Buying a domain feels like a milestone, so a lot of indie builders buy one before they have anything worth visiting. Others launch on a free subdomain and never leave, then wonder why Google, AdSense, and email all quietly refuse to cooperate. The honest answer is binary: there are four moments where a custom domain stops being optional, and outside those moments the free subdomain is fine. This walks through both.
TL;DR
Stay on the free subdomain for throwaways, demos, and internal tools. Buy a domain the instant any of these is true: you submit the site to Google for ranking, you accept payments or apply for AdSense, you advertise the URL anywhere offline, or you expect the project to outlive 90 days. A standard .com runs about $10–11 per year (Porkbun, Cloudflare Registrar), so the decision is almost never about the money.
What you actually get for free
Every major host in 2026 hands you a free subdomain with automatic HTTPS:
| Host | Free subdomain | Commercial use on free tier? |
|---|---|---|
| Vercel | yoursite.vercel.app | No — Hobby tier is non-commercial |
| Firebase Hosting | yoursite.web.app / .firebaseapp.com | Yes — Spark tier allows commercial use |
| Netlify | yoursite.netlify.app | Yes, within free bandwidth limits |
| Cloudflare Pages | yoursite.pages.dev | Yes |
These are genuinely good for prototypes and side projects nobody will see. The trouble starts the moment you want SEO, email, a brand, or money — because none of those work properly on a borrowed subdomain.
The four hard triggers
If even one of these applies, buy the domain. Each is a wall, not a preference.
1. You want Google to rank you as a real site
Search engines treat a platform subdomain as a tenant of the host, not a standalone property. yoursite.vercel.app shares its root reputation with thousands of other Vercel projects, and you cannot fully control Search Console at the apex. Owning the domain means the SEO equity you build is yours, and it survives a host migration.
2. You want email at the name (hi@yoursite.com)
This is flatly impossible on a free subdomain — you do not control the MX records of vercel.app. A you@gmail.com reply to a customer reads as a hobby; hi@yoursite.com reads as a business. You need the domain before you can point MX records at Google Workspace, Fastmail, or a free forwarder.
3. You will apply for AdSense, affiliates, or payments
This is the strictest wall. As of June 2026, Google AdSense and every major ad network (Mediavine, Ezoic, Raptive, Media.net) either explicitly require a custom domain or silently fail their automated checks against *.vercel.app-style URLs. AdSense in 2026 also wants a domain roughly 3–6 months old with 20–30 substantial original articles before approval, so buying late costs you that aging clock. Most affiliate programs and payment providers expect a custom domain too.
4. You are building a brand people will say out loud
Nobody dictates yoursite-prod-v2.vercel.app over the phone or types it from a podcast mention. If the URL will appear on a business card, a conference slide, a YouTube description, or in conversation, it has to be a clean name you own. Owning it also lets you switch hosts later without breaking a single inbound link.
What a domain actually costs (June 2026)
Price is rarely the real constraint. These are current registration and renewal figures at the two registrars that price closest to cost:
| TLD | Porkbun (register / renew) | Cloudflare Registrar (at cost) | Notes |
|---|---|---|---|
.com | ~$9.73 / ~$10.91 | ~$10.44 flat | Registry raising .com ~7%/yr through 2030 |
.dev | ~$12 / ~$12 | at cost | Forced HTTPS (HSTS preloaded) |
.app | ~$14 / ~$14 | at cost | Also HSTS preloaded |
.ai | ~$82 / ~$83 | ~$70 | Pricier; 2-year minimum at some registrars |
.io | ~$32 / ~$45 | varies | See the .io note below |
Cloudflare Registrar charges exactly the registry fee plus the $0.18 ICANN fee with zero markup, but it requires you to use Cloudflare’s nameservers. Porkbun lets you keep any DNS provider and prices nearly as low. Both include free WHOIS privacy and a free SSL cert.
Buying it, step by step
- Pick the name. A clean
.comis the safest long-term choice..dev,.app, and.aiare fine when.comis gone; skip.xyzand.onlineunless you accept the spam-adjacent trust hit. - Compare across registrars. Check Porkbun, Cloudflare Registrar, and Spaceship before you buy. Avoid any registrar that low-balls year one and triples in year two.
- Enable WHOIS privacy at checkout. It is free at Porkbun, Cloudflare, and Namecheap in 2026. Do not pay extra for it.
- Point DNS at your host. An
Arecord (orALIAS/flattenedCNAME) for the apex, aCNAMEforwww. Our DNS guide below covers the exact records. - Add the domain in your host’s dashboard (Vercel / Firebase / Netlify / Cloudflare Pages) and wait for the SSL certificate to provision — usually minutes.
- Update every reference to the URL: Search Console property, sitemap, canonical tags, Open Graph URLs, hardcoded links, and social profiles.
- Set a renewal reminder one month out. Auto-renew is on by default, but expired cards are the number-one way good domains lapse.
Common pitfalls
- Buying before you have something to ship. You pay for the domain, build nothing, then forget it auto-renews in year two.
- Clever spelling nobody can dictate.
flickrworked once; you are not Flickr. If you have to spell it out loud, rename. - Grabbing a cheap TLD because
.comis taken. A.xyzor.onlineadds friction to every trust decision a visitor or ad network makes. - Choosing a registrar with a hostile transfer policy. Read the transfer-out terms before you buy; some lock or upcharge.
- Letting it lapse. A dropped domain gets sniped by speculators, and reclaiming a name you built on can run into the thousands.
FAQ
- How much should a
.comactually cost in 2026?: About $10–11 per year at Porkbun or Cloudflare Registrar. The registry is raising the wholesale.comprice roughly 7% a year through 2030, so expect slow creep, not spikes. Anything far above ~$13 from a mainstream registrar is markup. - Should I buy multiple TLDs to protect the brand?: Only once the brand has real value. One
.comis enough for almost every indie project at launch; add the matching.aior.applater if you take off. - Can I transfer a domain after buying?: Yes, once the 60-day ICANN lock from registration expires. Unlock it at the old registrar, copy the auth (EPP) code, and start the transfer at the new one.
- Is
.iostill safe in 2026?: For now, yes. After the UK–Mauritius Chagos agreement (signed May 2025), there is a scenario whereIOis removed from the ISO 3166-1 list, which would start ICANN’s standard multi-year retirement window — not an overnight shutdown. Industry consensus is that.iois not going dark anytime soon, but for a long-term brand a.comcarries zero of that uncertainty. - Does a free subdomain hurt me at all if I’m just experimenting?: No. For demos, internal tools, and weekend hacks, a
*.vercel.appor*.web.appURL is perfect. The cost only shows up when you need SEO, email, ads, or recall.