How do I stop my domain from being stolen?
The short answer
Turn on two-factor authentication at your registrar, keep the domain’s transfer lock switched on, keep the account’s email address current and on an address you control, and don’t share the login. For a domain your business couldn’t survive without, ask your registrar about a registry lock.
Domains are usually stolen by getting into the registrar account, through a reused password, a phishing email or an old email address someone else now controls. Whoever controls the account can move the domain or change where it points.
- Two-factor authentication on the registrar account, and on the email account it uses.
- Transfer lock (often called “registrar lock”) switched on. It stops the domain being moved to another registrar until you unlock it.
- A current account email on a domain you control, not a former employee’s address.
- Your own account, not one belonging to your web designer.
- Registry lock, offered by some registrars for some domain endings, adds a manual check before any change.
Words used here
- Two-factor authentication (2FA)
- A second check when you log in — usually a code from your phone. It stops most account takeovers. Turn it on for every provider.
- Domain registrar
- The company you buy (rent) your website name from — e.g. Namecheap, Cloudflare, Porkbun or GoDaddy.
- Domain
- Your website’s name, like mycoolstartup.com. You rent it year by year from a domain registrar.
Still have a question?
Ask the SlopDox assistant: it answers from this catalog, any time. Or let SlopDox keep track of your websites for you, free for up to 3 websites.