The Question Every Founder Eventually Asks

You register example.com. A friend asks: "Did you also get exemple.com? exampel.com? exampla.com? What about example.net, example.co, example.io?" Suddenly the domain bill is $400/year and you are not sure which of those purchases were prudent and which were paranoia.

Defensive registration is real, and for some brands it matters a lot. But buying every conceivable typo is rarely the right answer. The correct framework distinguishes between variants that protect real revenue and variants that just feel reassuring.

The Cost-Benefit Mental Model

For any defensive variant, the question is simple:

Is the cost of registering it cheaper than the expected damage if a competitor or attacker registered it?

For a personal blog, that damage is essentially zero. For a fintech with a million users typing the URL daily, the damage from a phishing site at the typo'd version could run six or seven figures.

The Three Categories of Variants

Category 1: High-Priority (Almost Always Worth It)

  • The matching .com if you registered .io/.co/.app first. If your tech audience uses .io but the general public types .com, you are leaking traffic. Get both if you can.
  • The plural or singular variant of a generic-sounding brand. "Slack.com" and "Slacks.com" β€” easy confusion. Worth ~$10/year.
  • Hyphen variants of multi-word brands. "domavail.com" vs "dom-avail.com" β€” both will be typed if your brand is two words.
  • The .org and .net of any well-known brand. Defensive against phishing, parodies, and trademark squatters.

Category 2: Situational (Worth It for Some, Not Others)

  • Common one-character typos. Adjacent-key typos (qwerty proximity), doubled-letter typos, transposed letters. Worth it for high-traffic consumer brands; overkill for B2B SaaS with a small user base.
  • The .co alternative. Some users reflexively type .co thinking it is .com. Cheap insurance for consumer brands.
  • Localized variants. If you serve international markets, .co.uk, .de, .fr, .com.br, .com.au are sometimes worth registering even if you do not actively serve those markets β€” purely to prevent confusion or trademark abuse.
  • Common misspellings. "Pinterest" vs "Pintrest" β€” if your brand is genuinely hard to spell, defensive registration is rational.

Category 3: Almost Always a Waste

  • Every theoretical typo. Five- and six-letter brands have hundreds of plausible typos. Registering all of them costs thousands per year and protects against attackers who would just pick a different name anyway.
  • Obscure new TLDs. .xyz, .website, .online β€” most users will never type these. Registering them is symbolic, not protective.
  • Country TLDs you have no plans to enter. Owning yourname.tv when you do not serve Tuvalu is rarely useful.
  • Trademark variants nobody would actually type. "Yourbrand-official.com" or "the-realyourbrand.com" β€” attackers can invent infinite variants. You cannot register all of them.

The 5Γ—5 Rule

For most brands, defensive registration scales reasonably with this rule of thumb: register up to 5 critical variants for up to 5 years. That is a maximum portfolio of 25 domain-years β€” manageable cost, covers the vast majority of real exposure, and forces discipline about which variants actually matter.

The 5 critical variants for most brands are:

  1. The matching .com (if you do not have it)
  2. The .net
  3. The .org
  4. The most common typo (one letter swap or transposition)
  5. The most common alternative TLD in your industry (.io for tech, .shop for ecommerce, etc.)

When NOT to Buy Defensively

  • Pre-launch products. If you have not launched, you have no traffic to protect. Buy the primary domain and spend defensive money on marketing instead.
  • Internal-only B2B products. If your customers are sales-led and arrive via direct links and login pages, typo defense is mostly noise.
  • Brands with strong, distinctive names. "Spotify" or "Notion" do not have many plausible typos. Generic names like "DataPro" do β€” and need more defense.

What to Do Instead of Buying Every Typo

Defensive registration is one tool among several. Often, these alternatives give you more protection per dollar:

  • Trademark registration. A registered trademark gives you UDRP standing β€” you can take down typo squatters legally instead of buying defensive variants forever. Annual cost amortizes well over a 5-year horizon.
  • Brand monitoring services. Tools that watch new domain registrations matching your brand keywords and alert you. You only pay to register a variant when a real threat appears.
  • DMARC and SPF on your email domain. Most "domain-based" attacks exploit email impersonation, not URL typos. Locking down email is often higher-leverage than buying typo domains.

The Honest Answer to "Should I Buy It?"

Run this test for any candidate variant:

  1. How many people would plausibly type this variant per month? If under 10, skip.
  2. What happens if a competitor or scammer owns it? If "nothing meaningful," skip.
  3. What is the 3-year cost? If under $30 and the answer to question 2 was "real damage," buy it.

Most variants fail the first or second test. The few that pass all three are the ones genuinely worth registering.

Defensive registration is real protection. Universal typo registration is anxiety-driven spending dressed up as protection.