How to Protect Your Domain

Good to Know:

This page does not list prices. Registration and renewal prices change, so the search result and the checkout page show the current price for the name you choose. Nothing here is a quote or an offer.

A domain is an account asset before it is a website address. If someone else controls the account, the site, the email and the brand can move without your permission. Protecting the account is the first job.

The short answer

Keep the registrar lock on, enable two-factor authentication, use a registrant email the business controls, and make sure auto-renew has a payment method that will still work next year.

Then make sure more than one trusted person can get into the account. A domain that only one person can recover is a domain with a single point of failure.

Use the registrar lock

A registrar or transfer lock prevents the domain from being moved to another registrar without it being unlocked first. It is the simplest protection against an unauthorised transfer.

Turn it on for every domain you are not actively transferring.
Unlock only for the transfer window, then turn it back on.
A lock does not prevent changes inside the account, so it is not a substitute for account security.
Check the lock after a renewal or a support interaction.

Secure the account

Use a unique password. A password manager is better than a reused one.
Enable two-factor authentication. Use an authenticator app or a security key where available.
Limit account users. Remove access for people who no longer need it.
Review active sessions. Sign out of devices you do not recognise.
Watch for phishing. No legitimate support agent needs your password or an authorisation code outside a transfer you started.
Keep recovery details current. An old phone number can lock you out of your own account.

Keep the registrant email current

The registrant email is the recovery channel. Transfer approvals, renewal notices and security alerts go there. If it is an old personal inbox, the domain is exposed.

Use a role address such as domains@ on a domain the business controls.
Make sure at least two people can receive mail at that address.
Test the address after a change and after a transfer.
If privacy is enabled, confirm the forwarding address works.
Do not use the domain itself as the only contact if the domain is the thing at risk.

Protect the renewal

Turn on auto-renew and confirm it after every renewal cycle.
Keep a backup payment method on file.
Put the date in a shared calendar with reminders 60, 30 and 7 days out.
Send renewal notices to a role address, not one person's inbox.
Review the domain list once a year and remove names you no longer need.
Consolidate domains in one account so a renewal cannot hide in an old inbox.

Privacy is not security

Domain privacy hides contact details in the public WHOIS record. It does not stop someone from logging into your account, transferring the domain or changing the nameservers.

Control	What it protects
Domain privacy	Public contact details
Registrar lock	Unauthorised transfers
Two-factor authentication	Account sign-in
Current registrant email	Recovery and approvals
Auto-renew with backup payment	Expiration
Limited account users	Insider and credential risk

Use all of them. Each one covers a different failure.

If you lose access

Contact the registrar's support team immediately and explain that the account or domain is compromised.
Be ready to prove ownership: the account email, purchase receipt, registrant details and identification.
Change the password and enable two-factor authentication on any related email account.
Check the nameservers and DNS records for unauthorised changes.
Check whether a transfer is pending and ask support to lock the domain.
Notify customers if the site or email was used to send fraudulent messages.
Keep a record of every support ticket and timestamp.

Do not pay a ransom or send an authorisation code to anyone who contacts you first. Legitimate support will not ask for it outside a transfer you initiated.

The protection checklist

Registrar lock on.
Two-factor authentication enabled.
Unique password in a password manager.
Registrant email is a business role address.
At least two trusted people can access the account.
Auto-renew on with a backup payment method.
Renewal date in a shared calendar.
Privacy setting confirmed where available.
DNS changes monitored.
Account access reviewed after staff changes.

Frequently asked questions

How do domains actually get stolen?

Most cases start with a weak or reused password, a phishing email, an outdated registrant address or a compromised email account. The attacker then changes the contact details or starts a transfer.

Does domain privacy protect my domain from being stolen?

No. Privacy hides public contact details. It does not protect the account, the transfer lock or the sign-in. Use it alongside account security, not instead of it.

Is two-factor authentication necessary?

Yes. It is the single most effective protection against a stolen password. Use an authenticator app or a security key where available.

What if I lose access to the registrant email?

Contact the registrar immediately. Recovery usually requires proof of ownership, such as the purchase receipt, account details and identification. Update the email as soon as access is restored.

Can a stolen domain be recovered?

It can sometimes be recovered, but the process is slow and depends on evidence and timing. Act immediately, keep records and involve the registrar's support team.

Who should have access to the domain account?

At least two trusted people, so one person's departure or absence does not block a renewal or a recovery. Remove access promptly when roles change.

Does a registrar lock stop every change?

No. It blocks transfers to another registrar. It does not stop changes to DNS, contacts or nameservers inside the account, which is why account security matters too.

How often should I review domain security?

Once a year, after any staff change and after a renewal or transfer. A short review is enough if the settings are already in place.

General information:

A guide, not a guarantee. This page is general information to help you compare options. It is not legal, financial or tax advice, and it is not a promise that a name is available, that a price will hold, or that a registry rule will stay the same. Confirm current details in the search tool before you register.

Last reviewed: 2026-10-19. This page describes current practice and general information. Prices and registry policies can change.