---
title: "Hosting and network · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/hosting-and-network
updated: 2026-10-20
licence: "All rights reserved"
---

# Hosting and network

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Server and DNS work under every site. It covers HTTPS, TLS, HTTP/2 and HTTP/3, a fast first send, DNS records, IPv6 and certificate renewal.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network`.

## Required

- [Serve everything over HTTPS](https://agentwranglers.se/playbook/website/hosting-and-network/https-tls): Serve every page over HTTPS, the encrypted web, using TLS 1.2 or 1.3 and a valid certificate chain. Redirect plain HTTP to HTTPS.
- [Renew certificates automatically](https://agentwranglers.se/playbook/website/hosting-and-network/certificate-renewal): Renew every certificate automatically, and get an alert when one has under 14 days left.
- [Keep the domain name yours](https://agentwranglers.se/playbook/website/hosting-and-network/domain-renewal): Renew the domain automatically, lock it against transfers and protect the registrar account with two-factor login. A lapsed or stolen domain takes down the site and its email.

## Recommended

- [Turn off old encryption](https://agentwranglers.se/playbook/website/hosting-and-network/tls-configuration): Allow only TLS 1.2 and 1.3, with ECDHE key exchange and AEAD ciphers. Turn off TLS compression and 0-RTT for requests that change data.
- [Serve over HTTP/2 or HTTP/3](https://agentwranglers.se/playbook/website/hosting-and-network/http3): Serve the site over HTTP/2 at least, and over HTTP/3 where the server supports it.
- [Choose who may issue your certificates](https://agentwranglers.se/playbook/website/hosting-and-network/caa-records): Publish DNS CAA records. They list which certificate authorities may sign certificates for your name. All others must refuse.
- [Host where routes are signed](https://agentwranglers.se/playbook/website/hosting-and-network/rpki): Host the site and its DNS with providers that sign their internet routes with RPKI. They should also drop invalid routes.
- [Be reachable over IPv6](https://agentwranglers.se/playbook/website/hosting-and-network/ipv6): Make the site and its DNS reachable over IPv6 with AAAA records, as well as over IPv4.

## Optional

- [Send more in the first round trip](https://agentwranglers.se/playbook/website/hosting-and-network/tcp-initial-congestion-window): Let the server's first send carry the whole page. Raise the TCP initial congestion window. That is how much the server sends before waiting for a reply. Then the whole compressed HTML goes out without waiting.
- [Sign your DNS](https://agentwranglers.se/playbook/website/hosting-and-network/dnssec): Sign the DNS zone with DNSSEC, so answers can't be forged. Then add the DS record where you bought the domain.
- [Use TLSA records only where checked](https://agentwranglers.se/playbook/website/hosting-and-network/dane): Publish TLSA records only for services whose clients check them, such as mail servers. Browsers do not check them.

- Previous: [Security](https://agentwranglers.se/playbook/website/security)
- Next: [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)
- [All chapters](https://agentwranglers.se/playbook/website)