You bought a second domain — maybe a typo variant, a old brand name, or a ".in" to go with your ".com" — and now you just want it to send visitors to your main site. Somewhere in your registrar's dashboard or cPanel you spot two options: "Forwarding" and "Masked Forwarding." They sound almost identical. They are not, and picking the wrong one can quietly cost you search rankings and trigger browser security warnings for months before anyone notices why.
Symptom: The Redirect "Works" But Something's Off
A few signs that you've set this up in a way that'll cause problems down the line:
- The address bar still shows the old domain after "redirecting" to the new site — it never actually changes.
- Visitors on Chrome or Safari see "Not Secure" or a certificate warning, even though your main site has a valid SSL certificate.
- Google Search Console shows the old domain being indexed separately, with pages that look identical to your main site — a duplicate content flag.
- Links, forms, or relative paths on the redirected pages break, or the site displays inside a small scrollable frame instead of filling the browser window.
All four of these point to the same root cause: masked forwarding instead of a real redirect.
Cause: Masking Is a Frame, Not a Redirect
A proper redirect tells the browser "go fetch this other URL instead" — the browser's address bar updates, the new page loads normally, and search engines understand that the old URL now lives somewhere else. That's what a 301 (permanent) redirect does.
Masked forwarding does something different. It keeps the visitor's browser sitting on the old domain and loads your real site inside an invisible frame (technically an iframe or frameset), so the URL never changes. It's built for people who don't own a real hosting account and just want "something" to show up under a domain — think of it as a stopgap from the dial-up era, not a real deliverability tool.
Masking causes exactly the symptoms above because:
- SSL doesn't travel with the frame. The masked domain needs its own certificate to show a padlock; most registrar masking tools don't provision one, so you get a mixed-content or invalid-cert warning even though the site inside the frame is secure.
- Search engines see two URLs for one page. Google can index the framed content under the old domain's URL, which reads as duplicate content and can dilute rankings on both domains.
- Relative links and forms break. Anything coded as a relative path (
/contactinstead ofhttps://yourdomain.com/contact) resolves against the frame's outer URL, not the real one, so navigation and form submissions can silently fail. - Mobile browsers often refuse to render frames properly, leaving visitors with a broken or tiny, scrollable version of your site.
Fix: Use a Real 301 Redirect Instead
The fix is to stop masking and set up an actual redirect. You have two solid ways to do this depending on what you have access to.
Option A — Registrar-Level Forwarding (Fastest, No Hosting Needed)
Most registrars offer plain "domain forwarding" separate from "masked forwarding" — look for the option specifically labelled 301 or "permanent," not "cloaked" or "masked." This works entirely at DNS level and doesn't require the old domain to be hosted anywhere:
- In your registrar's control panel, find Domain Forwarding (not Masked Forwarding).
- Enter the destination URL as a full address:
https://yourdomain.com. - Select "Permanent (301)" if given a choice between 301 and 302.
- Leave "masking" or "cloaking" unchecked.
The catch: registrar-level forwarding usually redirects everything to one fixed URL. If someone visits oldbrand.com/pricing, they'll often land on yourdomain.com — not yourdomain.com/pricing. Fine for a simple rebrand; not fine if the old domain has pages you want mapped one-to-one.
Option B — Point the Domain to Your Hosting and Redirect via .htaccess (Full Control)
This is the right choice when you need path-preserving redirects, or a clean SSL padlock on the old domain during the transition.
- Add the old domain to your cPanel account as a Parked Domain or Addon Domain (WHM > List Accounts > Addon Domains, or cPanel > Domains).
- Point its DNS at your hosting: either an A record to your server's IP, or nameservers matching your main domain's zone.
- Once DNS resolves, run AutoSSL (or request it manually) so the old domain gets its own valid certificate — this alone fixes the browser warning.
- Add this to the
.htaccessin that domain's document root:
RewriteEngine On
RewriteCond %{HTTP_HOST} ^olddomain\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.olddomain\.com$
RewriteRule ^(.*)$ https://yourdomain.com/$1 [R=301,L]That $1 at the end is what preserves the path — olddomain.com/blog/post-1 now lands on yourdomain.com/blog/post-1 instead of dumping every visitor on your homepage. If you'd rather manage this from cPanel's UI instead of hand-editing files, the Redirects tool (cPanel > Domains > Redirects) does the same thing — just make sure "Permanent (301)" is selected and "www undefined" points to your main site's URL structure.
Masking vs. Proper Redirect: Side by Side
| Aspect | Masked Forwarding | 301 Redirect |
|---|---|---|
| Address bar | Stays on old domain | Updates to new domain |
| SSL / padlock | Usually broken or missing | Works if the old domain has its own cert |
| SEO | Duplicate content risk | Passes ranking signal to new URL |
| Path preservation | Not supported | Supported with .htaccess or CDN rules |
| Best for | Nothing you care about ranking | Rebrands, migrations, retired domains |
Prevention: Set It Up Right the First Time
A few habits that save you from redoing this later:
- Never use masked/cloaked forwarding for a domain that matters to your SEO or brand trust — treat it as legacy behavior, not a real option.
- Always choose 301 over 302 for a permanent move. A 302 tells search engines "this is temporary," so they keep the old URL indexed and don't fully pass ranking value.
- If this is a permanent migration (not a quick redirect for a spare domain), use Google Search Console's Change of Address tool on the old property so Google re-indexes the new domain faster.
- Keep the old domain's SSL certificate renewing (AutoSSL handles this automatically on SkyServer accounts) — a lapsed cert on a "just redirecting" domain still throws a warning before the redirect ever fires.
- Check for redirect loops after setup — visit the old domain in an incognito window and confirm it lands on the final URL in one hop, not two or three.
Frequently Asked Questions
What's the actual difference between forwarding and masking?
Forwarding (a 301 redirect) sends the browser to a new URL and updates the address bar. Masking loads your site inside a frame while keeping the old URL visible — the browser never really leaves the old domain.
Will a masked domain hurt my SEO?
It can. Search engines may index the framed content as duplicate content under the old domain, and no ranking value passes to your real site the way it does with a 301.
Can I redirect specific pages instead of the whole domain?
Yes, but only with a path-preserving setup — point the domain at your hosting and use an .htaccess rewrite rule or cPanel's Redirects tool with the "$1" wildcard, rather than registrar-level forwarding, which usually sends everyone to one fixed URL.
Do I need SSL on a domain I'm only redirecting?
Yes. The browser checks the certificate for whatever domain the visitor typed before the redirect fires. Without a valid cert on the old domain, they'll see a security warning before ever reaching your real site.
Should I use a 301 or 302 redirect?
Use 301 for anything permanent — a rebrand, a retired domain, a consolidated site. Reserve 302 for genuinely temporary redirects, like a short maintenance window, since it tells search engines not to update their index.
