How to keep your domain safe from hijacking and accidental loss
Losing a domain can take down your website and email, and with them, your business's online presence. Domains are usually lost in one of two ways: an expired renewal, or someone gaining access to the account that controls them. Both are largely preventable.
Secure the registrar account
The account at your registrar is the key to your domain. Anyone who can log in can change where it points or transfer it away.
- Turn on two-factor authentication. This is the single most effective step. Use an authenticator app or a security key rather than text messages if your registrar supports it.
- Use a strong, unique password, stored in a password manager, and not reused anywhere else.
- Limit who has access. If staff or contractors need access, use your registrar's team or delegate features rather than sharing your login, and remove access when it's no longer needed.
Protect the email behind the account
Your registrar account is only as secure as the email address that can reset its password.
- Secure that mailbox with two-factor authentication too.
- Don't use an address on the same domain as the only contact for your registrar account. If the domain stops working, so does your ability to receive the registrar's warnings and password resets. Use a separate address as a backup.
Lock the domain
- Registrar lock, also called transfer lock, prevents the domain from being transferred to another registrar until you unlock it. Keep it on except when you're deliberately transferring.
- Registry lock is a stronger protection offered for some extensions, often as a paid service. Changes require manual verification with the registrar, which makes hijacking much harder. It's worth considering for domains your business depends on.
Never let it expire by accident
- Turn on auto-renew.
- Keep the payment method on file up to date.
- Renew important domains for several years at a time.
- Add your own calendar reminder before the expiry date.
Watch out for phishing
Scammers send emails that look like they're from your registrar, often warning that your domain is about to expire or has a problem, with a link to "log in and fix it." The link leads to a fake login page.
- Don't click links in unexpected emails about your domain. Go to your registrar's website directly by typing the address.
- Be wary of "renewal notices" from companies you don't use. Some are invoices for unnecessary services; others are phishing.
Keep an eye on changes
- Enable alerts for changes to your domain's settings, if your registrar offers them.
- Check your domain's DNS records now and then, to make sure nothing has changed unexpectedly.
- Review who has access to your account once a year.
Keep records
Keep receipts, transfer confirmations and any purchase agreements. If you ever need to prove ownership in a dispute or recovery, documentation helps.
If something goes wrong
If you suspect your account has been accessed by someone else, or your domain's settings have changed without your knowledge:
- Contact your registrar's support immediately.
- Change your passwords, starting with the email account linked to the registrar.
- Ask the registrar to lock the domain and investigate.
Acting quickly gives you the best chance of recovering a hijacked domain.
A five-minute checklist
- Two-factor authentication on: yes or no?
- Registrar lock on?
- Auto-renew on, with a valid card?
- Backup email that isn't on the domain itself?
- Expiry date in your calendar?
If you can answer yes to all five, your domain is in good shape. And if it's a name you no longer need, rather than letting it lapse, you could list it for sale.