Limitations and known issues

What works

• HTML pages, stylesheets and scripts, with links to your domain rewritten to the preview.
• Redirects, including redirects between your domain and its www version.
• Cookies and logins: cookies your server sets stay on that preview link’s own address.
• Forms and file uploads up to 64 MB per request.
• WebSockets and Server-Sent Events, for live chat, dashboards and progress updates.
• Compressed responses (gzip and Brotli).
• HTTP Basic Auth prompts from your server, which reach the visitor unchanged.

Bot protection and firewalls

Anti-bot services and web application firewalls on the new server, for example a Cloudflare challenge or a security plugin, may treat traffic from DNSPeek as automated. The preview then shows a challenge page or an error instead of your site.

Requests from DNSPeek carry an X-DNSPeek-Proxy: 1 header. If you control the firewall, you can relax the rule for the duration of the migration, or pause the protection while you test.

Files on other hostnames

DNSPeek rewrites links that point at the domain of the link. Absolute URLs on other hostnames, such as cdn.example.com or static.example.com, are left alone. The browser loads them from wherever public DNS points today, usually the old server or your CDN. On the Free plan, one link covers one hostname, so a site spread over several subdomains needs a link for each.

On paid plans, turn on Include subdomains for a link. It then also previews every subdomain of its domain on the same server: shop.example.com opens at shop---<alias> on the preview domain, and links, redirects, stylesheets and scripts that point at any subdomain are rewritten to the matching preview address. Some limits remain:

• Hosts outside your domain, such as a third-party CDN, still load from the internet.
• Each subdomain keeps its own cookies. A login shared across subdomains (a multisite network admin, single sign-on) has to be repeated on each one, and so does the password of a protected link.
• The first part of a preview address can be at most 63 characters, so a long alias leaves less room for the subdomain.

More in WordPress multisite and subdomains.

A QA report flags broken files and hard-coded URLs that point at temporary hosts or raw IPs. JavaScript that builds URLs at runtime is rewritten conservatively, so a single-page app that assembles its own API addresses may still call the live site.

The same applies when the domain changed with the migration and you compare against an old site address: links to the other domain inside the page content are not rewritten.

Security headers differ in the preview

To make pages work on the preview address, DNSPeek removes your server’s Strict-Transport-Security, Content-Security-Policy and X-Frame-Options headers and marks cookies SameSite=None; Secure. Check those headers on the real domain after the switch, not in the preview.

Addresses that cannot be previewed

Private network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and loopback addresses are blocked, so a preview cannot reach machines inside a private network. The dashboard accepts IPv4 addresses. See Find your server IP.

Link expiry and access

• Links on the Free plan expire 7 days after they are created. Paid plans can keep links without an expiry date.
• An expired link shows “This preview link has expired.”; a disabled link shows “This link has been disabled by its owner.”
• A password-protected link asks for the password before showing the site, then remembers the browser for 24 hours.
• What every message on a preview page means, and who can fix it: Messages visitors see on a preview link.

A preview is not a production host

Previews are meant for testing and review before the DNS switch. Anyone with the link can open it, so use a password for anything sensitive and disable links you no longer need.