Turn on the registrar transfer lock
Why it matters
Without a transfer lock, a domain can be moved to another registrar if an attacker gets into your account or tricks support. The lock blocks transfers until you remove it yourself.
The fix
- Log in to the registrar and open the domain's security or transfer settings. Look for domain lock, transfer lock or registrar lock and switch it on. It sets the clientTransferProhibited status.
- Protect the registrar account as well, with a unique password and two-factor authentication, because the lock is only as strong as the account.
- When you really want to move the domain, unlock it first and then request the transfer code. Lock it again afterwards.
- For high-value domains ask the registrar about a registry lock, which sets serverTransferProhibited and needs manual confirmation for changes.
- Confirm the status in a whois lookup.
bash
# no whois command? Look the domain up at https://lookup.icann.org/ instead whois example.com | grep -i "transfer"
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.