Domain Hijacking: How It Happens and the Exact Steps to Lock Your Domain Down

Your domain name is the single most important asset in your online presence. It is your brand, your email address, your search rankings, and your customer trust, all anchored to one piece of infrastructure.

Domain hijacking is when someone gains unauthorised control of that infrastructure. Once it happens, your website can be taken offline, redirected to malicious content, or held for ransom. Your email can be intercepted. Your customers can be deceived.

It is more common than most domain owners realise, and most of it is entirely preventable with the right setup.

What Domain Hijacking Actually Is

Domain hijacking happens when an attacker gains access to your domain registrar account and transfers ownership or control of your domain without your authorisation.

This is different from someone registering a similar domain name (a separate issue covered in domain name disputes). Hijacking means your actual domain, the one you own and pay for, is taken or controlled by someone else.

Once an attacker controls your domain, they can:

• Point it to a different server (redirecting your visitors to malicious content)
• Transfer it to a different registrar (making recovery harder)
• Lock you out of the registrar account entirely
• Change your DNS records to intercept your email
• Hold the domain for ransom

Recovery is possible but slow, expensive, and not guaranteed to succeed quickly. The standard advice applies here: prevention is significantly better than recovery.

How Domain Hijacking Happens

Understanding the attack methods helps you close the right gaps.

Email Account Compromise

This is the most common path to domain hijacking and the most overlooked.

Your registrar account is only as secure as the email address attached to it. If an attacker gains access to your email, they can request a password reset for your registrar account. With the password reset link delivered to the compromised inbox, they are in your registrar account within minutes.

This is why using a dedicated email address for your registrar, one that is not published anywhere, never used for newsletters or sign-ups, and not guessable from your domain name, is one of the most effective security measures available.

Registrar Account Compromise

Weak passwords, reused passwords, or no two-factor authentication on your registrar account creates a direct opening.

If your registrar password is the same as any other account you use, and that other account is ever compromised in a data breach, your registrar account is potentially compromised too. Credential stuffing attacks (trying known leaked email and password combinations against registrar login pages) are automated and run continuously.

Phishing Attacks

Attackers send convincing emails that appear to come from your registrar. The email warns of an account issue, an expiring domain, or a security alert. It links to a fake registrar login page. You enter your credentials and the attacker captures them.

These emails can be highly convincing. They use the real registrar’s branding, reference your actual domain name, and create urgency. The only reliable defence is never clicking login links from emails. Always navigate to your registrar directly by typing the URL.

Social Engineering via Registrar Support

Some attackers target registrar customer support directly. They call, pretending to be the domain owner, and attempt to convince support staff to make account changes.

Good registrars have robust identity verification processes that prevent this. Less careful registrars have been successfully social engineered. Choosing a registrar with strong identity verification practices is part of domain security.

Expired Domain

Technically different from hijacking, but the result is the same. A domain that lapses through missed renewal is available for anyone to register. High-value or recognisable domains are sometimes purchased immediately by domain investors or bad actors when they expire.

Enabling auto-renewal and keeping your payment method current at your registrar prevents this entirely.

DNS Hijacking (Related but Different)

DNS hijacking does not transfer ownership of your domain but changes where it points. An attacker who gains access to your DNS management can redirect your website and email without changing the registrar account details.

This is addressed by the same measures that prevent registrar account compromise: strong authentication and monitoring.

Warning Signs Your Domain May Be at Risk

These are indicators that your current setup is vulnerable.

• Your registrar password is shared with any other account
• You have not enabled two-factor authentication on your registrar account
• Your registrar account email is your primary business email, which is published publicly
• You do not know what your registrar login email address is without checking
• Domain privacy is not enabled, leaving your real contact details in WHOIS
• Auto-renewal is not enabled
• You have not logged into your registrar account in over a year
• Your registrar does not offer two-factor authentication at all

If three or more of these apply to your current setup, the steps below are urgent, not optional.

The Exact Steps to Lock Your Domain Down

Work through these in order. Each step closes a specific attack vector.

Step 1: Secure the Email Address Attached to Your Registrar Account

This is the most important step and the one most people skip.

1. Log into your registrar account
2. Check which email address is registered to the account
3. If it is your primary business email (the one published on your contact page or your website), change it
4. Create a new email address used exclusively for your registrar account. Do not use it for anything else
5. Enable two-factor authentication on that email account, separate from and in addition to 2FA on your registrar

The dedicated email approach means even if your primary business email is compromised, your domain is not at risk. An attacker cannot request a registrar password reset to an email address they do not have.

Step 2: Enable Two-Factor Authentication on Your Registrar Account

1. Log into your registrar account
2. Go to Security Settings or Account Settings
3. Find the two-factor authentication or 2FA option
4. Enable it using an authenticator app (Google Authenticator, Authy, or similar)
5. Save your backup codes in a secure location

Use an authenticator app rather than SMS wherever possible. SMS-based 2FA is better than nothing but can be bypassed through SIM swapping attacks. An authenticator app generates codes locally and cannot be intercepted.

Step 3: Use a Strong, Unique Password

1. Change your registrar account password to one that is at least 16 characters
2. Use a combination of letters, numbers, and symbols
3. Do not reuse this password on any other account, ever
4. Store it in a password manager (1Password, Bitwarden, or similar)

If the idea of managing another unique password feels inconvenient, a password manager solves that entirely. Password managers generate and store strong unique passwords for every account so you never need to remember them.

Step 4: Enable the Registrar Transfer Lock

Every legitimate registrar offers a domain lock setting. It is sometimes called a registrar lock, transfer lock, or domain lock.

1. Log into your registrar account
2. Go to your domain management page
3. Find the lock or transfer settings
4. Confirm the lock is enabled

When a domain is locked, it cannot be transferred to another registrar without explicitly unlocking it first. This means that even if an attacker gains access to your registrar account, they cannot immediately transfer your domain away. The extra step of unlocking it creates a delay during which you may receive alerts and be able to intervene.

Most domains are locked by default. Verify this rather than assuming.

Step 5: Enable Domain Privacy Protection

Domain privacy hides your personal contact information from the WHOIS database. Without it, your name, email, and address are publicly searchable by domain name.

Exposed WHOIS information feeds two specific attack vectors: targeted phishing attacks that use your real details to appear credible, and social engineering attempts against registrar support that use your personal information to impersonate you.

Domain privacy protection covers exactly what it hides and what it does not. Enable it on every domain you own.

1. Log into your registrar account
2. Go to domain management for each domain
3. Find privacy or WHOIS protection settings
4. Enable it

Many registrars include domain privacy free. Others charge a small annual fee. It is always worth enabling.

Step 6: Enable Auto-Renewal and Keep Payment Method Current

1. Log into your registrar account
2. Find auto-renewal settings for each domain
3. Enable auto-renewal
4. Verify the payment method on file is current and will not expire before your next renewal date
5. Set a personal calendar reminder 60 days before your domain renewal date as a backup

An expired domain is not just a registration problem. It is a security problem. Domains that lapse become available to anyone, including attackers who monitor high-value domains waiting for the renewal to fail.

Step 7: Verify Your Contact Information Is Accurate

1. Log into your registrar account
2. Check the name, address, and phone number on file
3. Ensure these are accurate and belong to you
4. If using domain privacy, verify the underlying contact details are still correct

Inaccurate contact information creates problems during domain recovery if an attacker attempts a transfer. It also means renewal notices and security alerts may not reach you.

Step 8: Monitor Your Domain for Unauthorised Changes

Set up monitoring that alerts you immediately if your domain’s DNS records change or if your domain is transferred.

UptimeRobot monitors whether your site is online. A DNS monitoring service like DNSspy or the monitoring built into Cloudflare notifies you when DNS records change.

Some registrars send email alerts when account changes are made. Enable all notification settings in your registrar account if this option exists.

The Registry Lock Option for High-Value Domains

For domains that represent significant business value, a registry lock (also called a server lock or ICANN lock) provides a higher level of protection than a standard registrar lock.

A registry lock requires manual verification by the registrar’s staff before any change can be made to the domain. This is different from the standard domain lock, which a registrar account holder can toggle on and off through the control panel.

With a registry lock active:

• DNS changes require manual verification
• Transfers require manual verification
• Account changes require manual verification
• The lock cannot be removed by normal account access alone

Registry locks are typically available on premium or business registrar accounts. They have a higher administrative overhead because every change requires a manual verification step, which takes more time than self-service changes.

They are appropriate for domains where the business impact of a hijacking would be severe and where the inconvenience of manual verification for changes is acceptable.

What to Do If Your Domain Has Been Hijacked

If you discover that your domain has been transferred without your authorisation or that your DNS records have been changed maliciously, act immediately.

Step 1: Contact your registrar Call their support line immediately. Do not just submit a ticket. Explain that your domain has been hijacked and request an emergency hold to prevent further transfers. Document the time and content of every communication.

Step 2: File an abuse complaint Submit a complaint to your registrar’s abuse team in writing. Include evidence of your original registration (confirmation emails, payment records) and details of the unauthorised change.

Step 3: Contact ICANN ICANN has a complaint process for domain transfer disputes. Filing with ICANN creates a formal record and can initiate a dispute resolution process.

Step 4: Check whether the Registrar Accreditation Agreement applies ICANN’s transfer dispute resolution policy requires registrars to investigate and potentially reverse unauthorised transfers. Reference this policy in your communications with your registrar.

Step 5: Legal action if necessary For high-value domains, domain hijacking may constitute fraud or identity theft depending on your jurisdiction. A legal notice to the current holder or to the receiving registrar can be effective, particularly if the domain is being actively used for fraud.

Recovery is possible but can take days to weeks depending on the registrar, the country involved, and how quickly you acted. The steps above in the locking section, if done in advance, make this scenario far less likely to occur.

Security Checklist for Every Domain You Own

Apply this checklist to every domain you own, not just your primary domain. Attackers sometimes target less-guarded secondary domains to establish a foothold or to use in phishing campaigns associated with your brand.

Final Thoughts

Domain hijacking is largely a problem of neglect rather than sophisticated attack. Most successful domain hijackings happen because the registrar account had no two-factor authentication, used a weak or reused password, or had an email address that was easier to compromise than a dedicated one would have been.

The steps in this guide take about 30 minutes to complete for a single domain. They are the 30 minutes that prevent weeks of recovery work, potential financial loss, and the reputational damage of having your domain used against your own customers.

Why your domain name matters more than most businesses realise goes deeper on the value of what you are protecting. Treat it accordingly.