Protecting your domain from being stolen

A domain is usually the single most valuable thing a small business owns online. Losing it means losing your email, your site and years of search ranking at once.

The five settings that matter

1. Registrar lock (transfer lock). Keep it ON. It blocks any transfer request until you deliberately turn it off. Find it under Dashboard → My Domains → Manage → Settings.
2. WHOIS privacy. Hides your phone number and address from scrapers, which cuts down on the fake "your domain is expiring" letters.
3. Two-factor authentication on your account here. Set it up under Dashboard → Profile → Security. A stolen password alone then gets nobody anywhere.
4. A registrant email you actually control. Never use an address at the domain itself — if the domain lapses you lose the mailbox you need to recover it. Use a Gmail or another separate address.
5. Auto-renew ON, with a card or wallet that has not expired. Most "stolen" domains were simply not renewed.

Warning signs of a hijack attempt

• An EPP/authorisation code email you did not request.
• A transfer confirmation for a domain you are not moving.
• A password reset email at 3am.

If any of these arrive, do not click the links. Log in directly and check Dashboard → Notifications, then open a ticket.

If the worst happens

Contact us immediately. A transfer takes 5 days to complete and can be cancelled from the losing registrar's side during that window. Speed matters more than anything else.