It’s a narrow job, which is exactly why I have strong opinions about who should do it. When a company’s only real task is to hold something that belongs to you, how it behaves around that one task tells you everything. So here’s who I recommend, who I steer people away from, and the plain reasons for both.

Who I recommend: Cloudflare

For most small businesses, I send people to Cloudflare to register their domain. Not because it’s trendy, but because it does the narrow job cleanly and gets out of the way.

• It sells domains at cost. Most registrars buy a domain at wholesale and mark it up. Cloudflare charges you the wholesale price, the same amount they pay, with no markup. There’s no loss-leader trick where the first year is a dollar and the renewal quietly triples. The price you pay this year is roughly the price you pay every year.
• Privacy is included and free. Every domain registration creates a public record called WHOIS (a public directory of who owns a domain). Plenty of registrars charge you extra each year to keep your name, address, and phone number out of it. Cloudflare hides them for free, by default.
• No upsells at checkout. You’re buying an address. You won’t be walked through five screens of “you also need” hosting, email, security add-ons, and a website builder you didn’t ask for.
• Moving out is easy. A good registrar makes leaving simple, because it knows the address is yours. Cloudflare unlocks domains and hands over the transfer code without a fight. That alone tells you how it sees the relationship.
• It’s genuinely good at security. Cloudflare’s core business is protecting websites from attacks. The company holding your address being one of the better-defended ones on the internet is not nothing, especially after watching how the alternative below has gone.

One honest note, because I won’t pretend otherwise: Cloudflare is a large US company, and large companies deserve scrutiny. The reason I’m comfortable recommending it for domains specifically is that registration is a narrow, low-exposure job. To use Cloudflare as your registrar you also point your domain’s lookups (its DNS, the system that turns your name into a location) at Cloudflare, which is a normal, lightweight thing. Your visitors still go straight to your host. I’m recommending Cloudflare as the place that holds your address, not as a wrapper that sits in front of your whole site and watches your traffic. That’s a different decision, with different tradeoffs, and it isn’t this one.

Who I steer people away from: GoDaddy

GoDaddy is the name most people know, which is exactly why it’s worth being clear about. I don’t recommend it, and the reasons aren’t a matter of taste. They’re on the record.

• A regulator caught it overselling its own security. In 2025 the US Federal Trade Commission (the FTC, the government’s consumer-protection agency) found that GoDaddy advertised “award-winning security” while failing to use basic protections that the rest of the industry treats as standard, no multi-factor login, no real monitoring for break-ins, unsecured connections to customer data. GoDaddy settled, and the FTC’s order now forces it to actually build the security it had been claiming.
• Those gaps turned into real breaches. Between 2019 and 2022 GoDaddy was broken into repeatedly. In one 2021 incident, attackers reached the data of around 1.2 million customers, including website passwords and, in some cases, the private security keys that prove a site is really itself. In another, discovered in 2022, intruders sat in GoDaddy’s systems for a long stretch and planted code that quietly redirected customers’ visitors to malicious websites. When the company holding your address has that track record, “I’ll just use the famous one” stops being the safe choice.
• The billing has a reputation. GoDaddy draws a steady stream of complaints about charges people didn’t expect and add-ons that are easy to end up paying for. The cheap headline price tends to be the start of the conversation, not the end of it.

And it isn’t a bad year, it’s a long pattern. Years ago I sat next to someone at an airport who worked in GoDaddy’s support department, and what they described has stuck with me. The sales team was the celebrated part of the company, the part that pulled in big holiday bonuses, while the people who actually helped customers fix things were an afterthought. The work, as they told it, leaned on steering people into signing up for products they didn’t need. That was one person’s account, not a company statement. But it matched what the billing complaints, and later the FTC, would put on the record: a company organized around the sell, not the service.

The same instinct shows up in public. For about a decade, GoDaddy was best known for Super Bowl commercials that leaned heavily on sexualized images of women to grab attention, an approach it finally dropped after years of criticism. In 2015 it pulled a different Super Bowl ad after backlash, the one that used a lost puppy as a punchline and struck many viewers as making light of puppy mills. And in 2011 GoDaddy publicly backed SOPA, the Stop Online Piracy Act, a bill that would have handed the government and copyright holders broad power to force websites offline. When customers realized, tens of thousands moved their domains elsewhere in protest, and within days GoDaddy reversed course. None of these is the reason to avoid GoDaddy on its own. Together they sketch a company that has reliably reached for attention and the upsell, and changed only when its own customers made it expensive.

None of this means every GoDaddy customer gets burned. Plenty don’t. But you’re choosing who to trust with the one piece of your business that everything else points to, and on that question, the public record is not flattering.

The pattern to watch, not just the names

“Cloudflare good, GoDaddy bad” is too simple to actually help you, because next year there’ll be a different name. What you’re really learning to spot is a set of behaviors. A registrar is worth avoiding when it:

• Lures you with a near-free first year, then jacks the renewal. The real cost is what you pay in year two and forever after, not the teaser.
• Charges extra to keep your details private. Privacy on your own address shouldn’t be a paid upgrade.
• Buries the exit. If transferring your domain out means hunting through menus, waiting on support, or paying a fee, that’s a company treating your address as theirs.
• Sells you ten things while you’re trying to buy one. Aggressive upselling at checkout is a sign of where the company makes its money, and it isn’t from doing the narrow job well.

A registrar that does the opposite of all four, steady pricing, free privacy, an easy door out, and no hard sell, is one you can trust with your address. Cloudflare is the one I reach for. It isn’t the only honest option, but it clears the bar, and the famous one doesn’t.

The honest summary

Your domain is the one thing your whole online presence points back to, so the company that holds it should be boring in the best way: fair price, your privacy protected for free, and an open door if you ever want to leave. That’s why I send people to Cloudflare and not to GoDaddy. Pick a registrar by how it behaves around the one job it has, and you’ll rarely pick wrong.