- Domain theft is a real, documented risk that a simple setting largely prevents.
- Here is what transfer lock actually does, and when you legitimately need to turn it off.
Domain hijacking — an attacker gaining unauthorized control of your domain and transferring it away — is a real, documented risk, particularly for valuable or established domains. Transfer lock is the primary, simplest defense against it.
What Transfer Lock Actually Does
When enabled (the default setting for most domains), transfer lock prevents the domain from being transferred to a different registrar without first being explicitly unlocked by the legitimate account holder. This blocks the most common domain hijacking method: an attacker with partial access attempting to move the domain to a registrar they control.
Why This Matters
- A stolen or transferred domain can take down your website and email simultaneously, with no warning.
- Recovering a hijacked domain, when possible at all, is a slow, often expensive dispute process.
- Business domains with real traffic, brand value or email dependency are attractive targets specifically because of that value.
Checking and Enabling Transfer Lock
- Log into your domain registrar's management panel.
- Locate the domain status or security settings section.
- Confirm "Transfer Lock" or "Registrar Lock" is enabled — most registrars enable this by default, but it is worth verifying directly.
When You Legitimately Need to Disable It
- You are intentionally initiating a transfer to a different registrar.
- The transfer requires an EPP/authorization code, which is only obtainable once the lock is disabled.
- Re-enable the lock immediately once the legitimate transfer is complete.
Additional Domain Security Layers
- Enable two-factor authentication on your domain registrar account itself, not just the domain settings.
- Ensure the registrant email address on the domain is current and actively monitored — it is the primary recovery channel.
- Consider domain privacy protection to reduce the personal information exposed publicly via WHOIS.
- Use a strong, unique password for your registrar account, distinct from other services.
Frequently Asked Questions
Does transfer lock cost extra?
No — it is a standard, free feature included with virtually all domain registrations and should already be enabled by default.
Can transfer lock prevent me from managing DNS or renewing my domain?
No — it specifically blocks registrar-to-registrar transfers only, not routine DNS management, renewal, or other administrative actions on the domain.
Questions about domain security? See our domain services or ask our team.
