How do I protect my domain from being stolen?
Secure your registrar account
Your domain is only as safe as your registrar account. Use a long, unique password and enable two-factor authentication (2FA) with an app or hardware key. Avoid SMS 2FA if possible, as it's vulnerable to SIM-swap attacks.
Also, use a dedicated email address for your registrar account that isn't publicly known. That email should itself have a strong password and 2FA.
Enable registrar lock and privacy
Most registrars offer a 'registrar lock' or 'transfer lock' that prevents unauthorized transfers. Make sure it's on. WHOIS privacy also helps by hiding your contact info, making it harder for attackers to social-engineer your registrar.
Keep your WHOIS contact email up to date—if it's outdated, you might miss transfer approval emails, which could be a sign of an attempted theft.
- Turn on registrar lock (also called clientTransferProhibited).
- Enable WHOIS privacy to hide personal data.
- Use a unique email for domain management.
- Set up 2FA on your registrar account.
Monitor and respond
Regularly check your domain's WHOIS record to ensure your contact info hasn't changed. Set a calendar reminder to review before renewal. If you see unauthorized changes, contact your registrar immediately.
If your domain is stolen, act fast: contact your registrar and ICANN (if applicable). Having documentation of ownership (like receipts) helps. Prevention is far easier than recovery.
Common mistakes
- Using the same password across sites—if one is breached, your domain account is at risk.
- Ignoring renewal emails—an expired domain can be snatched up by others.
- Not enabling registrar lock—without it, a thief with your auth code can transfer your domain.