What Is Registrar Lock? Domain Theft Protection
Registrar lock is a free status, shown as clientTransferProhibited, that makes the registry refuse any transfer of your domain to another registrar, even with a valid authorisation code. It does not affect DNS, email or renewals. Keep it on, and switch it off only while a transfer you started is in progress.
For domain owners securing a name against hijacking, or unlocking one to move it to another registrar.
knowledge
- Read time
- 4 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What is registrar lock and what does it block?
Registrar lock is a status your registrar places on a domain, shown as clientTransferProhibited, that makes the registry refuse any request to transfer the domain to another registrar until the lock is removed. Panels also call it domain lock, transfer lock or theft protection. It costs nothing and is on by default at most registrars.
| Action | With registrar lock on |
|---|---|
| Transfer to another registrar | Blocked, even with a valid authorisation (EPP) code |
| Renewal | Allowed |
| DNS record changes | Allowed |
| Nameserver changes | Allowed, unless clientUpdateProhibited is also set |
| Moving to another account at the same registrar | Usually allowed; this is a push, not a transfer |
Because the status is recorded at the registry, it keeps working while you change hosting or DNS providers. Moving a domain to WebJi® is covered on domain transfer.
Domain lock statuses you will see in a WHOIS lookup
Status codes beginning with “client” are set by your registrar, and those beginning with “server” are set by the registry; only clientTransferProhibited is the everyday lock a domain owner toggles. Seeing two or three statuses together is normal.
| Status | Set by | What it blocks | How it is removed |
|---|---|---|---|
| clientTransferProhibited | Registrar | Transfer to another registrar | Unlock in your registrar panel |
| clientUpdateProhibited | Registrar | Changes to contacts or nameservers at the registry | Registrar lifts it, often automatically when you save a change |
| clientDeleteProhibited | Registrar | Deletion of the domain | Registrar panel or request |
| clientHold | Registrar | The domain resolving in DNS at all | Fix the issue, often unverified contact details or non-payment |
| serverTransferProhibited | Registry | Transfer, even after you unlock | Registrar asks the registry; often a registry lock or a dispute |
| serverHold | Registry | The domain resolving | Resolve with the registry through the registrar |
Run your domain through the WHOIS domain lookup and read the Domain Status lines. For gTLDs such as .com, ICANN now uses RDAP as the official lookup protocol; tools show the same codes. How the lookup works is explained in what WHOIS is.
How registrar lock prevents domain hijacking
Hijackers usually try to transfer a domain to a registrar they control, using a stolen account login or an authorisation code phished from the owner; registrar lock makes the registry reject that transfer outright. Without the lock, anyone holding the code can start a transfer.
Warning signs of an attempted or successful hijack are a transfer-confirmation email you did not request, a registrar in WHOIS that you do not pay, nameservers you never set, or mail suddenly stopping. The lock protects the transfer step only. An attacker inside your account could turn it off, so pair it with two-factor authentication on the registrar login and a registrant email address you check daily. The rest of the hardening is in how to protect your domain name.
How to unlock a domain and transfer it
Turn off the lock at the current registrar first, then get the authorisation code and start the transfer at the new registrar; a transfer started while the domain is still locked is rejected.
- Confirm the domain is not within 60 days of registration or a previous transfer, and that the registrant email is one you can read.
- Sign in to the current registrar and switch off the transfer lock.
- Copy the authorisation (EPP) code from the panel, or request it; registrars must provide it promptly on request.
- Start the transfer at the new registrar and enter the code. For most gTLDs the transfer fee adds a year to the registration.
- Approve any confirmation email. If nobody approves or rejects it, a gTLD transfer usually completes automatically after five days.
- When the domain appears at the new registrar, check that its lock is on again.
Where to find the code at common registrars is in how to get a domain authorisation code; the full move is in how to move a domain to a new registrar and, for one large registrar, transferring a domain from GoDaddy.
The 60-day transfer lock is a different lock
Separately from registrar lock, ICANN's current Transfer Policy lets a registrar refuse a gTLD transfer within 60 days of registration or of a previous inter-registrar transfer, and most registrars apply that rule. You cannot switch it off in a panel; you wait it out.
- Change of Registrant lock: changing the registrant name, organisation or email can trigger a further 60-day transfer lock, which many registrars let you avoid by opting out before you make the change.
- Policy revision: ICANN has adopted changes that replace these 60-day periods with a 30-day post-registration and post-transfer lock once implemented, so check the rule your registrar applies today.
- .in and other ccTLDs: follow their own registry's transfer rules rather than ICANN's.
- Urgent sale: inside the window, an intra-registrar push to the buyer's account at the same registrar is the usual route, as covered in how to sell domain names.
Registry lock vs registrar lock
Registry lock is a stronger, usually paid, protection applied at the registry through your registrar's staff after out-of-band verification, and it cannot be removed from a web panel even by someone who has your login. It shows as server-level statuses such as serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited.
It suits high-value or frequently targeted names, such as a bank, a large e-commerce brand or a government-facing service, where even a short hijack would be costly. For most businesses, the free registrar lock plus two-factor login and a monitored registrant email is enough. Registration options are on domain registration India.
Frequently asked questions
Should registrar lock be on or off?
On, almost always. Turn it off only for the hours or days a transfer you started is in progress, then confirm it is back on at the new registrar. An unlocked domain can be moved by anyone holding its authorisation code.
Does registrar lock affect my website or email?
No. The lock only blocks transfers between registrars. Your website, email, DNS records and renewals work exactly the same with the lock on, so there is no performance or availability reason to switch it off.
Why does my domain still show locked after I unlocked it?
WHOIS and RDAP results can be cached for a short time, so recheck after a few minutes. If serverTransferProhibited is shown, the registry, not your registrar, is blocking the move, often because of a registry lock, a dispute or a recent transfer.
Can I lock a domain that is about to expire?
You can, but the lock does not stop expiry. Renew the domain first; an expired name can be deleted and registered by someone else regardless of its lock status. Renewal timelines are in the domain renewal guide.
Transfer rules checked against the ICANN Transfer Policy and EPP status code definitions on 14 November 2026 · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.