How to protect your domain from theft and hijacking
How domains get stolen through phishing, email takeover and SIM swapping, a lock-down checklist with two-factor login, registrar and registry locks, and what to do if your domain is stolen.
Your domain controls your website, your email and, through password resets, many of your other accounts. If someone steals it, they can take over much of your online life. Here's how domain theft happens and how to make your names very hard to steal.
How domains get stolen
- Phishing: fake "your domain is expiring" or "verify your account" emails that steal your registrar login.
- Reused passwords leaked from another website.
- Email takeover: if someone gets into the email account on file, they can reset your registrar password.
- SIM swapping: tricking your phone company into moving your number to steal text-message codes.
- Social engineering: convincing registrar support to change account details.
- Letting it expire: the easiest "theft" of all.
Lock it down: the checklist
- Use a unique, strong password for your registrar, stored in a password manager.
- Turn on two-factor login, ideally with an authenticator app or a security key rather than text messages.
- Secure the email account on the domain with its own strong password and two-factor login.
- Don't use an email address on the same domain as your registrar contact. If the domain breaks, you lose access.
- Keep the registrar lock (transfer lock) on.
- Turn on auto-renew.
- For very valuable domains, ask about registry lock, which requires manual verification before any change.
- Never share auth codes or login codes, even with "support".
Warning signs
- Unexpected emails about transfers, password changes or new logins.
- Your website or email suddenly stops working.
- Your WHOIS record shows a different registrar.
If your domain is stolen
- Contact your registrar immediately, explain it's a hijacking, and ask them to freeze the domain.
- Secure your email and change all related passwords.
- Gather proof: invoices, account history, old WHOIS records.
- Ask the registrars to work together to reverse an unauthorized transfer. There are formal dispute processes for transfers.
- Consider legal help for valuable domains.
The most famous domain theft in history is the Sex.com case. Read it in famous domain disputes and stories.
Questions
Can someone steal my domain?
Yes, usually through a stolen registrar login, a hacked email account or social engineering. Two-factor login, a transfer lock and a secure email account prevent most thefts.
What is registry lock?
An extra security service for valuable domains that requires manual verification by the registry before changes can be made.