Printed QR Codes: Use Your Own Domain, Not Theirs

If you made a QR code on a free website and had it printed onto anything, you do not control where that code sends people. Somebody else does. They can meter it, put an advert in front of it, attach an expiry date to it, or switch it off, and the only part you own is the ink.

That is not a scare story. It is how these things are built, and the companies selling them say so on their own pricing pages. Business owners rarely read those pages, because the code worked when they scanned it at the counter, so why would you go looking for the small print.

Then one day it stops working. And by then it is on the labels.

The middleman you did not know you hired

A QR code is a picture of some text. That is the entire trick. Point a camera at the pattern, the phone reads the characters back out, and if those characters look like a web address it offers to open it.

Which means there are only two kinds of QR code, and the difference decides who is in charge.

A static code has your web address written into the pattern itself. The phone reads yourdomain.ie/menu and goes to yourdomain.ie/menu. Nobody sits in between. The trade is that the destination is fixed at the moment of printing, because the address is the picture.

A dynamic code has the generator's short address written into it instead, something like qr-svc.co/x7f2p. The scan lands on their server, and their server decides where to forward it. That indirection is sold as the feature: change the destination whenever you like, long after the print run. It is also the catch. A company you have no relationship with is now standing between your customer and your website on every single scan, for as long as that printed item exists.

On a Tuesday morning in the middle of a season, that abstraction turns concrete. Consider a garden centre in Carlow that had care instructions QR-coded onto its plant labels, thousands of them, spread across trays and trolleys and out into customers' gardens. The codes were made on a free account. The free account had a limit nobody had gone looking for. The labels are not coming back, and reprinting them is not a decision you make in an afternoon.

Read the pricing page before the printer does

I would rather show you the terms than describe them.

The QR Code Generator, one of the tools that turns up first when you search for one, lists a free tier of two dynamic codes, served with ads, and fourteen days of scan analytics. Uniqode's own help documentation notes that a code can carry an expiration date set in its advanced options, and that the platform disables any codes associated with malicious websites immediately.

Take those one at a time, because both matter more than they look.

The ads point is the smaller one, and it still stings. A customer standing at your counter scans your code and is shown somebody else's promotion before they reach your page. You paid for the print. They monetised the scan.

The disablement point is the one that should stop you. An automated system belonging to a third party can switch off your printed marketing without ringing you first. That system exists for good reasons, and I would rather it existed than not, given what the codes are being used for by criminals at the moment. But notice where the switch is. It is not in your building.

And this is a permanent dependency, not a campaign-length one. A code stamped on a van, etched on a shopfront, printed on a menu holder or a plant label is a piece of infrastructure with a service contract you did not negotiate. When the service changes its plan tiers, your infrastructure changes with it.

Your customers have already been taught to check the domain

This is the argument I have most trouble getting across, and it is the strongest one.

The National Cyber Security Centre published a short public guide to QR code phishing, or "quishing", in January 2025. Its description of the problem is blunt: criminals place scam QR codes over legitimate ones in high-traffic locations, and it names restaurants, parking payment points, and public posters and leaflets as the places this happens. Its advice to the public is a checklist. Look at the preview in your scanner or browser, and ask whether it matches the official website. Is the code tamper-proof, behind glass or on a digital display, or is it a sticker?

Bank of Ireland tells its customers much the same thing in its security guidance: check the QR code URL before opening it, look for signs of a suspicious link, and confirm the website matches the company it came from.

So the state's cyber security centre and the customer's bank are both training the person holding the phone to do one specific thing before they tap. Read the domain in the preview.

Now think about what your code shows them. If that preview line reads yourdomain.ie, the check passes and they tap. If it reads a jumble of characters on a service they have never heard of, the careful customer does exactly what they were told to do and backs out of the scan. You have paid a printer to produce something that fails the test your own customers were coached to run.

That is what genuinely irritates me about the free generators. They ask you to hand over your business name in the one place it earns its keep, the preview line, in exchange for a redirect you do not own. If a business is going to the trouble of getting its own domain and its own site up in the first place, spending the money to then print somebody else's address on its front door is a strange way to finish the job.

A short address on your own domain prints as a coarser, more forgiving pattern than a long tracked URL.

Static code, your redirect

There is a version of this that gives you the flexibility without the landlord, and almost nobody selling QR codes will mention it, because it does not need them.

Encode a short address on your own domain, and make that address a redirect you control.

yourdomain.ie/menu sends visitors to whatever you point it at this month. In WordPress that is a redirect rule you set in the dashboard, changed in seconds, no reprint. The printed picture never changes because the printed picture only ever contained your own address.

Google's Search Central documentation is clear about the mechanism. A permanent server-side redirect is the recommended method, and its indexing pipeline treats a 301 as a signal that the destination should be the canonical page, where a temporary 302 is not treated that way. In plain terms: use a permanent redirect when the move is permanent, and the search engine follows your intent instead of guessing at it.

Keep the address short while you are at it. Denso Wave, which invented the format and still publishes the specification, sets out forty versions running from 21 by 21 modules up to 177 by 177, and states the obvious consequence directly: as the amount of data increases, more modules are required, producing a larger symbol. A long tracked URL with campaign parameters bolted on the end produces a denser grid of smaller squares.

Denser grids are what fail on a curved bottle, a laminated label with a bit of glare on it, or a poster read from four feet away in bad light. yourdomain.ie/menu prints as a coarse, forgiving pattern that scans first time from a phone held at an angle by somebody who is already slightly impatient.

How to Print a QR Code You Can Still Change in Three Years

Choose the address before the artwork. Pick a short, human path on your own domain that describes the thing rather than the campaign: /menu, /book, /care, /offer. Names outlive campaigns.

Create the redirect first. Set that path up on your site and point it wherever it needs to go today. Do this before anything is designed, so the address in the artwork is one that already works.

Generate a static code. Any generator will produce one, including the free ones, because a static code needs no account and no server on their end. It is the plain picture of your address and it belongs to you the moment it is made.

Verify on real phones, not on your screen. Print it at final size, on the final material, and scan it with an old Android and a current iPhone, in the light the customer will actually be standing in. Check the preview line reads your domain.

Print it where it cannot be quietly replaced. Behind glass, laminated, engraved, or under the counter's own signage. The NCSC guidance tells people to be suspicious of a QR sticker, and a sticker is also the easiest thing in the world for somebody to cover with their own.

Getting all of that right assumes one thing: that there is a real site on a domain you control at the other end. If your printed material currently points at a social page or a builder's free subdomain, that is the piece to fix first, and it is a smaller job than it used to be. Building the site is now a matter of describing the business and watching a full WordPress site come back, which is the part of getting a first website live that used to take weeks and a deposit. You can see the whole thing built from a description in under a minute before deciding anything.

Where a paid QR platform genuinely earns its money

I will give the dynamic services their due, because there is a job they do properly.

If you are running a short campaign across a lot of physical placements and you need to know which placements worked, a paid platform is the right tool. Twelve different posters in twelve different towns, a unique code on each, and a dashboard telling you scans per poster, per hour, per day. Building that yourself with separate paths and analytics segments is more work than a six-week campaign justifies. Pay them, use the data, and let the codes lapse when the posters come down.

The rule is about permanence, not about the vendors. Rented redirects on temporary print, fine. Rented redirects on anything you cannot easily reprint, no.

I have been on the wrong side of this myself. Years back I put a shortened link on an exhibition banner because it looked tidier than the real address, and I never gave a thought to who owned the shortener. The banner outlived my interest in the campaign by a considerable margin. I have used full addresses on print ever since, and if they look less tidy, they still resolve.

Every dynamic QR code routes each scan through a third party before it reaches your site.

What pointing at your own domain does not fix

Two honest limitations, and the first one is serious.

Your redirect only lives as long as your domain does. Let the registration lapse and every printed code you have ever produced starts pointing at whoever registers that domain next, which is a worse outcome than a dead link, because a dead link at least looks broken. This is the real reason domain renewal is worth treating as a business-critical date rather than an email you skim. The same goes for the name itself: a trading name you use on print is not automatically a name you hold rights over, which is a distinction worth understanding before you commit it to a thousand labels, and it is why registering a business name is not the same as owning it.

Second, and less dramatic: you give up the per-scan dashboard. Your own analytics will tell you the page was visited. They will not, on their own, tell you whether the visit came from the poster in the window or the flyer in the bag, unless you deliberately set up separate paths for each and read them separately. That is a real loss of resolution and you should know about it before you choose. For most businesses printing one code on one thing, it does not matter. For a multi-placement campaign, it does, which is exactly the case above where paying somebody makes sense.

Conclusion

The question worth asking before any print job is not which QR generator is best. It is a shorter one: when this is printed, whose address is inside the pattern?

If the answer is your own domain, the code is a permanent asset, it passes the check your customers have been taught to run, and you can change where it goes for the next ten years without touching the print. If the answer is somebody else's, you have rented a piece of your own signage, and the terms of that rental are on a pricing page you have not read.

Both are choices you can make. Only one of them is still yours in three years.

Frequently Asked Questions

Do QR codes expire?

The printed picture never expires. What can expire is the service sitting behind it. A static code contains your web address directly, so it works for as long as that address works. A dynamic code contains a generator's short link, and that link stops resolving if the account lapses, the plan is downgraded, or an expiry date was set when the code was created. Uniqode's own documentation, for example, describes an expiration date field in a code's advanced options. If nobody at your business knows which type was used, assume dynamic and check the account.

Can I change where a QR code goes after it has been printed?

Yes, if you set it up properly. Encode a short path on your own domain, such as yourdomain.ie/menu, and put a redirect on that path. The printed pattern never changes because it only ever contained your own address, but you can repoint the redirect from your WordPress dashboard whenever you like. That gives you the same flexibility a paid dynamic QR service sells, without the account, the renewal, or the middleman.

Is a free QR code generator safe to use for my business?

For static codes, yes. A static code needs no account and no server on the generator's side, so once the image is made there is nothing left to depend on. Free dynamic codes are the risk, because the free tier is where the limits live: ad interstitials, capped analytics retention, and codes that stop redirecting when the tier changes. Read the pricing page before you commit anything to print.

What should a QR code on my menu or leaflet actually point to?

A page on your own domain, using a short readable path that describes the thing rather than the campaign. Both the National Cyber Security Centre and Irish banks tell consumers to check the address preview before tapping a scanned code, so the domain in that preview is doing real work. A customer who sees your business name carries on. A customer who sees an unfamiliar shortener has been told to back out.

Does using a redirect hurt my Google rankings?

Not if you use the right kind. Google's documentation states that a permanent server-side redirect is the recommended method, and that its indexing pipeline treats a 301 as a signal that the destination should be the canonical page, whereas a temporary 302 is not treated that way. Use a permanent redirect for a permanent move and search engines follow your intent rather than guessing at it.

How do I stop somebody covering my QR code with a fake one?

You cannot stop it entirely, but you can make it awkward. The NCSC guidance tells the public to be suspicious of QR stickers and to trust codes that are tamper-proof, behind glass or on a digital display. Print yours into the artwork rather than applying it as a label, put it behind glass or under laminate where you can, and check your customer-facing codes as part of the same routine that checks your opening hours are right.

Your Printed QR Code Is Not Yours. Point It at Your Own Domain.