How to Protect Your Domain from Hijacking (2026)
Your domain can be stolen without anyone touching your website. Hijackers don’t hack servers — they trick or breach your registrar account, change the nameservers, and point your domain wherever they want. Sometimes they just transfer it away entirely. Here’s the full playbook for making that as hard as possible.
Turn on registrar lock
Every registrar offers a domain lock (sometimes called transfer lock or theft protection). When enabled, your domain can’t be transferred to another registrar even if someone gets hold of your auth code. It’s free, it’s one toggle, and it stops the most common hijack path cold.
The catch: you have to turn it off when you legitimately transfer a domain — then turn it back on at the new registrar. Forget this step and your transfer fails silently, which is the single most common “my transfer isn’t working” support ticket in existence.
Do this now: log into your registrar, go to each domain’s settings, and confirm the lock is on. If you manage many domains, most registrars let you bulk-enable it in one screen.
Consider registry lock for valuable domains
Registrar lock stops transfers initiated through your registrar account. Registry lock goes one level deeper — it sets a lock at the registry itself (Verisign for .com/.net, for example), so no registrar-level action can move or modify the domain without manual verification, usually by phone.
Registry lock is overkill for a personal blog. For a domain your business depends on — the one on your invoices, your storefront, your email — it’s the strongest protection that exists. Not every registrar offers it, and it sometimes costs extra. Ask yours. If they don’t offer it, that’s a data point about how seriously they take security.
Turn on two-factor authentication — everywhere
Your registrar account is the single point of failure for every domain you own. A password alone isn’t enough: credential-stuffing attacks try leaked username/password pairs against registrar logins every day, and domain investors are specifically targeted.
Use an authenticator app (not SMS — SIM-swapping defeats SMS codes, and attackers who want your domain will try). Every major registrar supports TOTP-based 2FA. Store your backup codes somewhere offline.
Then do the same for the email account tied to your registrar. Password resets, transfer approvals, and auth codes all go there. A compromised inbox is a compromised domain portfolio, full stop. If your registrar email is a Gmail you also use for newsletters and random signups, that’s a problem — see the next section.
Use a dedicated email for your registrar
Don’t register domains under the same email you use for newsletters, forums, and free trials. Every one of those services is a potential breach that leaks the address — and once attackers know which email controls your domains, they can target it specifically.
Create one address used only for registrar and DNS accounts. It never appears in breaches tied to other services, never gets phished by “your Netflix subscription expired” lures, and any email it receives that isn’t from your registrar or DNS provider is suspicious by definition.
Use WHOIS privacy
Your domain’s WHOIS record publishes your name, address, email, and phone number unless you enable privacy protection. Hijackers use that data for targeted phishing — “your domain expires tomorrow, click here to renew” emails that harvest your registrar login, or social-engineering calls to support (“hi, I’m locked out of my account…”).
WHOIS privacy replaces your details with the registrar’s proxy info. It’s free at Porkbun, Cloudflare, and Dynadot. If your registrar charges for it in 2026, that’s a red flag about how they treat customers generally. Full explainer: domain privacy explained.
One caveat: during a transfer, some registries reject the move with privacy enabled. Disable it to transfer, then re-enable immediately at the new registrar. Keep the window short — your details are most exposed between registrars.
Enable DNSSEC
DNSSEC cryptographically signs your DNS records so resolvers can verify they haven’t been tampered with. It doesn’t stop someone from changing your nameservers at the registrar — but it does stop attackers from spoofing your DNS responses in transit (cache poisoning, man-in-the-middle on DNS).
Setup: enable DNSSEC at your DNS provider (Cloudflare does it in one click; most registrars’ built-in DNS supports it), then add the DS record at your registrar. It’s a ten-minute job that closes a real attack vector. Not every TLD supports DNSSEC, but .com, .net, .org, and most major ones do.
Separate your providers
Don’t keep your domains, DNS, hosting, and email all with one company. Every consolidation is a single point of failure: one compromised account or one bad corporate decision takes everything down at once.
The October 2026 Namecheap incident is the cautionary tale — a customer’s seized domains took his servers and his company email down simultaneously, because everything was in one place. At minimum, keep your email provider separate from your domain registrar. Ideally, DNS lives somewhere separate too (Cloudflare’s free tier is the obvious choice).
Monitor your domains
Set up monitoring so you hear about changes before your visitors do:
- Expiry alerts. Most registrars email you, but set a calendar reminder too — and renew important domains for 5–10 years. A domain renewed for a decade can’t lapse because you missed one email. It’s the cheapest insurance in this entire guide.
- Nameserver change alerts. An unexpected nameserver change is the signature of a hijack in progress. Some registrars notify you of DNS changes; third-party uptime monitors can watch your records too.
- Watch your inbox. Transfer authorization emails, password reset emails you didn’t request, “your account details changed” notices — treat every one as urgent until proven otherwise.
Harden your account recovery
Attackers who can’t phish your password will try the recovery flow: “I lost my phone, here’s my ID.” Make recovery hard to fake:
- Keep your registrar account’s contact info current — an old phone number on file is a social-engineering opportunity.
- Know your registrar’s recovery process before you need it. Some require notarized documents; some just need email access. You want to discover this on a calm Tuesday, not during an incident.
- Save support’s direct contact info somewhere outside your email — if your email is compromised, you need another way to reach them.
What to do if your domain is hijacked
Act fast — every hour matters, because a transferred domain gets harder to recover the further it moves:
- Contact your registrar immediately. Ask them to lock the domain and revert unauthorized changes. This is where having 2FA and verified identity on file pays off — you need to prove you’re you, fast.
- Secure your email first. Change that password before anything else — the attacker may be intercepting registrar emails, which means every “we’ve secured your account” message goes to them too.
- Check for a transfer in progress. If the domain is mid-transfer to another registrar, the gaining registrar can sometimes halt it. Time matters enormously here.
- File a complaint with ICANN if your registrar is unresponsive. ICANN’s Transfer Complaint process exists for exactly this situation.
- Document everything — screenshots, timestamps, emails, ticket numbers. If it becomes a legal dispute (valuable domains do), the paper trail is everything.
The uncomfortable truth
Everything above protects you from attackers. It doesn’t protect you from your registrar. In October 2026, Namecheap seized and disabled every domain of a 12-year customer over a missed verification email — no hack, no hijacker, just the registrar itself pulling the plug with no human recourse. Read what happened.
Technical locks can’t fix a trust problem. If your registrar has shown it will disable paying customers’ portfolios without appeal, the only real protection is moving somewhere you trust. Security starts with who holds the keys — make sure it’s someone who answers to you.