense, but which one? If you were only thinking about SEO, it didn't matter. But there were a lot of other issues beyond SEO, which I'll explain below.

People's understanding of URLs

In the early 2000s, I worked at a marketing agency, and there was a lot of concern that if we left out the "www" in a URL, people might not realize it was a World Wide Web address. It wasn't that long ago that we were leaving out http:// in a URL. Also, because of some legacy issues, I personally preferred to use the full "proper" hostname, "www.example. com".

Now it's very different. If you have a common top-level domain, everyone will understand whether you put www in it or not. Also, a version name can now be redirected to another address. So if your canonical hostname is "www.example. com" and you use the more concise "example.com" in print ads, that's fine. However, if your top-level domain is newer, like .beer, it's better to include www, because people may not recognize it as a web address.

No www is better looking and more concise

I have to admit: "example.com" is shorter and easier to read. You can't read "www" in one breath, can you? And without www, the name takes up less space. So it's understandable that people are starting to omit the "www" and just use the root domain as the hostname.

So why the debate over whether to include www or not?

Why are we still arguing about this? Can't people just use whatever they like?

Of course you can.

But if you're a webmaster, you might want to think twice before you decide, because most things on the web, like cookies, we don't think about before we use them.

Cookies are sent to all subdomains

Cookies set under the host name are also sent to all subdomains, that is, if a cookie is set on the website "example.com", the browser will also send this cookie when browsing "www.example.com".

This sounds like a good thing, because they are the same website anyway, right? However, this cookie will also be sent to "cdn.example.com", "email.example.com", "intranet.example.com", and any third-party service website containing ".example.com". Many third-party service websites share your cookies in this way.

For cookies set under "www.example.com", they are not sent to these websites. Your browser can recognize that they are not "subservices" but completely different services, so it will not send cookies.

Unnecessary cookies will slow down the operation of web pages

Every time you visit a web server, the browser sends HTTP and cookies once. So if your cookie is set under the root domain "example.com", then every time you visit "email.example.com" or "intranet.example.com", the browser will send the cookie. This can cause the web page to run slower and affect the user experience.

Third parties can read cookies

So, if your hostname is the root domain ("example.com") and you can log in to the content management system (CMS), the CMS will send a cookie to your browser while you are logged in. Then, if you visit "someinternalservice.example.com", the administrator of that website can access and use this cookie to log in to "example.com" in the CMS on your behalf.

Similarly, when you visit "email.example.com", your CDN service provider can also log in to your email service and load a large number of websites with "example.com", such as "static.example.com" and so on.

If you are concerned about the security of the content on your website, you should use a hostname with a www prefix. If this doesn't make you decide whether to prefix or not, then I can't say anything. HTTPS and two-factor authentication (2FA) do not ensure the security of your website. Although 2FA is usually useful, security measures such as IP restrictions can help.

Subdomain cookies can be shared across the entire domain

If you have a service on a subdomain such as "sso.example.com", RFC 6265 enables you to set a cookie on the subdomain and share it with "example.com" or "www.example.com". Therefore, using a prefixed hostname allows for more flexibility.

The DNS root domain cannot be a CNAME (canonical name)

Speaking of flexibility, we have to talk about DNS again.

There is a restriction in DNS that the record type of the root domain must be A, which means it must point to a fixed IP address.

As your site grows, you may move it to a hosting service, or want to point it to a web application firewall or DDoS mitigation service. At this time, you can use a CNAME record to point your hostname to another flexible hostname. This new hostname is selected and managed by the hosting provider based on your traffic and needs.

If your hostname is under the root domain ("example.com"), you cannot use CNAME. However, a prefixed hostname does not encounter this problem. Therefore, if you want to have more options, you should use a hostname with www from the beginning.

Conclusion: Add www

It makes a difference whether you use www or not. Without www, the root domain name does look simpler, but it only makes the browser search bar simpler. You can use "www.example.com" as the hostname and use the name without www elsewhere, because even if the user enters the name without www, the browser will automatically jump to the correct page.

Using the full name with www as the hostname has many advantages: the web page runs optimally, is safe and reliable, and is very flexible.