Back to blog

Brand strategy

Subdomain or Separate Domain? A Decision Framework for Growing Brands

Decide whether a launch, country site, campaign, or documentation hub belongs on a subdomain or a separate domain—with SEO, security, analytics, and governance in view.

Mumitul Islam Mumit

Mumitul Islam Mumit

Founder · pdomain editorial

October 22, 2026 26 min read

Glass letterforms and a globe representing domain naming and global brands
pdomain field note · Brand strategy

Useful? Share the field note

LinkedInXFacebook

A growing brand eventually faces a deceptively consequential question: should its next product, market, campaign, or support resource live under its existing domain—or on a new one?

There is no universal SEO or branding rule that makes one structure best. The right choice depends on how closely the new experience belongs to the main brand, how independently it must operate, and whether the organization can support the extra technical and administrative overhead. A subdomain can create separation without requiring a wholly new brand address. A separate domain can give a venture its own identity and operational boundary, but it also creates another property to manage.

This framework helps founders, operators, domain buyers, and brand teams make that choice deliberately. It treats the URL as an organizational decision, not just a naming exercise.

First, define the options

Consider a company at example.com. It could place a new resource in any of these locations:

  • Subdirectory: example.com/docs
  • Subdomain: docs.example.com
  • Separate domain: exampledocs.com

A subdirectory is part of the existing hostname. A subdomain is a distinct hostname beneath the parent domain. A separate domain has its own registered domain name.

Those structures are not interchangeable in every technical or operational respect. They also do not dictate how a business must organize its teams. A subdomain can be run by an independent product team; a separate domain can still share the same design system, analytics setup, and corporate governance. The domain choice creates possibilities and constraints. It does not substitute for an operating model.

This article focuses on the choice between a subdomain and a separate domain. A subdirectory is included as a useful comparison, especially where search visibility and a unified customer experience matter.

The short decision rule

Start with the question: Will visitors understand this experience as part of the same brand and relationship?

  • If the answer is clearly yes, begin by considering the main domain, often a subdirectory or subdomain.
  • If the answer is partly, a subdomain may give the experience a distinct home while retaining an obvious connection to the parent brand.
  • If the answer is no, or the venture must stand on its own, consider a separate domain.

Then test that first impression against practical requirements:

  1. Does the experience have a different audience, promise, or commercial identity?
  2. Does it need a genuinely separate security or privacy design?
  3. Will it serve a distinct country or language market?
  4. Can your team maintain the extra domains, redirects, analytics, certificates, and renewals?
  5. What happens if the product is sold, discontinued, or rebranded?
  6. Is the choice reversible without a disruptive URL migration?

A separate domain should earn its additional complexity. A subdomain should earn its place if it provides a meaningful operational or user-experience benefit over a subdirectory. Neither should be chosen simply because the desired path is inconvenient to implement.

A practical comparison

| Consideration | Subdomain | Separate domain | |---|---|---| | Brand connection | Usually visible through the shared parent name | Can be strong, weak, or intentionally absent | | Independence | Separate hostname, but still visibly related | Greater naming and brand independence | | Search and URL operations | A distinct hostname; plan and monitor it as its own property | A distinct domain and hostname; a domain move may be needed if changing later | | Cookies and browser boundaries | Cookies can be scoped to a parent domain in some configurations; careful design is essential | A different registrable domain normally offers more separation for ordinary domain-scoped cookies | | Analytics | Can be configured as one reporting setup, but hostname handling still matters | Cross-domain measurement may require deliberate configuration | | Country targeting | Can support a market-specific experience | A country-code top-level domain may provide a clear local identity and a geographic signal | | Governance | Parent brand and domain controls remain central | Requires separate ownership, renewal, DNS, and brand oversight | | Best fit | A distinct but clearly related service or audience | A distinct venture, brand, or market requiring stronger autonomy |

These are tendencies, not guarantees. For example, separate domains do not automatically create secure systems, and subdomains do not automatically share every cookie. The results depend on implementation.

Decision factor 1: Brand architecture and customer expectations

Does the offer belong to the parent brand?

A product name can be different from a company name while still belonging to the same brand family. If customers should recognize the parent company immediately, a subdomain can make that relationship explicit:

  • billing.example.com
  • api.example.com
  • learn.example.com

A separate domain can instead emphasize an independent proposition:

  • A company launches an experimental consumer product with a distinct audience and positioning.
  • A group of businesses operates several brands under one parent company.
  • A product is intended to be acquired or spun out, and should not be tightly bound to the corporate domain.

The issue is not whether one name looks more modern or memorable. Ask what a customer should infer before clicking. Does product.example.com communicate “a product from Example”? Does productname.com communicate an independent brand? If customers need to know that a company stands behind an experience—for example, a payment or account service—obscuring that connection may undermine confidence. In other cases, a separate identity may make the proposition clearer.

Test the name with people who do not know the internal plan

Brand teams often know the relationship between a new offering and the company because they helped build it. Prospective customers do not have that context. Test likely addresses in simple questions:

  • “Who do you think runs this service?”
  • “Would you expect this page to use the same account as the main website?”
  • “Would you trust this address with a payment or personal information?”
  • “If you saw this name in a search result, what would you expect to find?”

The answers can expose a mismatch. A parent-branded subdomain may suggest a direct corporate service when the product is meant to feel independent. A new domain may look unrelated when customers need reassurance that it is part of an established company.

Consider how the brand portfolio may change

A product’s likely future matters. A permanent corporate function—such as support or documentation—often has a stable relationship to the parent brand. A venture that may be renamed, sold, or separated has a different outlook.

Before choosing, write down what the brand should look like in three plausible future states:

  1. The product remains part of the parent company.
  2. The product is rebranded but remains within the company.
  3. The product is sold, spun out, or discontinued.

A subdomain may be convenient in the first scenario but create migration work in the third. A separate domain may preserve independence but require more day-to-day maintenance while the product remains small.

The goal is not to predict the future perfectly. It is to avoid making the most consequential future option unnecessarily difficult.

Decision factor 2: Search visibility and URL changes

Search considerations deserve care because they are frequently reduced to oversimplified claims. “Google treats subdomains as separate sites” and “Google gives subdirectories more authority” are often presented as universal rules. Do not make a domain decision on the strength of slogans.

Google’s site-move guidance treats a change of URLs as a migration that requires planning. It recommends preparing URL mappings, implementing redirects, updating relevant links, and monitoring the move. The exact work depends on the scope of the change. Moving to another domain is not merely changing a logo or switching a DNS record: existing URLs, links, and search visibility need to be managed deliberately. [1]

A new subdomain also introduces a new hostname and a set of URLs to maintain. Even where the brand name remains visible, the team needs to ensure that pages are crawlable, internally linked, correctly canonicalized where appropriate, and included in its reporting and monitoring routines. A new hostname does not remove the need for sound site structure.

Choose based on the experience, not an assumed ranking shortcut

Consider three common cases:

A documentation library that supports the core product. If documentation is an extension of the main site and shares its audience, a subdirectory such as example.com/docs may make the relationship and navigation straightforward. A subdomain such as docs.example.com may be preferable if the documentation platform, publishing workflow, or release cycle is operationally distinct. Either option should have clear links to the product and a coherent information architecture.

A separate product with its own audience and proposition. A subdomain may work if the product is visibly endorsed by the parent company. A separate domain may suit an independent brand better. Search strategy should support that decision; it should not be the only reason for it.

A new country site. The choice of URL structure is one part of international targeting. Google’s guidance describes country-code top-level domains as a strong geographic signal, while also outlining other approaches such as subdomains and subdirectories for regional versions. It also emphasizes that language and regional versions should be made understandable to both users and search systems. [2] A country domain may help communicate a local presence, but its value depends on the business, available naming options, legal and commercial requirements, and ability to maintain country-specific content.

Treat any later change as a migration project

A decision that is easy to make today may be expensive to reverse later. If a site moves from campaign.example.com to campaignbrand.com, plan it as a URL migration, not a cosmetic rebrand. Inventory the old URLs, decide where each should lead, implement appropriate redirects, update internal links, and monitor the destination after launch. Google’s migration documentation provides a structured starting point for this work. [1]

Before selecting a structure, ask:

  • Is there an expected reason to move this experience later?
  • Can the team preserve the old domain and redirect its URLs if it moves?
  • Who owns the URL inventory and migration plan?
  • Are links, bookmarks, printed materials, and third-party references likely to persist?
  • Is the team prepared to monitor search and traffic signals after a move?

A domain decision is strongest when the organization has a plausible transition plan, even if that plan is never used.

Decision factor 3: Product launches and experiments

A product launch can be a marketing page, a new application, or a separate business line. Those are different needs, and they should not automatically receive the same URL treatment.

Temporary campaign or lasting product?

A short-lived campaign usually benefits from a clear, memorable address, but that does not necessarily mean it needs a new domain. A landing page under the main domain can make the sponsor and brand relationship clear. A campaign subdomain may be appropriate when a distinct platform or launch environment is involved. A separate domain can work when the campaign itself is a standalone brand, but it introduces obligations that may outlast the campaign.

Campaign addresses often appear in paid media, partner materials, QR codes, presentations, and social posts. Before launch, determine what visitors will see after the campaign ends. Options include:

  • Keeping the page live as an archive.
  • Redirecting the campaign address to a relevant product or information page.
  • Reusing the address only after confirming that the previous content and links will not cause confusion.
  • Maintaining the domain and renewal process as long as external references remain useful.

A campaign domain that is allowed to lapse can become a problem if old links still circulate. The issue is not unique to separate domains, but a separately registered campaign name makes ownership and renewal especially important.

Experiments need an exit plan

An experiment may begin as a subdomain because that is quick to set up, then develop a separate identity. It may also launch on a new domain and later be absorbed into the main brand. Either route can be reasonable if the team decides in advance what success, continuation, and shutdown mean.

For an experiment, record:

  • The intended audience and brand relationship.
  • Whether users will create accounts or provide sensitive information.
  • Which analytics and consent practices apply.
  • Who can publish, change DNS, and retire the experience.
  • What will happen to its URLs and domain if the experiment ends.

The domain choice should not be made solely by the team that can publish the fastest. Include the owners responsible for brand, search, privacy, security, analytics, and ongoing maintenance.

Launch checklist

Before the address appears in public:

  • Confirm that the name is clear, defensible, and approved for the intended use.
  • Decide whether the launch is a product, a campaign, a market site, or an independent venture.
  • Establish the canonical URL and preferred hostname.
  • Check navigation and links between the launch and the parent site.
  • Identify login, payment, and data-collection flows.
  • Confirm analytics and consent requirements across the relevant hosts.
  • Document who will renew the domain, administer DNS, and manage certificates.
  • Decide how the address will be retired or migrated.

Decision factor 4: Country sites and regional identity

Country and language decisions involve more than translation. The structure should reflect how the organization serves its customers, handles content, and presents its local identity.

A company might use:

  • example.com/de/ for a German-language section.
  • de.example.com for a regionally managed site.
  • A country-specific domain where appropriate and available.

Google describes several URL structures for multi-regional sites and notes that a country-code top-level domain is a strong geographic signal. That is a search signal, not a promise of better performance, and it does not decide whether a country domain is commercially or operationally appropriate. [2]

Choose a structure the team can maintain

A country site requires ongoing decisions about language, product availability, support, shipping, currency, privacy notices, and local content. The domain alone cannot resolve those questions. If a business creates multiple regional addresses without a process to keep them accurate, a seemingly polished expansion can produce contradictory or outdated information.

A country-specific subdomain may work when local teams need distinct publishing or technical arrangements but the central brand connection should remain obvious. A separate country domain may suit a strong local identity or a market where the business deliberately operates under a different name. A subdirectory can make sense when the same team and platform manage all versions under one hostname.

For each market, answer:

  1. Is the site language-specific, country-specific, or both?
  2. Are products and services actually available there?
  3. Who approves local claims, pricing, and support information?
  4. Will users need a local account, payment flow, or customer service channel?
  5. How will the team maintain regional links and route users to the right version?
  6. Is the domain name suitable for the market and its intended audience?

Legal requirements can vary by country and industry. Domain and URL choices should be reviewed with qualified local counsel where the decision depends on local law, regulated activity, privacy obligations, or rights in a name. This article is general editorial guidance, not legal advice.

Decision factor 5: Cookies, accounts, and security boundaries

A domain decision can influence the shape of browser interactions, but it does not create a security architecture by itself.

Hostnames are not the same as cookie boundaries

A web origin is identified by its scheme, hostname, and port. A subdomain such as account.example.com is a different origin from www.example.com. [3] That distinction matters for browser rules governing access between origins, but cookies have their own scoping behavior.

MDN explains that a cookie without a Domain attribute is associated with the host that set it. A cookie configured with a parent-domain scope may be available to matching subdomains. [4] In practice, this means that a subdomain can be distinct as an origin while still receiving a cookie that has deliberately been scoped broadly enough to cover it. A separate domain generally cannot receive a cookie scoped to the parent company’s domain, but that fact alone does not make the separate site secure.

Do not set cookies broadly merely to make a login or analytics flow convenient. Decide which hosts need access to each cookie, and use appropriate attributes and application controls. MDN documents cookie attributes including Secure, HttpOnly, and SameSite; their use should reflect the application’s requirements and threat model. [4]

Do not confuse a new hostname with a security boundary

A subdomain is not a substitute for isolating sensitive systems. If an application needs to separate administrative access, customer data, or third-party code, design that isolation deliberately. A separate domain can reduce some forms of accidental cookie sharing when configured independently, but it cannot guarantee that an application, server, account system, or analytics integration is secure.

For example:

  • A marketing microsite with no login may be suitable for a separate publishing platform, but it still needs appropriate access controls and maintenance.
  • An account portal may use a subdomain for brand continuity, but its authentication and session design must be reviewed independently.
  • An acquired product may use a separate domain, yet still share staff accounts, APIs, or infrastructure with its parent.

For security-sensitive systems, involve qualified security professionals. This article offers general design considerations, not a security assessment.

Session handling matters more than the URL label

OWASP describes session fixation as an attack in which an attacker causes a victim to use a session identifier known to the attacker, then takes advantage of the victim authenticating with that identifier. One recommended defense is to issue a new session identifier after authentication and other privilege changes. [5] Moving an application to a new subdomain or a separate domain does not by itself solve that problem.

When deciding where an application should live, ask the engineering and security teams:

  • Which hosts can set or receive authentication cookies?
  • Does the application require single sign-on across subdomains?
  • How are sessions created, rotated, invalidated, and protected?
  • Are third-party scripts or platforms involved?
  • Is any sensitive functionality being mixed with a less controlled publishing environment?
  • What isolation is required by the actual threat model?

The right answer may be a subdomain, a separate domain, or neither. The security controls must match the application rather than the marketing structure.

Decision factor 6: Analytics and measurement

Analytics is often easier when teams decide on measurement before launch. It becomes harder when multiple sites are already collecting events with inconsistent names, consent behavior, and ownership.

A subdomain and a separate domain are not identical from the browser’s perspective, and the analytics setup should account for the actual user journey. A user who moves from a marketing site to a product application may appear to cross a host or domain boundary. Whether that journey should be treated as one continuous session depends on the analytics system, configuration, consent choices, and measurement goals.

Google Analytics documents cross-domain measurement as a configuration for understanding activity across multiple domains. [6] That is a measurement mechanism; it does not make the domains share ordinary website cookies. Nor does it resolve questions about consent, data access, retention, or who is allowed to use the resulting reports.

Before launch, define:

  • Which team owns the measurement plan?
  • Which events are shared across the parent site and new experience?
  • How will users be recognized across relevant hosts, where permitted?
  • Do consent and privacy choices remain understandable across the journey?
  • Should the new site have separate reports, shared reports, or both?
  • Which hostname and referral details need to be visible to operators?

Do not assume that creating a new domain automatically gives the product an independent analytics setup. Conversely, do not assume that putting a service on a subdomain means its data should be combined with the parent site. Measurement should reflect the business relationship and applicable privacy requirements.

Decision factor 7: Ownership, governance, and cost of attention

Domains generate work after launch. Each additional hostname or registered domain can introduce tasks involving DNS, hosting, certificates, access control, renewals, content governance, monitoring, analytics, and support. The direct technical work varies, but the organizational need for clear ownership does not disappear.

A subdomain usually remains visibly tied to the parent domain, but still needs an owner. A separate domain needs the same operational clarity, plus explicit responsibility for registration and renewal. It may also need separate brand review, abuse monitoring, and a documented plan for staff turnover.

Assign one accountable owner

A healthy domain inventory records at least:

  • The domain or hostname and its business purpose.
  • The accountable business owner.
  • The technical administrator and registrar or DNS access owner.
  • Renewal and billing responsibility, where applicable.
  • Hosting and certificate arrangements.
  • The analytics and privacy contacts.
  • The launch date and review date.
  • The retirement, transfer, or migration plan.

Avoid leaving ownership in an individual employee’s personal account or in the memory of the team that launched the site. Use organizational accounts and documented recovery processes appropriate to the business.

Keep access proportional to need

Not everyone who edits content should be able to change nameservers. Not every infrastructure administrator needs approval authority over the brand name. Separate responsibilities where practical, and document how emergency access works. The exact controls depend on the organization’s tools and risk profile; the general principle is to make responsibilities explicit rather than relying on informal knowledge.

A separate domain can be valuable where a product needs a different owner or future transfer path. It can also become an orphan asset if no one is responsible for it. A subdomain can be easier to oversee centrally, but may become a bottleneck if every change requires approval from a parent-domain team. Governance should fit the intended degree of independence.

A scored decision framework

Use the following framework as a structured discussion, not a mathematical truth. Score each factor from 1 to 5, where 1 means “strongly favors a subdomain” and 5 means “strongly favors a separate domain.”

| Question | 1: Favors subdomain | 5: Favors separate domain | |---|---|---| | Brand relationship | Clearly part of the parent brand | Meant to stand independently | | Audience overlap | Same customers and journey | Different audience or market | | Product autonomy | Shared roadmap and ownership | Separate roadmap or likely transfer | | Trust and endorsement | Parent name should be prominent | Independent name is more appropriate | | Technical operations | Shared platform and controls | Separate platform or operating model | | Future plans | Expected to remain integrated | May be sold, spun out, or rebranded | | Domain maintenance | Prefer centralized administration | Team can own another domain responsibly |

The scores are prompts. A high total does not mechanically require a separate domain. For example, a product may be independent in its roadmap but still need the parent company’s name for customer trust. Discuss disagreements: they often reveal a decision that should be settled at the brand or operating-model level before the domain is selected.

Add a “must not” test

Some requirements should not be averaged away. Treat them as constraints:

  • Do not expose a sensitive service on a hostname until the security and authentication design is approved.
  • Do not launch a country-specific site unless an accountable team can keep its content accurate.
  • Do not register a separate domain without assigning renewal and access ownership.
  • Do not promise a seamless cross-domain account experience until the product and measurement requirements are understood.
  • Do not choose a structure that the team cannot support simply because it looks cleaner in a pitch deck.

A constraint can rule out an option even when it scores well on other dimensions.

Recommendations by common use case

Product launch that is clearly part of the core business

Starting point: Consider a subdomain or subdirectory.

Use the parent domain when the product’s credibility, support, and customer journey depend on the core brand. Choose between subdirectory and subdomain based on platform, publishing, and operational needs. If the product may later become independent, document the migration implications and keep control of any likely future domain name.

Product intended to grow into an independent brand

Starting point: Consider a separate domain, or a subdomain as a deliberate first phase.

If customers should eventually recognize the product on its own, a separate domain may make the intended identity clear from the beginning. If the product is still being validated and the parent brand provides useful endorsement, a subdomain can be an interim choice. Define what evidence or milestone would trigger a move so that “temporary” does not become an unexamined permanent arrangement.

Documentation and developer resources

Starting point: Favor a close relationship to the main brand; choose the host based on tooling.

Documentation is generally part of the product relationship, even if it uses a separate platform and publishing workflow. A subdomain can be practical where the docs have independent deployment or release processes. Keep navigation, product identity, and support routes coherent. A standalone documentation brand is a more specialized choice and should have a clear audience or reason to exist.

Campaign or event

Starting point: Use the parent domain unless the campaign itself has a genuine independent identity.

A dedicated campaign domain can be memorable, but the organization must manage its renewal and long-term destination. For a one-time event, a subdirectory or subdomain may be easier to govern and less likely to become a disconnected property. Decide what happens to the address after the event before promoting it publicly.

Country or language site

Starting point: Choose the structure the local operating team can sustain.

A country-code domain may provide a direct local identity and a geographic signal. A subdomain may support distinct regional management while retaining the parent name. A subdirectory may suit a centrally managed site. Evaluate the actual country and language strategy, not just the visual neatness of the URL. [2]

Account portal or customer dashboard

Starting point: Let security and identity requirements lead; keep brand continuity as a design input.

A subdomain may be an understandable place for a first-party account experience, but cookie scope, session management, and isolation require technical review. A separate domain may provide a distinct product identity or help separate some browser-level concerns, but it does not make the system secure by default. Establish the login and session architecture before selecting the address. [3][4][5]

A practical decision process

A short, documented process can prevent repeated debate.

Step 1: Write the user-facing proposition

Complete this sentence: “This experience is for ___, and visitors should understand it as ___.”

Use plain language. If the sentence says “part of the main product,” a parent-domain location may be the natural starting point. If it says “an independent service for a different audience,” explore a separate domain.

Step 2: Draw the actual user journey

Map how people arrive, move between experiences, sign in, seek help, and leave. Include search, email, paid media, partner links, and mobile apps if relevant. The chosen address should support that journey rather than force users to infer a relationship.

Step 3: Identify technical and data boundaries

List the systems, user data, cookies, authentication, third-party tools, analytics, and publishing workflows involved. Ask whether the experience needs to share any of these with the parent site. Do not assume that shared branding requires shared cookies, accounts, or data.

Step 4: Assign operational owners

Name the people or teams who will manage the experience, DNS, content, security review, analytics, renewals, and eventual retirement. If ownership is unclear, resolve that before launch.

Step 5: Check reversibility

Compare the cost of changing from a subdomain to a separate domain with the cost of starting on a separate domain immediately. Include redirects, external links, customer communications, search monitoring, analytics continuity, and retained domain control. Google’s site-move guidance is a useful reference for planning URL changes. [1]

Step 6: Record the decision and revisit it

A short decision record should include:

  • Chosen URL structure.
  • Why it fits the brand and user journey.
  • Rejected alternatives and their trade-offs.
  • Security, privacy, and analytics assumptions.
  • Named owners.
  • Conditions that would prompt a review.
  • A retirement or migration plan.

Revisit the decision if the audience, ownership, product architecture, or country strategy changes substantially.

Common mistakes to avoid

Choosing only for visual appeal

A short or fashionable address may look good in a presentation but create a disconnected customer journey. The name should work in a browser bar, search result, spoken referral, support conversation, and future brand portfolio.

Treating SEO advice as a universal law

A hostname choice is not a substitute for useful content, clear information architecture, crawlability, and a sound migration plan. Avoid claims that a subdomain must rank worse or that a separate domain automatically creates an SEO advantage. Make the decision around the product and maintain the site well.

Treating a subdomain as a complete security perimeter

Subdomains are different origins, but cookie scope and application design matter. A broad cookie configuration can span subdomains, and separate domains can still share infrastructure or accounts. Define the intended boundaries technically rather than inferring them from the address. [3][4]

Launching first and deciding ownership later

Domains can outlast teams and campaigns. A launch without renewal, access, and retirement ownership creates avoidable risk. Add those responsibilities to the launch checklist rather than assuming someone else will handle them.

Forgetting the exit

A product may close, a campaign may end, or a brand may be sold. Decide how users and old links will be treated before the address becomes widely distributed. A redirect, archive, or transfer may be appropriate, but the right choice depends on the content, users, and business situation.

Conclusion: choose the structure that matches the relationship

A subdomain is often the practical choice when a new experience is distinct enough to need its own hostname but clearly belongs to the parent brand. A separate domain is more compelling when the brand, audience, ownership, or future of the experience should stand independently. For many integrated resources, a subdirectory is worth considering alongside both options.

The best decision is not the one with the shortest URL or the strongest supposed search advantage. It is the one that makes the brand relationship clear, supports the real user journey, respects security and privacy requirements, and can be maintained by an accountable team.

Make the choice with both the launch and the eventual exit in mind. Document the reasons, assign ownership, and treat any later URL change as an operational project. That discipline matters more than choosing a fashionable structure—and gives the brand room to grow without making every new product a new domain debate.

References

[1]: https://developers.google.com/search/docs/crawling-indexing/site-move-with-url-changes "Google Search Central: Site moves with URL changes"

[2]: https://developers.google.com/search/docs/specialty/international/managing-multi-regional-sites "Google Search Central: Managing multi-regional and multilingual sites"

[3]: https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy "MDN: Same-origin policy"

[4]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies "MDN: HTTP cookies"

[5]: https://owasp.org/www-community/attacks/Session_fixation "OWASP: Session fixation"

[6]: https://support.google.com/analytics/answer/10071811 "Google Analytics Help: Set up cross-domain measurement"

Share this guide

LinkedInXFacebook