Nineteen days from losing the domain - Cuban Buffet
Published
This one started with a recommendation. We sent somebody to the restaurant's website, the site did not load, and the QR code on their printed material did not work either. A domain is the one asset a business cannot rebuild from a backup, and it is the one nobody checks.
The domain redirected visitors to a scam page
Entering cubanbuffet.com redirects first to "bigmeechies" and then to lifeandfoodtown.com/candied-strawberries-recipe, a scam page. The WordPress installation was compromised, at approximately September 2025. Any customer visiting the domain ends up on a fraudulent site.
For roughly six months, every customer who typed the restaurant's address was handed to somebody else's scam. That reaches the people most likely to buy, because they are the ones who already knew the name. It also puts the restaurant's domain into browser and reputation blocklists, which outlast the compromise and are slow to clear.
A hacked site is discovered by monitoring or by a customer, and one of those is free. Point an uptime check at the domain that follows redirects and alerts on the final URL rather than on a 200 response, because a compromised site answers perfectly while serving somebody else's content. Keep the CMS patched or remove it: a brochure site with no logins and no database has almost no attack surface to maintain. The anti-pattern is treating a website as finished at launch, after which nothing looks at it until a customer says it is broken.
Background: static sites vs a CMS.
Registrar locks blocked renewal with 19 days to expiry
The domain carries the following active restrictions: clientDeleteProhibited, clientRenewProhibited, clientTransferProhibited, clientUpdateProhibited. These restrictions mean the domain cannot currently be renewed, transferred or modified without first contacting the registrar to unlock it. That has to happen before March 30 or the domain is lost.
clientRenewProhibited is the dangerous one, because it removes the action that saves the domain. The owner discovers it at the moment they try to renew, which is usually the week it expires, and unlocking runs through the registrar's support queue rather than a settings page. A restaurant that loses its domain does not just lose a website: the email addresses stop, the printed material points nowhere, and anybody can register the name the day it drops.
Turn on auto-renew and put a card on the account that does not expire before the domain does, because a declined renewal is the most common way a domain is lost. Register for the longest term you are willing to pay for; ten years costs less attention than ten renewals. Read the status codes once a year: clientTransferProhibited is a sensible default that blocks hijacking, clientRenewProhibited is not, and the two look alike in a list. The anti-pattern is leaving domain renewal to a calendar reminder aimed at whoever set it up.
Background: domain vs hosting vs website.
No valid certificate, so browsers warned before the page loaded
SSL/TLS certificate: not valid or non-existent. Browsers show visitors a "site not secure" warning.
The warning is a full-page interstitial the visitor has to click through, and it arrives before any of the restaurant's content. Most people do not click through. It also compounds the redirect above: a browser that has already flagged the site as unsafe is the one being sent to a scam page.
Certificates are free and issue in under a minute, so this is never a cost decision. Automate renewal with ACME rather than diarising it, because a certificate lasts 90 days and nobody remembers a task that recurs four times a year. Monitor expiry separately from renewal, since the failure that matters is the automation silently stopping. The anti-pattern is paying for a certificate: the paid ones offer nothing a visitor can see.
Background: SSL certificates.
The QR code printed on the restaurant's material led nowhere
The QR code printed on their material uses a third-party service, qrco.de, and the link no longer works. Anybody who scans it gets an error, which makes a poor impression and loses contact opportunities.
Printed material cannot be patched. Every menu, flyer and window sticker carrying that code is now a dead end, and they stay dead until they are reprinted. The scan also happens in the worst possible place: a customer standing in the restaurant, phone in hand, deciding whether this is a business that has its act together.
Point a printed QR code at a URL on your own domain, never at a shortener. A short link is somebody else's service, with its own expiry, its own outage and its own decision to start charging, and it takes your printed material with it when any of those happen. If the destination needs to change later, redirect from your own domain, which costs nothing and is under your control. The anti-pattern is a shortener chosen for its analytics dashboard: you are renting the most permanent thing you own.
The working fallback was a free subdomain carrying advertising
The Facebook page links to a free site on a generic subdomain. It works, but it uses a generic subdomain rather than cubanbuffet.com, which costs credibility; it displays the platform's advertising on every page; there is no control over load speed or search ranking; and it includes no professional email on the business domain.
It kept the restaurant reachable, which is worth something. What it cannot do is accumulate anything: ranking, links and reputation build against a domain, and none of it transfers when the business eventually moves to its own. Two years on a free subdomain is two years of search authority earned for the platform instead.
A stopgap is fine as long as it is on the real domain. Point the domain at whatever is quickest to stand up, even a single page, so that every link earned from that day forward accrues to the name the business keeps. Set up mail on the domain at the same time, because a business address on a free mail provider is the other half of the credibility problem and takes ten minutes. The anti-pattern is building the temporary site somewhere else and moving it later, which throws away everything it earned.
Background: website design.
What was already correct
The content survived. The Internet Archive holds a capture from June 17, 2024 carrying the high-resolution logo, photographs of the dishes and the team, recorded customer testimonials and the menu and catering copy. A compromised site loses its hosting, not its history, and rebuilding from an archive capture is ordinary work rather than a salvage operation.
Bottom line
The domain was renewed. It now runs to March 30, 2027, which is the whole difference between an expensive week and a business that has to start its search ranking from nothing.