Most people think about website security. Hardly anyone thinks about the account that holds the domain itself.

That is backwards. Your domain sits above everything else. Your website points to it. Your email runs through it. Your customers type it in. If somebody gets into your registrar account, they do not need to hack your website. They can just point your domain somewhere else, read your email, or move the name to another registrar.

I have been buying, selling and building on domains for a long time. At one point I owned more than 1,600 of them, a story I tell in How I Got Into Domains. You do not hold that many names without learning that the registrar login is the most important password you own. This is the checklist I would hand any small business owner, whether you have one domain or a few hundred.

Why your domain account is worth protecting

A registrar is the company you pay to register and renew your domain. Your registrar account is where all the real control lives:

  • Nameservers and DNS. Change these and your website, email and anything else on the domain points somewhere new.
  • Contact details. Change the email on file and the renewal notices, transfer approvals and password resets go to someone else.
  • Transfers. With the domain unlocked and the auth code in hand, the name can be moved to a different registrar.
  • Renewals. Turn off auto-renew or let a card expire, and the name can lapse.

ICANN's security committee wrote a whole guide on this back in 2010, SAC044, A Registrant's Guide to Protecting Domain Name Registration Accounts. The threats it lists still read like today's news: unauthorized account access, malicious DNS changes, contact info changes, unauthorized transfers and interference with renewals. Every step below closes one of those doors.

Turn on two-factor authentication

If you do only one thing from this post, do this.

Two-factor authentication (2FA) means a password alone is not enough to get in. You also need a code from an app, a security key or a text message. The U.S. Cybersecurity and Infrastructure Security Agency has a plain-English page on multifactor authentication that explains why it stops so many account takeovers.

A few tips:

  • Use an authenticator app or a security key if your registrar offers one. A text-message code is better than nothing, but an app or a key is harder to steal.
  • Save the backup codes somewhere safe. If you lose your phone, those codes are how you get back in.
  • Give the account a unique password. Never reuse your registrar password anywhere else. A password manager makes this easy.

Do this on every registrar account you have, not just the main one. The forgotten account with one old domain in it is usually the weakest link.

Lock the domain at the registrar

Most registrars have a setting called "registrar lock," "transfer lock" or "domain lock." Behind the scenes it usually sets a status called clientTransferProhibited on the domain.

ICANN's page on EPP status codes explains it simply: that status tells the registry to reject requests to transfer the domain away from your current registrar, which helps prevent unauthorized transfers from hijacking or fraud. There are similar statuses that block deletes (clientDeleteProhibited) and updates (clientUpdateProhibited).

My rule is easy. Every domain stays locked unless I am actively moving it. When the move is done, I lock it again. I cover that whole process in How to Transfer a Domain Name to Another Registrar.

You can check a domain's status yourself with ICANN Lookup. If you see "client transfer prohibited" in the results, the lock is on.

What about registry lock?

For a domain that runs a whole business, there is a stronger option. Some registries offer a Registry Lock service, requested through your registrar, that sets server-level statuses. ICANN notes that removing those takes longer because your registrar has to ask the registry to lift them. That extra friction is the point. It usually costs more, and not every registrar or ending offers it, but it is worth asking about for your most important name.

Treat the auth code like a password

The authorization code (also called an auth code, EPP code or transfer key) is what lets someone move your domain to another registrar. If the domain is unlocked and someone has that code, you have a problem.

  • Do not email it around or paste it into a group chat.
  • Only generate it when you are actually transferring. If your registrar lets you reset it, reset it after a move is finished.
  • Be suspicious of anyone asking for it. A buyer, a "consultant" or a web designer does not need your auth code unless you have agreed to move the name to them.

If you sell a domain, the auth code is part of the handoff, but only after you get paid. I walk through that order in How to Sell a Domain Name.

Use a recovery email that does not depend on the domain

This one sounds small, and it catches a lot of people.

If the email address on your registrar account is something like you@yourbusiness.com, and the domain yourbusiness.com expires or gets its DNS changed, that email stops working. Now the renewal reminders, password resets and transfer approvals go nowhere. You are locked out of the one account that could fix it.

ICANN's Expired Registration Recovery Policy includes a recommended best practice for registrars that says the same thing: they should advise registrants to give a secondary email contact that is not tied to the domain itself, so expiration reminders still get delivered.

A real-world reminder showed up this month. Verisign had planned to shut down existing third-level .name domains and the email forwarding that came with them. As Domain Name Wire reported, Verisign reversed course on Nov 10 and existing registrations will stay, as long as at least one registrar keeps supporting them. But one registrant said she would have had to change 211 accounts tied to her .name email address. That is what happens when everything hangs on one address you do not fully control.

So for your registrar login, use an email address you control on a different domain, protected with its own 2FA.

Turn on auto-renew and keep your card current

Losing a domain to an expired renewal is not a hack, but the result is the same. The name is gone or costs a lot to get back.

Under ICANN's renewal policy, registrars must send at least two reminders before a generic domain like a .com expires, one about a month out and one about a week out, plus another within five days after it expires if it has not been renewed. That only helps if those emails reach you.

What I do:

  • Turn on auto-renew for every name you plan to keep.
  • Keep the payment card current. An expired card quietly turns auto-renew off in practice.
  • Renew important names for several years at a time so one missed email cannot sink you.
  • Watch the redemption window. Once a deleted generic domain enters redemption, ICANN says it sits there for 30 days, and restoring it usually means an extra fee.

Country-code endings like .us, .co or .si can have their own registry rules, so check your registrar's renewal terms for those.

Write down where every domain lives

This is the boring step that saves you later.

Make a simple list, a spreadsheet is fine, with:

  • every domain you own,
  • which registrar holds it,
  • which email address is on the account,
  • when it expires and whether auto-renew is on,
  • where the DNS is hosted,
  • and who else has access.

When I was cutting down my portfolio, I learned how expensive scattered names get. I wrote about that in The Real Cost of Owning Too Many Domains. The real win is having every name in one place where you can see it, and a list makes that possible.

Control who has access

Small businesses often hand a registrar login to a web designer, an old employee or a family member "just for a minute." Years later, that person still has it.

  • Own the account yourself. The domain should be registered in your name or your business's name, in an account you control. Not your designer's account.
  • Use team or delegate access if your registrar offers it, instead of sharing your main password.
  • Remove people when the work is done. Change the password when someone leaves.
  • Keep proof of ownership. SAC044 recommends keeping proof that the domain is yours. I keep invoices and registration emails for that. If you ever have to dispute a hijack, that paper trail matters.

If you are just starting out and still choosing a name, set this up from day one. My guide on how to pick a domain name for a new business is a good place to begin.

Watch for warning signs

You do not need fancy monitoring. You just need to pay attention to the emails your registrar sends and act fast on anything you did not do.

Take these seriously:

  • a password reset you did not request,
  • a notice that your contact details changed,
  • a transfer request or a "pending transfer" status,
  • nameserver or DNS changes you did not make,
  • your website or email suddenly pointing somewhere strange.

ICANN's status code page says that if you see pendingTransfer and you did not request a transfer, you should contact your registrar immediately and ask them to deny it. The same goes for any change you did not make. Call your registrar first, then change your password and check your 2FA.

Also watch for phishing. Fake "your domain is expiring" emails and fake registrar login pages are common. Go to your registrar's site directly instead of clicking the link in the email.

My five-minute domain security checklist

Here is the short version. Run through it once for every registrar account you have.

  1. Two-factor authentication is on, with backup codes saved.
  2. The password is unique and stored in a password manager.
  3. Every domain is locked, unless you are moving it right now.
  4. The account email is on a different domain you control.
  5. Auto-renew is on and the card on file is current.
  6. You have a list of every domain, its registrar, expiration date and DNS host.
  7. Only the people who need access have it.
  8. Your most important name has registry lock, if it is available and worth it to you.

Final thoughts

Securing your domain account is not glamorous, and nobody notices when you do it right. But your domain is the front door to your website, your email and your brand. Fifteen minutes of setup is a lot cheaper than trying to win a name back after it is gone.

If you want to see the names I am working with right now, take a look at my domain portfolio.

FAQ

How do I protect my domain name from being stolen?

Turn on two-factor authentication at your registrar, use a unique password, keep the domain locked, keep your auth code private, use an account email that is not on the same domain, and turn on auto-renew. Those steps close the most common ways a domain gets taken.

What is a registrar lock?

A registrar lock is a setting that tells the registry to reject transfer requests for your domain. It usually shows up as clientTransferProhibited when you look up the domain. Leave it on unless you are moving the domain to a new registrar.

What is the difference between registrar lock and registry lock?

Registrar lock is a setting your registrar controls and you can usually toggle it in your dashboard. Registry lock is set at the registry level through your registrar, and removing it takes extra steps. Not every registrar or domain ending offers registry lock.

Should my domain account email use my own domain?

It is safer not to. If that domain expires or its DNS breaks, you can lose access to the email that receives renewal notices and password resets. Use an address on a different domain that you control.

What should I do if someone transfers my domain without permission?

Contact your current registrar right away and ask them to stop or reverse the transfer. Change your password, check your 2FA and gather proof that the domain is yours, like invoices and registration emails. If your registrar cannot help, ICANN has a transfer complaint process for generic domains.

Does WHOIS privacy protect my domain from hijacking?

Privacy can cut down on spam and phishing aimed at your contact details, but it does not lock the domain or protect your login. You still need two-factor authentication, a lock and a strong password.