Suvi

The options, roughly cheapest first:

Put the domain behind a service that terminates TLS for you. Several content delivery and DNS providers offer free tiers that issue a certificate for your domain automatically and let you configure a redirect rule. You change the nameservers, add a rule, and it works for both protocols. This is what most people end up doing and it costs nothing.

Use a dedicated redirect service. Small paid services exist that do only this — point the domain at them and configure the target. Worth it if you have a handful of domains and do not want to manage anything.

Host a tiny redirect yourself. Any small server or serverless function with an automatic certificate can answer for the old domain and issue a permanent redirect. More control, more to maintain.

What I would avoid is buying full hosting purely to serve a redirect, which is the option the registrar will suggest.

What you are paying for with a commercial certificate, so you can judge whether any of it applies:

• Extended validation, where the authority verifies the legal identity of the organisation. Browsers no longer display this distinctively, so its practical value has fallen a long way.
• Warranties attached to the certificate. These are much narrower than the marketing implies and almost never pay out to a site owner.
• Support, which for a small site is rarely the deciding factor.
• Longer validity, though maximum lifetimes have been shrinking industry-wide and automation is the direction of travel regardless.

For a personal site, a small business site, or a shop, the free automatic option is the correct choice and there is no asterisk on that.

If your host refuses both the free option and your own certificate, that is worth treating as information about the host rather than about certificates.

Worth adding a proportionality point, because this question usually comes with an anxiety attached.

For most sites, images being copied is not the problem people fear, and the effort spent on preventing it would be better spent on being findable. The photographers I know who make a living from images spend almost no energy on this and a great deal on licensing and on being easy to hire.

If the images are genuinely the product, watermark and sell the clean version. If they are illustrating something else, let them travel.

There are two related headers with the same problem and it is worth handling all three at once when you set this up.

• Location, which the reverse directive covers.
• Cookie domain and path, which a companion directive rewrites. Without it, cookies set by the back end can be scoped to the internal hostname and the browser will not send them back, which produces logins that appear to succeed and then immediately forget you.
• Absolute URLs inside the page body, which nothing in this family rewrites. If the application generates links containing its own hostname, the proxy cannot fix that — the application has to be configured with its public address.

That third one is the reason well-behaved applications have a setting for their external base URL, and configuring it is usually cleaner than any amount of rewriting at the proxy.

On the parts that can be reduced, since some of it is under your control:

Registration contact details are largely maskable now. Most registrars offer privacy services and several top-level domains redact personal data by default, so your name and address need not be public even though the domain's existence is.

Certificate transparency can be partly mitigated with a wildcard certificate, which puts only the parent name in the log rather than each subdomain. The parent is still logged.

Your traffic can be kept off your local network's view with encrypted name resolution, which hides queries from an observer on the path but not from the resolver you chose.

So you can control who knows who owns it and reduce who sees which names underneath it. The existence of the registration itself is public by design.

The durable answer, and the one I would recommend if this matters to you regularly: get the data out and chart it yourself.

Most analytics platforms offer an export or an API. Pull the daily figures into a spreadsheet or a small dashboard, aggregate by week or month there, and you control the granularity permanently. It also survives the next interface redesign, which is not a small consideration given how often these tools are reorganised.

For a small site this is a one-off afternoon and then a scheduled export. For anything where the trend is the thing you actually look at, it is worth doing rather than fighting the reporting UI every quarter.