What is domain locking?

A domain lock is a status flag set at your registrar that blocks any transfer requests from going through. It sits quietly in the background and does nothing visible to your website or your visitors. But the moment someone tries to initiate an unauthorized transfer, the lock stops it cold. No confirmation email to approve, no waiting period to cancel. The request simply gets rejected.

Most registrars apply a domain lock automatically when you register a new domain. The problem is that many domain owners never check whether it is still on. And if it gets turned off by accident, by a team member, or through a compromised account, there is no alert to tell you your domain is now unprotected.

What is a domain lock?

A domain lock is a setting at your registrar that blocks certain actions on your domain. When the lock is active, no one can transfer the domain to another registrar, update the ownership details, or delete the registration. The lock applies at the registry level, which means it does not matter what someone does inside your registrar account. The registry itself will reject the request.

The official name for this setting is "client transfer prohibited." You will also see it called a registrar lock, a transfer lock, or simply domain lock. They all refer to the same core protection. It is one of the most effective and easiest ways to prevent an unauthorized domain transfer, and it costs nothing to enable.

You can read more about what an unauthorized transfer looks like and the damage it causes in the chapter on how to protect your domain from getting hijacked.

What are the different types of domain locks?

There are several lock types, each protecting a different aspect of your domain registration. Your registrar may enable one or more of these depending on the plan you are on.

Client transfer prohibited

This is the most common lock. It prevents your domain from being transferred to a different registrar. When someone submits a transfer request, the registry checks for this lock. If it is present, the transfer is denied. You must remove it before you can move your domain anywhere. This is the lock most people mean when they say "domain lock" or "registrar lock."

Client update prohibited

This lock prevents changes to the domain's registration data. That includes your name, contact information, and nameserver settings. With this lock active, no one can change where your domain points or update the owner details in the registry record, even if they gain access to your registrar account.

Client delete prohibited

This lock stops anyone from deleting the domain registration entirely. Without it, a compromised account could be used to cancel the domain, making it available for someone else to register.

Server transfer prohibited

This lock is set by the registry itself, not by you or your registrar. It is applied during legal disputes, UDRP proceedings, or when the domain is in a restricted status (like a grace period after registration). You cannot remove this lock yourself.

Most registrars enable the client transfer prohibited lock by default. The update and delete locks are available but not always turned on automatically. If your domain is critical to your brand, turning on all three client locks gives you the strongest protection available at the registrar level.

How do you check if your domain is locked?

There are two ways to check your domain's lock status.

The first is inside your registrar account. Log in, open the domain management panel, and look for a setting labeled "domain lock," "transfer lock," or "registrar lock." It is usually a toggle switch. If it shows "on" or "enabled," the lock is active.

The second way is through a WHOIS lookup. Run a lookup on your domain and scroll to the "Domain Status" field. If you see "clientTransferProhibited" listed, your transfer lock is active. You may also see "clientUpdateProhibited" and "clientDeleteProhibited" if those locks are enabled too.

Check this at least once every few months. There is no automatic notification if the lock gets turned off, so a routine check is the only way to catch it early.

How do you unlock a domain?

Unlocking a domain is straightforward. Log into your registrar, go to the domain settings, and turn off the lock. The status change usually takes effect within a few minutes, though some registries take up to 24 hours to reflect it.

There is only one reason to unlock a domain. You are about to transfer it to a different registrar. The receiving registrar cannot pull the domain over while the transfer lock is active. Once the transfer is complete, the new registrar will apply its own lock automatically.

If you are not transferring, keep it locked. There is no performance benefit, no SEO advantage, and no technical reason to leave a domain unlocked.

Should you keep domain locking on?

Yes. Always. Domain locking should be on for every domain you own unless you are actively in the middle of a transfer. The lock adds zero cost, zero maintenance, and zero friction to your daily operations. It does not affect your website, your email, your DNS settings, or your visitors in any way.

The only thing it does is prevent someone from moving, changing, or deleting your domain without your knowledge. That is a trade worth making every single time.

Some brand owners manage dozens of domains across multiple registrars. If that applies to you, make a list and check the lock status on every single one. It takes five minutes and it closes one of the easiest attack paths someone could use against your brand.

What happens if your domain is unlocked and you do not know it?

An unlocked domain is not guaranteed to be stolen. But it removes the first line of defense. If an attacker gains access to your registrar account or intercepts a transfer authorization email, there is nothing stopping them from initiating a transfer immediately.

With the lock on, even a compromised account is not enough. The attacker would need to disable the lock first, which adds an extra step, an extra log entry, and in many cases triggers a confirmation email. That extra layer of friction can be the difference between catching the attempt in time and losing the domain entirely.

Domains without a transfer lock are also more vulnerable to domain hijacking through social engineering. If someone contacts your registrar pretending to be you and your domain is already unlocked, there is one less verification step standing in their way.

What is the difference between a registrar lock and a registry lock?

A registrar lock (also called a client lock) is the standard lock you manage through your registrar's dashboard. It is free, instant, and available on nearly every domain. When you hear "domain lock," this is what most people mean.

A registry lock is a more advanced form of protection offered by some registries and premium registrar plans. Instead of being managed through a web interface, a registry lock requires manual verification by the registry operator before any changes can be made. This usually means a phone call, an identity check, and a waiting period before the lock can be removed.

Registry locks are designed for high-value domains where the standard lock is not considered enough. Banks, large brands, and organizations whose domains are prime targets for hijacking use registry locks as an added layer on top of the registrar lock.

For most brand owners, a registrar lock is sufficient. It blocks the vast majority of unauthorized transfer attempts and costs nothing to maintain. If you own a domain that generates significant revenue or is a known target, a registry lock adds a second level of protection that is much harder to bypass. You can learn more about the broader set of domain security measures in the dedicated chapter.

How does WEMASY handle domain locking?

When you register or connect a domain through WEMASY, the transfer lock is enabled by default. You do not need to search for it in a settings panel or remember to turn it on. It is active from the start.

If you ever need to transfer your domain away from WEMASY, you can disable the lock from your domain settings, request your authorization code, and start the transfer. Once the process is complete, you re-enable the lock at your new registrar. WEMASY's domain management is designed to keep protection on by default so that the secure option is always the easiest one.

For details on what is included in each plan, see the pricing page.

Frequently asked questions