Academy › Publishing › Domain and email
The lock that stops anyone from taking it without your say-so
Turn on the transfer lock for your domain, and know that only you decide the day it comes off.
By Yodai · Published September 6, 2026 · Updated October 12, 2026
You can have a password you never reuse anywhere else, a recovery email that isn't on the domain itself, and a second step that your app asks for instead of a text message. Even so, someone could still move your domain to another registrar without touching any of those three things.
Here's how it happens: someone gets partial access to your account, or talks the registrar's support team into handing over what they need, and requests the transfer. If the domain doesn't have the transfer lock on, the registry processes the request. Your registrar is supposed to email you to confirm or reject it, but if that email goes to an inbox you don't check, or one the attacker already controls, the transfer gets approved on its own in a few days.
And it's not just the website. If that domain also runs your business email, and you use that email to log in to your WhatsApp Business, your payment processor, and everything else, it all depends on that one thing. The day the domain changes hands, everything tied to it changes at the same time.
What this lock stops, and what it doesn't touch
The transfer lock isn't a password or a two-factor step. It's a status attached to the domain itself, at the central registry, not in your user account. On the technical record it's called clientTransferProhibited, and while it's active, any transfer request to another registrar gets rejected before anyone even asks for a code.
The standard transfer process gives the domain owner five days to confirm or cancel the change before it becomes final. The lock doesn't replace that window; it makes it unnecessary: if the lock is in place, the request never even enters that five-day window. It gets rejected at the first step, before any confirmation email reaches you.
Don't confuse this with what your password does protect. With the lock in place, you can still log into the panel, change name servers, renew, and edit records. The lock doesn't stop any of that. It stops exactly one thing: the domain changing registrars.
With the lock on, the transfer gets rejected right away. Without it, your only chance is to reject it in time when the notice arrives.
How to turn it on
You turn it on from your registrar's panel, the company where you bought the domain, not from the tool you use to build your site: the domain lives wherever you bought it, no matter what. The exact name of the setting varies from one registrar to another, but the goal is always the same status.
- 1Log in to your registrar's dashboard
Use your account, ideally one whose recovery email isn't on the domain itself. - 2Find your domain's settings page
It's usually under "Domains" or "My Domains," and from there, under the "Status" or "Security" tab. - 3Turn on "Transfer Lock" or "Domain Lock"
It's the same setting even if your registrar calls it something else: the effect is clientTransferProhibited. - 4Check the status with a WHOIS lookup
If clientTransferProhibited shows up on the public record, the lock is really in place, not just checked off in your dashboard.
The day you actually want to move it
There will come a day when you do want to switch registrars: over price, over support, because you're selling the business. When that day comes, you go into that same dashboard, turn off the lock, request the authorization code, the auth code or EPP code, and hand it to the new registrar.
The lock and the auth code work together, not separately. The code confirms that you're the one requesting the transfer; the lock stops anyone else from using it without your say-so. You turn one off to use the other, and as soon as the transfer is confirmed or canceled, you turn the lock back on for the domain that stays with you.
- It usually comes free with the domain, though not every extension supports it: check with your registrar
- You can turn it on and off yourself, right from your registrar's dashboard, in one click
- Some registrars offer it as an add-on, sometimes for a fee
- To remove it, your registrar has to request it from the central registry, with a manual check outside the dashboard, like a phone call with a real person
- It can't be bypassed even if both your password and your two-factor step are compromised
- It takes longer to handle on the day you actually do want to move it
Which one should you pick? For most businesses, the standard lock, turned on and checked every so often, is enough. If your whole billing system runs through that domain and losing it for even a day would cost you dearly, pay for registry lock: the extra phone call is the price of making sure not even your own hacked account can take it away.
- The transfer lock is turned on for the domain, not just for the account
- You know it only comes off the day you decide to move the domain, and goes back on right after
- You've checked with a WHOIS lookup that clientTransferProhibited actually shows up on the public record
- You know when it's worth paying for the registry lock instead of settling for the standard one
Three scenarios
Answer before opening each one. If one gives you trouble, go back to the section that explains it.
1. You're selling the business and the buyer asks for the domain's authorization code this afternoon. What do you do first?
You go into your registrar's dashboard and turn off the transfer lock before requesting the auth code. If you generate the code while the lock is still on, the transfer will get rejected anyway as soon as the buyer tries it, and you'll have wasted the afternoon for nothing.
2. You get an email that looks like it's from your registrar, asking you to confirm your details through a link, and without realizing it, you enter your password on that link. Does having the transfer lock on protect you at all?
Not much, as long as your password is all they need to log in: from your account, they can remove the lock just as easily as you can, in one click. What protects you is the second step through your app, since without it they can't get in, and registry lock, which can't be removed from the account. Change your password the moment you notice anything, check that the lock is still on, and watch your email for any transfer notice you need to reject.
3. You're switching registrars because your current one just jacked up the price, and you haven't logged in to touch anything about the domain in two years. What do you check before requesting the transfer?
That the lock is still in place, so you know no one's touched it while you weren't looking, and that the recovery email on that registrar account is still yours and not one you no longer use. Without that, the auth code you request could end up in an inbox you no longer control.
With the transfer lock active, the technical safeguard is complete. But there's one door no dashboard setting can close: the one you open yourself when you think you're responding to your registrar, but you're actually responding to whoever wants to steal it from you.
In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.
NextVerify in the panel, never through the link in the email