--- title: How to keep your domain name from being stolen description: Domain hijacking usually starts at the registrar, not the server. Here is how to lock your domain, protect the account email and stay on top of renewals. date: 2026-08-31 updated: 2026-09-01 tags: [security monday, domains, dns] url: "https://drivenhost.com/blog/keep-your-domain-from-being-stolen" author: DrivenHost --- Losing a website is a bad day. Losing the domain name is worse. The site, the email, and every password reset that lands in that email all follow whoever controls the domain. When we see this go wrong, it is almost never something clever aimed at the server. Somebody got into the registrar account, or nobody was watching it at all. Here is what we would check on your own domains this week. ## Your domain and your hosting are two different accounts Plenty of owners assume the domain lives in the same place as the website. Often it does not. The hosting account runs the site and the mailboxes. The registrar account decides where the domain points and who owns it, and control of that account beats everything else you have set up. Change the nameservers and the site moves, no server access required. So the first job is boring paperwork. Find out which registrar the domain sits with, who has the login, and which email address is on file. If the answer is "our old developer set it up", that is the security problem, not a filing problem. A Whois lookup on your domain will tell you the registrar and the current status codes even if the account details are lost. Once you know where the domain lives, you can check how it is [pointed at your hosting](/blog/kb-point-domain-nameservers). ## Turn the transfer lock on, then verify it Registrars can set status codes at the registry that reject changes outright. The ones worth asking about are clientTransferProhibited, which refuses transfer requests to another registrar, clientDeleteProhibited, which refuses deletion, and clientUpdateProhibited, which refuses updates. ICANN documents all three, and you can confirm they are active with a Whois lookup rather than taking anyone's word for it. Most registrars turn transfer lock on by default now. Most is not all, and the lock sometimes comes off during other work and never goes back on. Check it, note the date you checked, and check again after anyone touches the domain. There is a second layer for domains you cannot afford to lose. For .ca names, CIRA sells a Registry Lock through certified registrars, billed annually, where changes have to be coordinated with both the registrar and CIRA before the registry will accept them. It is deliberately slow. That is the point. Similar registry-level locks exist for some other extensions, so ask your registrar what is available for yours. One more thing worth knowing: ICANN's transfer policy applies a 60 day lock after a change of registrant, and another after a transfer. If an attacker does get in and changes the owner details, that window is often what buys you time to get the domain back. ## Guard the email address on the registrar account Registrar security comes down to the mailbox that can reset the password. Transfer approval notices, owner-change confirmations, and expiry warnings all arrive there. Two habits help. Turn on two-factor authentication at the registrar, since a leaked password on its own then gets nobody anywhere. And think hard about which address you use for the account. If the registrar contact email is a mailbox hosted on the same domain, losing the domain also loses your ability to prove you own it and to receive the recovery mail. A separate address, on a different domain or a personal account you control, breaks that circle. If you want the professional-looking option for day to day mail while keeping recovery elsewhere, our [business email](/email) is set up for exactly that split. ## Watch the expiry date A surprising share of "our domain was stolen" turns out to be a domain that quietly expired. The card on file lapsed, the notices went to an address nobody reads any more, and someone registered the name the moment it dropped. Put the expiry date in a calendar you actually look at. Keep auto-renew on, and keep the payment method current. Then treat renewal mail with suspicion, because domain renewal scams are old and still effective, arriving by email and sometimes by post, dressed up as an invoice with a real due date on it. Never renew through a link in a message. Log in to the registrar yourself and check the date there. ## Keep the list of people who can change things short Developers, agencies, and the friend who helped with the site five years ago tend to accumulate access. Every extra login is another way in, and shared logins mean nobody can tell you who made a change. When someone leaves the project, remove their access and rotate the password that day. The same discipline applies to your [hosting account security](/blog/hosting-account-security): fewer logins, each one tied to a real person, each one with two-factor turned on. Ten minutes on a Monday covers most of this. Check the lock, check the contact email, check the expiry date, and write down where the domain lives so the next person does not have to guess. If you are not sure where your domain is registered or what the status codes on it mean, [open a ticket with our support team](/support) and we will look at it with you. ## Sources - [ICANN: EPP status codes](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en) - [ICANN: Transfer Policy](https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en) - [CIRA: Registry Lock](https://www.cira.ca/en/ca-domains/register-your-ca/registry-lock/)