Why do some sites require www — and others break if you type it?

Question

Weirdo · Accepted Answer

www is not a magic prefix. example.com and www.example.com are two DNS names. Each needs its own records (or a redirect). Miss one, skip the redirect, or pin HSTS to only one host, and the browser treats whichever you typed as a different site.

DNS draws the namespace as a tree. Each node carries its own resource records, which may be empty. RFC 1034 is blunt: a domain name identifies a node, and a query asks only that node. www is just a label on the tree — same class of thing as blog or mail — and it is not automatically the same as the bare example.com.

So “you have to type www” or “it breaks if you do” is usually a missing A or AAAA on one of the two names, or they point somewhere else. Hosts often give www a CNAME to their hostname. The bare apex (the root of the zone, often written @) cannot hold a real CNAME: if a CNAME is present at a node, no other data should be, and a zone apex must already have SOA and NS. Cloudflare’s CNAME flattening is the server resolving the alias to an IP and answering with A/AAAA, so the apex can pretend. Without that trick, and without an A record of its own, typing www or not is two different roads.

Even if both names land on the same machine, HTTP still treats them as two hosts. A site can 301 from one to the other; skip that, and you stay where you typed. HSTS is pickier: the browser remembers “HTTPS only” per host. MDN is explicit that includeSubDomains covers descendants, not parents. An HSTS policy on www.example.com does not cover example.com; the reverse works only if example.com sent includeSubDomains. Force HTTPS on one side with no certificate ready on the other, and one spelling opens while the other locks.

Cookies follow the host too. Omit Domain on Set-Cookie and the cookie is host-only — returned only to the host that set it. Domain=example.com is what also sends it to www. Sign in on www, then visit the bare name and look signed out: you walked through a different door.

Why do some sites require www — and others break if you type it?

Two names, not one door

Redirects, HSTS, and cookies are not shared either