This guide is for business owners and managers in Nepal who are registering a domain name, moving an existing website, or checking whether their current website and business email are properly secured. It covers the practical trade-offs between .com.np and .com, how to prevent losing control of your domain to a former vendor, and the essential security controls every business website should have in place.

Nepali edition: नेपालमा डोमेन (.com र .com.np), होस्टिङ र वेबसाइट सुरक्षा गाइड

1. Choosing between .com.np and .com

One of the first questions every Nepali business asks is whether to use a free country-code domain (.com.np, .org.np, .edu.np) administered by Mercantile Communications (register.com.np) or an international top-level domain (.com, .org, .net).

Factor .com.np (Country-code domain) .com (Global domain)
Direct registration fee Free of charge for eligible registered entities in Nepal Annual renewal fee (paid via Dollar card or local registrar)
Eligibility & naming rule Must closely match your registered business name or trademark; requires business registration certificate, PAN/VAT and a formal cover letter Any available name can be registered immediately without document review
Approval & DNS changes Manual document verification during registration; nameserver updates go through the register.com.np portal Instant registration and instant self-service DNS/nameserver changes
Best suited for Nepali institutions, schools, clinics, local service businesses and domestic brands whose name matches their legal registration Businesses serving international clients, tourism operators, software products, or brands whose short trade name differs from their long legal name

Our practical recommendation for established businesses: if your brand name matches your company registration, register both. Use .com as your primary canonical domain (or .com.np if you are a strictly domestic institution) and configure a permanent 301 redirect from the other so no one can impersonate your business name.

2. The #1 operational risk in Nepal: losing ownership of your domain

Every month we hear from businesses in Nepal whose website went offline or whose agency disappeared — and when the owner tries to move to a new developer, they discover the domain, DNS and hosting were registered under a freelancer’s personal Gmail account.

Follow one non-negotiable rule: your company must hold the owner login for your domain registrar, your DNS (such as Cloudflare) and your Google Business Profile.

  • Register under a company email or owner-controlled account, never a contractor’s personal email.
  • Grant developers delegated or role-based access rather than handing over the master account password.
  • Turn on Two-Factor Authentication (2FA) on your domain registrar, Cloudflare/DNS account and workspace email.
  • Keep a one-page infrastructure sheet inside your company records listing where your domain is registered, when it renews, where DNS is hosted, and who holds admin access.

3. Hosting architecture: why cheap shared hosting hurts both speed and security

Many websites in Nepal are placed on overcrowded shared cPanel servers where dozens of unrelated WordPress sites share the same PHP environment and IP address. When one neighbour site gets infected through an outdated plugin, the entire server slows down or its IP gets blacklisted for email.

Modern business websites and web applications are much safer and faster when separated by function:

  • Marketing and content websites: build them as pre-rendered static or hybrid sites deployed on a global edge network (such as Firebase Hosting, Cloudflare Pages or Vercel) with a nearby CDN node in South Asia. There is no public database or /wp-admin login page for bots to brute-force.
  • Web applications and APIs: run them on isolated cloud instances or managed containers with automated daily off-site backups, strict firewall rules and separate staging and production environments.
  • Business email: never host your company email on the same web server that runs your website. Use a dedicated mail service (such as Google Workspace, Microsoft 365 or Zoho Mail) so website maintenance never interrupts your email.

4. Email authentication: SPF, DKIM and DMARC

Have you ever sent an invoice or proposal from info@yourcompany.com only for your client to say it landed in their Spam folder — or worse, discovered that someone forged an email pretending to be your company?

That happens when a domain lacks three standard DNS records:

  1. SPF (Sender Policy Framework): a DNS TXT record listing which mail servers are allowed to send email on behalf of your domain.
  2. DKIM (DomainKeys Identified Mail): a cryptographic signature added by your mail provider proving the email was not altered in transit.
  3. DMARC (_dmarc.yourdomain.com): a policy telling receiving mail servers (like Gmail and Outlook) to quarantine or reject messages that fail SPF and DKIM checks.

Setting up SPF, DKIM and DMARC takes less than an hour and immediately protects your domain reputation and deliverability.

5. Website security checklist for businesses in Nepal

Whether your website is brand new or five years old, ask your engineer to verify these seven controls:

  • HTTPS everywhere with HSTS: every http:// and www. variant redirects with a single permanent 301 hop to your https:// canonical domain, and Strict-Transport-Security (HSTS) is enabled.
  • Modern HTTP security headers: your server sends Content-Security-Policy (CSP), X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy and Permissions-Policy to block script injection and clickjacking.
  • Zero known dependency vulnerabilities: run npm audit (or your stack’s security scanner) before every release and patch vulnerable packages promptly.
  • Hardened contact and booking forms: validate every submission on the server (never just in the browser), use a hidden honeypot field, enforce minimum human completion time, and rate-limit repeat submissions so bots cannot flood your inbox or CRM.
  • Secrets kept strictly on the server: API keys for eSewa, Khalti, Fonepay, SMS gateways, Telegram bots or databases must never appear in browser JavaScript or public Git repositories.
  • Automated, tested off-site backups: if your server disappeared today, how fast could your team restore the database and files from a clean off-site backup?
  • Uptime and certificate monitoring: automated alerts notify your technical team if a page returns an error or an SSL certificate is nearing expiry.

Need a security review or reliable cloud hosting?

We handle websites and cloud & operations for businesses in Nepal — from domain and DNS cleanup to high-speed hosting, security headers and automated backups. Contact us if you would like us to review your setup.

Sources