Cybersecurity glossary
What is Registrar Lock?
Learn what registrar lock is, which domain changes it helps block, how it reduces unauthorized transfers, and why it should be paired with stronger account security controls.
Definition
Registrar lock is a registrar-managed protection state, commonly implemented through EPP status codes such as clientTransferProhibited, that helps prevent unauthorized domain transfers or updates unless the lock is removed first.
Why registrar lock matters
A registrar lock is one of the simplest controls that raises the cost of domain hijacking. It tells the registrar not to process sensitive changes such as transfers unless an authorized operator deliberately unlocks the domain first. That sounds basic, but domain theft often begins with weak change control. When a domain can move or be modified with a few clicks, attackers who phish registrar credentials or exploit sloppy support processes gain a straight path to traffic redirection, email interception, and certificate abuse.
What registrar lock actually protects
EPP status control
The lock is usually represented by registrar-managed EPP statuses such as `clientTransferProhibited` and related update protections.
Transfer friction
A locked domain cannot be transferred away casually, which blocks a common path used in registration takeovers.
Intentional unlock step
Legitimate owners must take an explicit action before a move or change can proceed, which creates a review checkpoint.
Account-dependent security
The value of the lock still depends on how well the registrar account, recovery channels, and support workflows are protected.
How registrar lock works in practice
The owner enables the lock
A security-conscious operator turns on the registrar lock for important domains after registration or transfer-in.
The registrar applies status values
The registrar sets EPP statuses that tell downstream transfer workflows the domain should not move or change normally.
A transfer or update request arrives
If someone tries to move the domain or make a blocked modification, the request runs into the lock state.
The change is denied until unlock
The registrar refuses the protected action unless an authorized user first removes the lock through the proper workflow.
Legitimate changes use a controlled window
Operators temporarily unlock the domain for a planned change, verify the action, and complete the request.
The domain is relocked after the change
Once the maintenance window closes, the operator restores the lock so the domain returns to a safer steady state.
Common lock-related states to understand
The exact labels vary, but EPP-style lock statuses usually map to a few predictable control patterns.
| Element | What it means | Why it matters |
|---|---|---|
| Transfer prohibition | The domain should not be moved to another registrar while the lock is active. | This is the control most people mean when they say “registrar lock,” and it directly reduces unauthorized transfer risk. |
| Update prohibition | Certain registration changes may be blocked until an operator removes the protective status. | This reduces the chance of quiet edits to nameservers or ownership data slipping through without review. |
| Delete prohibition | A protected domain cannot be removed through routine workflows while the status is present. | Accidental or malicious deletion of a critical production domain can be just as damaging as theft. |
| Account-compromise limitation | If an attacker fully controls the registrar account, they may be able to remove the lock first. | That is why [registry lock](/glossary/registry-lock), phishing-resistant MFA, and tight recovery controls matter too. |
Good operating habits around registrar lock
The lock works best when it is part of a larger domain-control process rather than a forgotten checkbox.
- Enable registrar lock on every production, mail, SSO, and customer-facing domain unless an active project truly requires it off.
- Protect the registrar account with phishing-resistant MFA, unique passwords, and minimal admin membership.
- Restrict who can unlock domains and document the business reason each time the control is removed.
- Monitor registration status, nameserver changes, and WHOIS or RDAP updates so unexpected activity is noticed quickly.
- Separate billing contacts from security approvals where possible so routine renewals do not weaken change control.
- Keep recovery email inboxes and support PINs under the same tier-zero discipline as production admin accounts.
- Pair registrar lock with [registry lock](/glossary/registry-lock) for your highest-value names rather than assuming one layer is enough.
- Re-lock domains immediately after a legitimate transfer, DNS move, or registrar maintenance task completes.
The limit of registrar-side protection
Registrar lock is valuable because it adds friction to unauthorized change, but it is still a registrar-side control. If the attacker owns the registrar login, social-engineers support, or abuses weak recovery channels, they may be able to remove the lock before carrying out the theft. That is why mature teams treat registrar lock as the baseline, not the finish line. For crown-jewel domains, registry lock, out-of-band approval, and continuous monitoring are what turn a helpful guardrail into a resilient operating model.
The practical takeaway
A registrar lock helps stop unauthorized domain transfers and some registration changes by forcing a deliberate unlock step first. Use it everywhere, but do not mistake it for complete protection. Strong account security, careful unlock procedures, and stronger registry-side controls are what keep a lock from becoming security theater.
Related security terms
Registry Lock
A stronger, registry-side control that adds manual verification beyond standard registrar locks.
Domain Hijacking
Registrar lock is one of the safeguards used to reduce unauthorized domain theft.
WHOIS
Registration data and status changes often surface through WHOIS or registration-data monitoring.
Domain Name System (DNS)
Domain transfer protection matters because DNS delegation changes can redirect all traffic for a name.
Top-Level Domain (TLD)
Lock behavior and transfer processes are defined within the registrar and registry rules for a TLD.
Frequently asked questions
What is registrar lock in simple terms?
It is a setting at your registrar that helps stop someone from transferring or changing your domain without first removing the lock.
Is registrar lock the same as registry lock?
No. Registrar lock is usually a client-side EPP status at the registrar, while registry lock adds stricter registry-level review and manual approval.
Does registrar lock stop all domain hijacking?
No. It lowers risk, but an attacker who compromises the registrar account may still remove the lock if stronger controls are absent.
What changes can registrar lock affect?
It commonly blocks transfers and may also restrict updates or deletion depending on which EPP status values the registrar applies.
Should every business domain use registrar lock?
Yes for ordinary protection, especially on customer-facing and mail domains. High-value assets should usually go further with registry lock as well.
Can you still move a domain when it is locked?
Yes. The domain owner can temporarily remove the lock through the registrar workflow, complete the legitimate change, and then re-enable it.
References
Explore authoritative guidance and frameworks related to registrar lock.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.