Security and transfers

Your website's Domain page controls Strict HTTPS for its connected domain. The owner can transfer the website to another person, or to another of their organizations, from Settings.

Strict HTTPS (HSTS)

Every website here is served over HTTPS, with the certificate managed for you. HSTS goes one step further: it tells browsers to only ever load your domain over HTTPS, so a visitor who types http:// or follows an old insecure link is never sent unencrypted, not even for the first request that would normally redirect.

It also makes your domain eligible for the browsers' HSTS preload list.

The catch worth understanding: HSTS applies to your whole domain, including every subdomain of it. If you run other subdomains that are not on HTTPS — an old mail interface, a legacy tool — those will stop loading for anyone who has visited your website. Switch it off if that describes you; leave it on otherwise.

The setting only affects a connected custom domain. Your free address is already served over HTTPS by the platform.

Find Strict HTTPS (HSTS) below the three checks in the My domain card. Before you connect a domain, the same control appears in the Security section of the Domain page.

Transferring a website to another person

To give a website to someone else — a client taking over their own website, for example — open its Settings, scroll to Danger Zone, press Transfer, choose Another person, type their email address and the website's name to confirm, and press Send transfer.

Nothing moves yet. We email them a link, and the website stays yours — live, editable and on your bill — until they accept. Settings shows Waiting for [email] to accept with the date the link expires (after 7 days), and Cancel transfer takes it back. Sending a transfer to a different address replaces the first one.

The person you send it to:

1. Presses Accept Transfer in the email and signs in with that email address, or creates an account with it.
2. Chooses which of their organizations the website joins. It has to be one they own or administer, on a plan, with room for another website under that plan. An organization that cannot take it says why, with a link to choose a plan.
3. Presses Accept transfer. The website moves to their organization at once, exactly as described below, and you get an email saying so.

They can also press Reject Transfer in the email (or on the transfer page). Rejecting needs no sign-in: the website stays yours, nothing changes, and you get an email saying they rejected it. You can send a new transfer at any time.

If the website has been deleted or moved in the meantime, or you no longer own the organization it is in, the link says the transfer is no longer available and nothing moves.

Transferring a website to another organization

A website belongs to one organization, and its plan is what pays for it. Moving it to another organization moves that cost with it — which is why both sides are gated. To move it into another organization you own or administer, choose My organization in the Transfer dialog.

• Only the owner of the organization the website is in may transfer it out. Giving a website away is the owner's call alone, not an administrator's.
• You may only transfer it into an organization you own or administer, since arriving adds a billed website there.
• The destination needs room for it. If its plan already holds as many websites (or forms, or games) as it includes, the transfer is refused until it upgrades.
• The destination must be subscribed to a plan. A website cannot be transferred into an organization on the Free plan. The transfer is refused with [Organization] must be subscribed to a plan before a website can be transferred to it, and nothing moves. Choose a plan for that organization on its Billing page, then transfer again — subscribing does not complete an earlier attempt on its own.

The transfer takes the website with everything on it — its pages, its versions, its media, its conversations, its domain. Its URL in the dashboard changes to sit under the new organization; the website's own addresses do not change.

What happens when you press the button

The move is immediate, whatever the website's size. Pressing Transfer this website (or the recipient pressing Accept transfer) takes you straight to the website under its new organization, where it is listed in the dashboard and the website switcher from that moment. Nothing about the website itself changes — its pages, versions, media and conversations are exactly as they were, and your free address and any connected domain keep serving throughout. Both organizations' bills are adjusted at once.

A transfer either happens or it doesn't: there is no pending or waiting state. If the destination is not on a plan, you are told so beside the field and the website stays where it is.

If Max is in the middle of an update, the website still moves at once. The update finishes on the website in its new organization, and its credits come from the organization it started in, never from the new one. A builder still open on the old address stops showing that update; open the website again from its new organization to follow it.

If a save is in progress, the transfer waits a moment for it. If the save is still running after that, you are told what is running, beside the field. Try again once it is done; nothing has moved.

Access follows the destination organization. Site-specific access and pending invitation access from the previous organization are removed. The destination organization's owner and administrators can grant access to its members after the move.

Deleting a website

Deleting is on the same page, and it is worth reading about before you use it — it releases your free address and cannot be undone from inside the app. See Deleting a website.

Next

• Organizations — what an organization is and why websites live in one.
• Deleting a website — what is removed, what is kept, and what happens to your bill.