What is Domain Lock and Why Should It Be Active?

Your domain name, which is your identity in the internet world, is the cornerstone of your digital presence. So, how can you protect this most valuable asset of your brand in the digital world against malicious attempts? This is exactly where Domain Lock comes into play.

In this article, we at Nossi have compiled what a domain lock is, what it does, and why it must be managed with great care.

What is Domain Lock?

A domain lock is the most crucial layer of protection that prevents your domain from being transferred to another registrar without your permission or knowledge. When this system—often referred to in international sources as Domain Lock, Registrar Lock, or Transfer Lock—is active, all external transfer requests for your domain are automatically rejected.

The server (hosting) where a website is hosted can be changed at any time, but when you want to change your domain registrar, an official transfer process begins. An "EPP code" (Auth code / Transfer password) is required for this transfer to take place. However, even if your password somehow falls into the hands of others, the transfer process absolutely cannot be initiated as long as the Domain Lock is not disabled. In other words, this lock is the second strongest firewall against theft.

Why Should It Always Be "Locked" (Active)?

In some cases, the phrase "unlocked" can create confusion; what is meant here is that the security mechanism must actually be "active (locked)". The domain lock mechanism should only be temporarily disabled when you consciously intend to move your domain name to another company. It must be locked again immediately after the process is completed.

The main reasons for keeping your domain lock active are:

• Prevents Domain Theft: While the lock is engaged, it is impossible for unauthorized persons to move your site to another registrar.

• Protects Your Social Media and Brand Reputation: The security of your website link in the profiles of your social media accounts like Instagram and X (Twitter) depends directly on the security of your domain. If you lose your domain, your followers could be redirected to a completely different, potentially harmful site.

• Prevents Human Errors: It prevents your domain from slipping through your fingers as a result of accidental approvals or incorrect clicks on your control panel.

What Happens if the Domain Lock is Left Unlocked (Inactive)?

If you leave the transfer lock in the open (passive) state, you single-handedly remove the biggest obstacle preventing malicious actors from seizing your domain name. The only thing an attacker needs at this stage is your EPP code. In scenarios where your email is hacked or your password is leaked, your domain name can be stolen in minutes because Domain Lock, your secondary security shield, is not active. Unless you are planning a transfer, leaving the lock open is unnecessary and poses a massive risk.

Your Digital Assets are Safe with Nossi!

You can easily check your domain lock status by logging into your Nossi customer panel, not just on desktop computers, but even from your mobile devices (e.g., your phone's browser). When performing sensitive operations such as unlocking or locking, you must always ensure that you are connected to a secure internet network and that your Two-Factor Authentication (2FA) system is active on your panel.

As Nossi, our recommendation is to always keep your domain lock in the Active (Locked) position unless you have an impending transfer plan. Remember, you should only share your EPP (Transfer) code with the authorized companies you will transfer to, and never share it with third parties—even people you trust—via messaging apps or emails.

Do not leave your digital investments to chance; keep your locks solid and your mind at peace!