What Is Registrar Lock? Domain Theft Protection

What registrar lock is and what it blocks

Registrar lock is a status your registrar sets on a domain that blocks transfer to another registrar until you remove it. Registrars show it as clientTransferProhibited in WHOIS; some panels call it a domain lock or transfer lock. It is the cheapest protection against domain theft.

• Blocks — transfer requests to another registrar, even with a valid authorization code.
• Does not block — renewals, DNS edits, nameserver changes, contact updates or website hosting.
• Default — on for new registrations at most registrars, and it should stay on.
• Removal — one toggle in your registrar account, plus the authorization code for the transfer.

The lock lives at the registry, not on your server, so it keeps working even while you change hosts or DNS. Transfer discipline — lock on the old registrar, code requested by you — is covered alongside the domain transfer service.

The domain lock states you will see in WHOIS

Five EPP statuses explain almost every locked domain. Only the first is the everyday lock a domain owner toggles; the others are set by the registrar or registry for deletion, update or abuse reasons.

A WHOIS lookup lists these under Domain Status. Two or three at once is normal; a registrar lock usually appears with the update and delete flags.

What domain hijacking looks like

Hijacking is someone else gaining control of the registration: changing the registrar of record, the nameservers, or both, so your traffic and mail go elsewhere. It usually starts with a stolen registrar login or a phishing email that harvests the authorization code.

The warning signs are a registrar in WHOIS that you did not choose, nameservers you never set, mail that stops arriving, or a password reset you did not request. A locked domain blocks the transfer step even when the account is compromised, which is why the lock matters more than the panel's design.

Why the lock should stay on by default

Leave registrar lock on and unlock it only for the hours a real transfer needs. A locked domain cannot move even if someone has your password and a valid authorization code, because the registry refuses the request before it reaches the gaining registrar.

Pair the lock with two-factor authentication on the registrar account and a monitored admin email. The lock protects the transfer; the account protection stops the attacker from turning the lock off.

How to unlock a domain, then transfer it

Disable the lock at the current registrar first, then request the authorization code and start the transfer at the gaining registrar. Order matters: a transfer request placed while the domain is locked is rejected and must be restarted.

1. Sign in to the current registrar and turn off the transfer lock for the domain.
2. Copy the authorization code (EPP code) shown in the panel; if it is hidden, request it by email.
3. Start the transfer at the new registrar and pay its transfer fee, which usually adds a year to the registration.
4. Approve the confirmation email sent to the registrant address — the transfer waits five days without approval.
5. Leave the lock off until the transfer completes, then switch it back on at the new registrar.

If the current registrar will not unlock the domain or give you a workable way to do it within five days, ICANN's transfer complaint process exists for exactly that case.

The 60-day transfer lock after registration or transfer

ICANN policy blocks a transfer for 60 days after a new registration, a completed transfer, or a change of registrant details. This lock is separate from registrar lock and your registrar cannot waive it, so plan domain sales and ownership changes around it.

Renewals and DNS changes are unaffected. If a transfer is urgent inside the window, the only route is an inter-registrar push within the same provider, which is not a transfer.

How to check your domain's lock status in WHOIS

Run the domain through a WHOIS lookup and read the Domain Status lines. Seeing clientTransferProhibited means the transfer lock is on; seeing no transfer status at all means the domain is unlocked and can be moved by anyone holding the code.

Check the registrar name on the same result. If it is not the company you pay, treat it as an incident: contact your registrar immediately and ask for the domain to be locked while the record is investigated.

Registry lock versus registrar lock

Registry lock is a stronger lock applied at the registry by the registrar's staff after out-of-band verification, usually by phone. It shows as serverTransferProhibited or a registry-specific status and cannot be removed from a web panel.

It suits high-value or frequently targeted domains where an account compromise would be costly. For most businesses the self-service registrar lock plus two-factor authentication is enough; the domain protection guide covers the rest of the account hardening.