First, Know What "Hosting" Actually Means
Before you look anything up, get one distinction right — it is where most hosting searches go wrong. A website has at least three providers, often three different companies: the registrar (where the domain was bought), the DNS host (which runs the nameservers), and the web host (whose server serves the site's files). A CDN or proxy such as Cloudflare may also sit in front, hiding the real server behind its own IP addresses.
So when someone asks "who hosts this website?", they usually mean the web host. But a WHOIS lookup mostly answers a different question: it names the registrar and nameservers, which may point to a DNS-only provider while the site lives elsewhere. Checking one source alone can confidently name the wrong company.
The reliable approach is to cross-check two signals: the DNS/IP trail (where traffic actually goes) and the registration record (who controls the domain). When both agree, you have your answer. When they disagree, the DNS/IP trail wins for the web host — usually because a CDN sits in front of the site. This guide covers all three free methods and how to read each result.
For the answer in seconds, start with Nomlen's free Who Is Hosting checker. The rest of this guide shows how to verify that answer, and what to do when it is masked.
Method 1: The One-Click Hosting Checker (Fastest)
A hosting checker does the DNS and IP detective work for you: enter a domain, it resolves it to an IP address, looks up which network owns that IP, and matches the network to a provider — in seconds, with no need to know what an A record is.
This is the right starting point for checking a competitor's stack, finding where an old client site lives before you take over maintenance, or working out who to contact about a site you now own but whose paperwork is lost.
One caution: a checker reports what the public internet sees. If the site sits behind a CDN or proxy, it will report the CDN — accurately, but not the company running the origin server. That is deliberate configuration, not a tool failure; the masked-site section below explains how to handle it.
Method 2: Follow the DNS and IP Trail Yourself
To verify a checker's answer, the manual trail has three steps — no paid tool needed.
Step 1: Find the site's IP address
Every domain publishes an A record (IPv4) and usually an AAAA record (IPv6) pointing to its server's IP. Run a DNS lookup — Nomlen's free DNS checker shows all record types at once — and note the A record. IP addresses are allocated in blocks to networks, and those allocations are public.
Step 2: Look up who owns the IP address
Enter that IP into an IP lookup tool. The result names the organisation the block is registered to — often the hosting company itself, or a data-centre operator leasing space to many hosts. A block registered to Amazon, Google Cloud or DigitalOcean names the infrastructure, though the actual host may be a smaller company renting a cloud server there.
Step 3: Read the nameservers and the reverse DNS name
Two more records sharpen the answer. NS records name the authoritative nameservers, whose hostnames often literally contain the provider's name. The reverse DNS (PTR) record for the IP often returns a hostname on the provider's network too. When IP owner, nameserver domain and reverse-DNS hostname all agree, you have a confident identification.
Worked example, with made-up values: A record 203.0.113.45, an IP lookup naming Example Hosting Ltd, and NS records ns1.examplehosting.com and ns2.examplehosting.com — three signals, one company. If IP block and nameservers instead belong to a CDN, you have found the CDN, not the origin host.
Method 3: Check WHOIS and RDAP for the Registration Record
WHOIS — and its modern replacement RDAP, which ICANN now treats as the definitive source for generic domains — records who registered the domain, with which registrar, and which nameservers it uses. ICANN's free Lookup tool at lookup.icann.org returns this record, as does Nomlen's WHOIS checker.
What to read: the registrar field names where the domain was bought — useful for contacting the owner or starting a transfer, but not proof of the web host. The nameserver field is the useful one: if those nameservers belong to a hosting company, it very often hosts the site too, since many hosts bundle DNS with hosting. Creation and expiry dates show how long the domain has existed.
What you will usually not find is the owner's name, email or phone number. Since GDPR-era privacy rules, most registrars redact personal contact details or replace them with a privacy proxy. That is normal: hosting identification does not need personal data, and the registrar, nameservers and dates — still public — are the fields that matter here.
How to Read the Results: A Comparison
Each method answers a slightly different question:
Method | What it actually reveals | Speed | Best for | Watch out for |
|---|---|---|---|---|
Hosting checker (one-click) | Provider behind the public IP address | Seconds | Quick identification, competitor research | Reports the CDN if one is in front of the site |
DNS + IP trail (manual) | A record, IP owner, nameservers, reverse DNS | A few minutes | Verifying a checker result, learning the evidence chain | Cloud IP blocks may name the cloud, not the tenant host |
WHOIS / RDAP lookup | Registrar, nameservers, domain age and status | Seconds | Finding the registrar, checking domain age, starting a transfer | Registrar is not the web host; personal contacts are redacted |
Browser + terminal (dig / nslookup) | Raw DNS answers, straight from the source | Minutes | Double-checking when tools disagree | Needs comfort with the command line; cached answers can mislead |
One signal is a lead, two agreeing signals are an answer, three are certain. If checker and WHOIS disagree, trust the DNS/IP trail for the web host and treat the nameserver company as the DNS provider — then check whether a CDN explains the gap.
When the Answer Is Masked: Cloudflare, Proxies and CDNs
The most common reason a hosting lookup "fails" is that it did not fail at all — the site is behind Cloudflare or a similar proxy, and the public IP genuinely belongs to Cloudflare. Cloudflare is not a traditional web host; it is a reverse proxy and CDN between visitors and the origin server, hiding the origin IP by design. No public tool can reliably see past it.
There are legitimate workarounds, but they have limits. Historical DNS records sometimes reveal the origin IP from before the proxy was switched on. Mail, FTP or staging subdomains sometimes point at the origin server directly, bypassing the proxy. And the site's own history can help: an old hosting invoice or the registrar account usually names the host even when the public internet cannot. What does not work is re-running the same checker expecting a different answer, or trusting a tool that claims to "unmask" Cloudflare IPs — those IPs are often stale or belong to someone else.
If you own the site and have lost track of your host, skip the detective work: check your registrar account's nameservers and search your email for the host's welcome message or invoices. If you need to reach the owner of someone else's masked site, use the registrar's abuse contact or the CDN's abuse-reporting channel — not an attempt to expose the hidden server.
What to Do Once You Know the Host
- Taking over a site you own: contact the host's support with proof of domain ownership (registrar access is usually enough) to recover hosting access. Registrar and host are separate accounts — recovering one does not recover the other.
- Moving hosts: find the current host first so you can export a full backup before changing DNS. Migrating without a backup is the most common way sites lose content mid-move.
- Reporting abuse or phishing: report to the host's abuse team, not just the registrar. The host can suspend the content; the registrar can only act on the domain, which is slower and broader.
- Researching a competitor: the host hints at stack and scale — a budget shared host, a managed platform, or a major cloud each imply different priorities. Combine it with the domain's age from WHOIS.
- Buying a site or domain: confirm the host matches the seller's claims and check the domain's age and status in RDAP before paying. A mismatch with the public record is a reason to pause.
Common Mistakes That Produce the Wrong Answer
Confusing the registrar with the host. A domain bought at GoDaddy or Namecheap may be hosted anywhere. The registrar field in WHOIS is the shop, not the server.
Trusting a single tool on a CDN-masked site. If the result is Cloudflare, Akamai or another CDN, you have found the shield, not the server.
Checking the wrong domain. Look up the bare domain and the www version, and any subdomain you care about — a blog and a shop often sit on different hosts.
Reading a cached DNS answer. Records are cached for their TTL, so a site that migrated yesterday may still show its old host in some tools. Wait out the TTL or query the authoritative nameserver directly.
Assuming the IP owner is the host on cloud infrastructure. On AWS or Google Cloud, the IP block belongs to the cloud provider while the site may be run by an agency renting a cloud server. The IP owner narrows it to the cloud, not the tenant — nameservers and reverse DNS often narrow it further.
Frequently Asked Questions
Can I find out who hosts any website for free?
Yes, for any public website. A free hosting checker, DNS lookup and WHOIS/RDAP lookup together identify the host in most cases. The exception is a CDN-masked site, where public tools can only name the CDN.
Is it legal to look up who hosts a website?
Yes. DNS records, IP allocations and registration data are public by design — the internet needs them to route traffic. You are reading published records, not accessing anyone's server. Do not use the information to attack, impersonate or harass anyone.
Why does the lookup say Cloudflare instead of a hosting company?
Because the site uses Cloudflare as a reverse proxy: visitors connect to Cloudflare's servers, which fetch content from the real origin server. The public IP genuinely belongs to Cloudflare, so that is the honest answer from public data.
What is the difference between a registrar, a DNS host and a web host?
The registrar sells and manages the domain registration, the DNS host runs the nameservers, and the web host runs the server holding the site's files. One company often does several of these jobs, but they are separate roles.
Can WHOIS tell me who hosts a website?
Indirectly. WHOIS and RDAP show the registrar and nameservers, not the web host directly. If the nameservers belong to a hosting company, it probably hosts the site too — but always cross-check with the DNS/IP trail.
How do I find the host of a website I own but lost track of?
Check your registrar account for the nameservers, search your email for the host's welcome message or invoices, and run a hosting checker on your domain. With registrar access you can prove ownership to the host's support team and recover hosting access.
What if the hosting checker and WHOIS disagree?
Trust the DNS/IP trail for the web host — it shows where traffic actually goes — and treat the WHOIS nameserver company as the DNS provider. The gap usually means a CDN sits in front of the site, or DNS and hosting came from different providers.
Does finding the host also reveal the website owner?
Not usually. The host provides infrastructure, not ownership, and owner contacts in WHOIS are normally redacted. To contact an owner, use the site's contact page or the registrar's contact channel.
