Registrar lock is a flag on your domain that refuses transfer requests. It is enabled by default on most domains, and it is the single most effective protection against a domain being stolen, because a stolen domain is usually taken by transferring it away, not by breaking into your website.
What it actually prevents
Domain theft follows a predictable pattern. Someone gains access to the email address on the WHOIS record, or to the registrar account, and initiates a transfer to a registrar under their control. Once the domain has moved, recovering it is slow, expensive, and sometimes impossible.
The lock breaks that chain. Even with account access, a transfer cannot start until the lock is removed, which is an extra deliberate step, and one more chance for a notification to reach you.
It is not comprehensive. Someone with full control of your registrar account can unlock it themselves. It stops the fast, automated version of the attack, which is the version that actually happens.
Checking and changing it
In the client area, open your domain's settings and look for Registrar Lock or Transfer Lock. It should be on.
You can also confirm it from outside with a WHOIS lookup. The status field shows something like:
clientTransferProhibited
That is the lock. Its absence means the domain can be transferred by anyone who obtains the EPP code.
When to turn it off
Exactly one situation: you are deliberately transferring the domain to another registrar.
Turn it off, complete the transfer, and turn it back on at the new registrar. A transfer will be refused while it is on, and that refusal looks identical to an invalid EPP code, which is why the two get confused. Getting your EPP code goes over doing both at once.
Turn it back on the same day. A domain left unlocked after a transfer is unlocked indefinitely, because nobody remembers to revisit it.
What the lock does not affect
Worth being clear about, because people expect it to block more than it does.
It does not prevent DNS changes. Nameservers and records can be edited normally with the lock on; that is the point, since DNS is routine and transfers are not.
It does not prevent renewal, expiry, or contact detail changes. And it does not protect against losing the domain by simply not renewing it, which is a more common way to lose a domain than theft. Renewing your domain sets out that sequence.
Other statuses you may see
A WHOIS record can show several status values, and they are not all the same thing.
clientTransferProhibited is the registrar lock you control.
clientUpdateProhibited and clientDeleteProhibited block detail changes and deletion. Some registrars offer these as extra protection for high-value domains.
serverTransferProhibited is set by the registry rather than your registrar, often during the first 60 days after registration or a previous transfer. You cannot remove it and neither can your registrar.
That last one explains transfers refused despite everything on your side being correct.
What actually protects a domain
The lock is one layer. Three others matter as much.
Secure the registrar account with a unique password and two-factor authentication. This is the account that controls the lock itself.
Secure the WHOIS contact email. Transfer approvals go there, so whoever controls that mailbox controls the domain. It should have its own strong password and two-factor, and it should not be an address on the domain it protects.
Keep auto-renewal on. More domains are lost to expiry than to theft.
Together those four make a domain genuinely difficult to lose. Any one of them alone is thinner than it feels.
The registry lock, for domains that matter
Ordinary transfer lock is set by you at the registrar and can be removed by anyone with access to that account. That is exactly the account an attacker targets.
A registry lock is applied at the registry itself and can only be lifted through a manual process with the registrar: typically a verified request from named contacts, taking days rather than seconds.
It is slower, it usually costs money, and it is the measure that survives a compromised registrar login. For a domain a business depends on entirely, that trade is worth making; for the rest it is not.
Not every registrar or extension offers it, and it is worth asking rather than assuming. Monitoring DNS and detecting unauthorised changes goes over the detection half for domains where the lock is not available.
Locks do not protect the nameservers
Worth stating plainly because it is the gap people assume is covered.
A transfer lock prevents the domain moving to another registrar. It does nothing about somebody with access to your registrar account changing the nameservers, which redirects the website and the email immediately, without the domain going anywhere.
That is the faster and more damaging attack, and the protections against it are different: two-factor authentication on the account, a monitored contact address, and few people with access.
Some registrars offer a separate lock on DNS changes. Where it exists it is worth enabling for the same domains that justify a registry lock.
Check the lock across every domain, not one
for d in example.com example.net example.org; do printf '%-24s %s\n' "$d" "$(whois "$d" | grep -i 'clientTransferProhibited' | head -1)" done
Locks come off for a transfer and are frequently never put back, and a domain moved by a registry after a registrar failure commonly arrives unlocked.
Checking the whole portfolio once a year takes minutes and finds the ones that quietly lost their protection. Managing a portfolio of domains and renewals explains where that check belongs.
What the lock looks like during a legitimate transfer
When you unlock deliberately, expect the status to take a short time to update at the registry, and expect the authorisation code to be regenerated at that moment on many registrars.
A code obtained before unlocking is therefore frequently invalid, which is one of the commonest reasons a transfer is refused. What to do when a domain transfer fails has the detail.
Relock as soon as the transfer completes. It is a two-minute job that is easy to leave for later and then forget entirely.