**Branding -> Domain** in your admin sidebar.

This is where your firm's address lives: the one your traders and your team
sign in on, and the one in every link the platform sends. On the left is a list
of three rows, each ending in how it stands: **Your domain**, **Status page**
and **Bot protection**. Click a row, or walk the list with `J` and `K`, to open
it beside the list. A right click on a row opens it, checks DNS, or copies the
address or a link to that row. The open row is part of the page address, so a
link to `?section=captcha` opens on bot protection.

Each row has its form on the left and a column on the right with the DNS record
to set and what a change reaches. Under the form are the last changes to that
row from the activity log, whoever made them.

One save bar saves whatever you changed on any row, in one go. A dot in your
colour beside a row means it holds a change you have not saved yet, a red one
that the last save failed on it, and the screen opens the first row that
failed. **Discard** puts every row back to what is saved.

## Who can change what

| Permission           | What it allows                                                        |
| -------------------- | --------------------------------------------------------------------- |
| `view_domains`       | Open the screen and read every address, record and check             |
| `manage_domains`     | Move, check DNS, make an address the main one, remove one, set keys   |
| `view_activity_logs` | See the last changes under each row                                   |

Without `manage_domains` the screen says so once, every field is shown but
locked, and there is no save bar and no button that acts.

## Your domain

**Main address** is the address in every link, with whether it works, since
when, and what HTTPS answered at the last check. A firm that starts on a name
under the platform's own domain sees that said here, with the suggestion to move
to a domain of its own so traders only see the firm's name.

**Move to another address** takes the new address, such as
`trading.yourfirm.com`. Paste it with or without `https://`: the screen keeps
only the name. Saving starts the move, and nothing changes for your traders yet:

1. The column on the right shows the one record to add at your DNS provider: a
   CNAME from the new name to the platform, each part with a copy button. For
   the root of a domain, such as `yourfirm.com`, it says to use an ALIAS or
   ANAME record instead, because most providers take no CNAME there.
2. The platform checks the record every five minutes, and **Check DNS** checks
   it at once. The row says what the last check found: the record points at the
   platform, points somewhere else, or is not there.
3. As soon as the record points at the platform, the new address becomes the
   main one by itself. New mails and links use it from then on.

The address you moved from keeps working and moves to **Other addresses**, so
bookmarks and links in older mails still arrive. **Stop moving** empties the
field and, once saved, drops the address that was waiting.

While the main address has never worked, there is nothing to keep online. The
field then reads **Use another address**, and the address you save takes the
place of the one that never worked instead of waiting beside it.

An address that starts with `status.` cannot be used for the platform, because
every such name opens the status page. Names under the platform's own domain are
given out by Propper. For one of those, the column on the right says that Propper
sets its DNS record and shows no record to add.

**Other addresses** lists every older address that still works. **Make main**
makes one the main address again at once, and **Remove** stops it working at
once. Both ask first, and the dialog says what changes: the address in new
mails, the status page's own address moving along, the status page address the
older one kept that stops with it, or how many passkeys stop working. The address you are using the panel on cannot be removed from that
same address.

The column on the right says what a move reaches:

- **Links in new mails** switch to the new address once it takes over.
- **Passkeys** belong to one address. The screen counts how many people sign in
  with one on the main address: after a move they use their password once and
  add a passkey again.
- **Status page address** moves along, from `status.trade.oldfirm.com` to the
  same word on the new domain, and waits for its own record.
- A warning when the new address is your own domain and bot protection needs
  keys, or needs the new address added to your widget. Clicking it opens the
  field that fixes it.

Under the form, **Questions** answers what firms ask most: which address to use,
how to add the record, the root of a domain, Cloudflare's proxy, how long it
takes, HTTPS, and what happens to the old address.

## Status page

The public status page always answers at `/status` on your domain, as soon as
that domain works. Switch on **Own address** to give it a subdomain of its own
that opens only the status page: always `status.`, an optional word of your own,
then your domain, such as `status.yourfirm.com` or
`status.uptime.yourfirm.com`.

The column on the right shows the CNAME record for that name, and where the page
answers once you save. A new name waits for its record again, and the screen
warns when saving makes an address that works now stop working. Switching the
own address off keeps the word, so switching it back on offers the same name.

The look of the page is set on [Status page](/docs/platform/admin/status-page),
which shows and changes the same address.

## Bot protection

Cloudflare Turnstile keeps bots away from sign-in, registration and password
reset. Cloudflare checks which domain a challenge runs on, so the platform's own
widget covers only names under the platform's domain. A firm on a domain of its
own brings its own widget, from a free Cloudflare account. The row says which of
these applies to you, and that keys are needed before you go live when they are.

- **Site key**: public, it ends up in the page source either way.
- **Secret key**: stored encrypted, never shown again and never sent to the
  browser. Leave it empty to keep the stored one. A new site key needs the
  secret of the same widget, and the screen asks Cloudflare whether it knows a
  secret before storing it, so a typo is caught here rather than by a trader who
  cannot sign in.
- **Remove keys** empties both. Once saved, sign-in on your own domain runs
  without bot protection until new keys are saved.

**Set up in Cloudflare** lists the three steps, with a link to Turnstile in
Cloudflare's dashboard. The column on the right lists every hostname of yours
the widget has to allow, including the address a move is heading for, each
with a copy button, and when the keys were saved. Keys saved while the platform
does not run Turnstile, or while you are on a name under the platform's domain,
are used as soon as they are needed.

The activity log records that keys were saved, replaced or removed, with the
site key, and never the secret.

## In the older designs

Propper - OG and Tactical keep the single page they launched with: the domain
field, the DNS steps, the status page address and the Turnstile keys, each with
its own save button. Changing the domain there replaces the main address in
place, so the old address stops working until the new one is verified. Moving
without going offline, older addresses, what a check found, HTTPS, and the
history are only in the standard design.