Overview

Domain locking is a security feature that prevents your domain from being transferred to another registrar without explicit authorization. It works by setting a clientTransferProhibited status code on your domain record. It should be enabled on all domains except when actively in the process of transferring — and it's free at most registrars.

What Is Domain Locking?

Domain locking is a security feature offered by domain registrars that prevents your domain from being transferred to another registrar without explicit authorization. When a domain lock is active:

No domain transfer can be initiated

The registrar will reject any incoming transfer requests for the domain

Changes to critical DNS records may also be restricted (depending on the registrar)

Think of it like a deadbolt on your front door. Even if someone has a copy of your key (your account credentials), the deadbolt provides an additional layer that must be specifically engaged to unlock.

How Does Domain Locking Work Technically?

Domain locking is implemented through a domain status code in the EPP (Extensible Provisioning Protocol) system — the global standard for domain registrar-registry communication.

When a domain is locked, the registrar sets a status code of clientTransferProhibited on the domain record. This code signals to all other registrars that transfer requests should be refused.

Some domains may also have additional lock codes:

clientUpdateProhibited: Prevents changes to domain contact information

clientDeleteProhibited: Prevents the domain from being deleted

serverTransferProhibited: A registry-level lock applied by the domain registry itself (not just the registrar)

Premium domain security services often apply multiple lock types for maximum protection.

What Problems Does Domain Locking Prevent?

Preventing Unauthorized Domain Transfers

The primary purpose of the registrar lock is to prevent unauthorized transfers — the cornerstone of domain hijacking protection. If an attacker compromises your registrar login credentials, the first thing they might do is initiate a transfer to move your domain to a registrar under their control.

With domain locking enabled, this attack is stopped cold. The transfer request will be rejected outright because the domain status code prohibits it.

Blocking Social Engineering Attacks

Attackers sometimes call registrar support lines posing as the domain owner to request a transfer or account changes. A locked domain adds friction to this attack — the attacker would need to also convince support to disable the lock, which typically requires additional verification steps.

Protecting Against Accidental Transfers

Domain locks aren't only about malicious actors. Accidental or mistaken transfer requests (perhaps triggered by a confused employee or a billing error at a reseller) can also be blocked by the lock.

Should You Enable Domain Locking?

The answer is yes — with one exception.

Enable Domain Locking If:

You have no plans to transfer the domain to another registrar in the near future

Your domain is registered for an important business, brand, or project

Your domain has significant traffic, SEO value, or monetary worth

You want maximum protection against domain theft

In practice, that describes nearly every domain worth owning. You should enable domain locking on all your domains by default.

Disable Domain Locking Only When:

You are actively in the process of transferring the domain to a new registrar

You need to make specific changes that your registrar's lock prevents

Even when you temporarily disable the lock to initiate a transfer, you should be watching your email closely for any transfer-related notifications and re-enable the lock if you cancel or delay the transfer.

How to Enable Domain Locking at Major Registrars

Enabling Registrar Lock on Namecheap

1. Log into your Namecheap account

2. Go to Domain List

3. Click Manage next to your domain

4. Under the Domain tab, find Transfer Lock

5. Toggle it to ON (the switch should turn green)

6. The change takes effect immediately

Enabling Registrar Lock on GoDaddy

1. Log into GoDaddy and go to My Products

2. Click DNS or Manage next to your domain

3. Scroll to Domain lock under the Additional Settings section

4. Click the toggle to enable it

Enabling Registrar Lock on Google Domains / Squarespace Domains

1. Log into your account and select the domain

2. Go to Registration settings

3. Find Domain lock and toggle it on

Checking Your Domain Lock Status via WHOIS

You can verify your domain's lock status without logging in by checking the public WHOIS record:

1. Go to lookup.icann.org or whois.domaintools.com

2. Enter your domain name

3. Look for the Domain Status field

4. You should see clientTransferProhibited if the lock is active

Domain Locking vs. Other Security Measures

Domain locking is one layer of a multi-layered security approach. It should not be your only protection.

Domain Locking + Two-Factor Authentication

Domain locking prevents unauthorized transfers. 2FA prevents unauthorized account access. Together, they're significantly more effective than either alone. An attacker who somehow bypasses your 2FA still faces the domain lock — and vice versa.

Domain Locking + WHOIS Privacy

WHOIS privacy hides your contact information from public domain records, reducing the information available to attackers for social engineering. Combine WHOIS privacy with domain locking for a stronger defense.

Domain Locking + Registry Lock (Premium)

Some registries and premium registrars offer a registry-level lock (sometimes called "Domain Registry Lock" or "Platinum Lock") that goes beyond the standard registrar lock. This requires manual intervention from the registry — not just the registrar — to remove, making it extremely difficult to transfer the domain even if a registrar account is compromised.

This level of protection is typically reserved for high-value domains (often costing $100–$500/year) and is used by major corporations, domain investors, and government entities.

What Happens When You Need to Transfer a Locked Domain?

Needing to transfer a domain doesn't mean you lose protection — it just requires a brief, deliberate unlock step.

Process for transferring a locked domain:

1. Log into your registrar account

2. Navigate to domain settings and disable the transfer lock

3. Request your EPP (authorization) code

4. Initiate the transfer at your new registrar using the EPP code

5. Monitor your email for transfer confirmation requests and approve them

6. The transfer completes within 5–7 days

7. Set up your domain lock at the new registrar once the transfer is complete

The window during which your domain is unlocked is brief and deliberate — which is why it's not a significant security risk when managed carefully.

Expert Verdict

Domain locking is the single highest-leverage, zero-cost security action available to domain owners. The clientTransferProhibited status code acts as a hard technical barrier against unauthorized transfers — one that an attacker cannot bypass through account compromise alone because disabling the lock generates its own authentication flow with the registrar.

The reason domain locking matters in 2026 more than ever is the sophistication of social engineering attacks targeting registrar support teams. Attackers armed with WHOIS data and AI-generated voice impersonation have become increasingly effective at convincing support agents to make account changes. A domain with registrar locking active forces the attacker to clear an additional verification hurdle — one that most social engineering attacks cannot consistently defeat.

For domains that represent critical business infrastructure — primary brand domains, SaaS product domains, e-commerce storefronts — the appropriate security posture is layered: registrar lock on, 2FA with an authenticator app, WHOIS privacy enabled, and a dedicated secure email for the registrar account. For domains with valuations exceeding $50,000, the marginal cost of upgrading to a registry-level lock is easily justified by the protection it provides against even the most determined attackers.

Frequently Asked Questions

Conclusion

Domain locking is one of the quickest, easiest, and most effective security measures you can apply to protect your domain from unauthorized transfers and domain hijacking. It costs nothing, takes about 30 seconds to enable, and doesn't affect your site or email in any way.

If you're not sure whether your domain lock is enabled right now, check it today. For any domain with meaningful value — whether that's business revenue, brand reputation, or SEO authority — the registrar lock should always be on.

Looking to register a new domain with security best practices from day one?

Use DomainsDiscovery.com to check domain availability and compare prices across registrars instantly.