Turn on two-step verification at your registrar, switch on the transfer lock, and make sure the account, the registrant name and the renewal card belong to the business rather than to one person.

The account behind everything

Somewhere there is an account, at the company where your domain is registered, that decides where your website and your email are delivered. Whoever can sign in to it controls both.

For many small businesses that account was opened years ago, by whoever set up the first website, with a password chosen that afternoon and an email address that may no longer be read.

It is rarely visited, which is part of the risk. An account nobody checks is an account where a change can go unnoticed for days.

What someone could do with the login

The second is the one that spreads. Most accounts a business holds, from banking to hosting to social media, reset their passwords by email, so whoever receives your email can take over the rest.

Two-step verification

Two-step verification adds a second check to the password: a code from an app on a phone, or a code sent by text message, entered at sign-in. A stolen or guessed password is no longer enough on its own.

Many registrars offer it now, usually in the account's security settings, though it is rarely switched on by default.

Turning it on takes a few minutes. The registrar shows a code to scan with the app on your phone, then asks for the first six-digit code to confirm it works.

Where there is a choice, an authenticator app is generally the better option, since text messages can be diverted by someone who talks a phone company into moving your number.

Whose phone holds the codes

Two-step verification ties the account to a device, and that device belongs to a person. Plan for the day that person is away, changes phones or leaves.

Many registrars also provide backup codes when two-step is switched on. Print them and keep them somewhere the business controls, such as the office safe.

Where the registrar allows more than one user, give a second trusted person their own access rather than sharing one login.

The transfer lock

A transfer lock, sometimes called a registrar lock, blocks any attempt to move the domain to another registrar until the lock is lifted from inside the account.

Many registrars switch it on by default, but not all, and some lift it during support requests and never put it back. For a .com address, a public WHOIS lookup shows the lock as clientTransferProhibited in the domain's status.

Moving a domain also needs a transfer code, sometimes called an authorisation code, from the current account. Treat that code like a password, and never send it to anyone you did not contact first.

Registrars usually email the account's contact address when a transfer is requested. An unexpected request should be refused at once, and the password changed.

A worked example

A small community museum, run by a part-time director, a board and a group of volunteers, decided last spring to replace its website.

When the new director asked for the domain login, nobody had it.

A board member had registered the domain nine years earlier, in her own name and with her personal email. She had renewed it every year on her own card and been reimbursed.

She had since moved to another province but answered quickly. Signing in together, they found a password she had also used elsewhere, no two-step verification and the transfer lock switched off.

Nothing had gone wrong. The account had simply never been looked at since the day it was opened.

With her help, the registrant was changed to the museum's legal name, the account moved to a museum address, and two-step verification was set up with the code app on two phones: the director's and the board treasurer's.

The backup codes went into the museum's safe, the transfer lock went back on, and the domain now renews automatically for three years at a time on the museum's card.

The account belongs to the business

Three names should be the business's: the registrant, which is the legal holder of the domain; the account holder; and the card on file.

If a web designer or agency manages the domain for you, that is normal and often sensible.

Ask them to confirm in writing that the registrant is your business, and how you would get the transfer code if you ever needed it.

A good provider will answer that quickly, and keep the account protected with the same care as its own.

Staff changes are the time to check. When the person who set up the account leaves, its details should change that week, not when something breaks.

An address that survives the domain

Registrar accounts recover lost passwords by email. If that address is at the domain itself, a domain that lapses or is pointed elsewhere also cuts off the email you would need to fix it.

Use an address that would keep working if the domain stopped, or add one as a backup contact, and make sure someone reads it.

The renewal card needs the same attention. An expired card is one of the most ordinary ways a domain is lost.

The counter-case

A registrar that does not offer two-step verification is not an emergency, but it is a reason to raise the question with whoever manages your domain before the next renewal.

Very high-value domains can go further with a registry lock, which needs manual confirmation for any change. For most small businesses that is more than they need.

For everyone else, the three steps are the same: two-step on, transfer lock on, and every name on the account the business's own.

At the registrar

  1. List everyone who can sign in to the registrar.
  2. Change the password to one used nowhere else.
  3. Turn on two-step verification.
  4. Store the backup codes somewhere the business controls.
  5. Switch on the transfer lock.
  6. Check the registrant is the business's legal name.
  7. Set automatic renewal on a current business card.

Step one is the one that turns up surprises. Until you know whose phone, whose email and whose name are on the account, none of the other steps can be done properly.

Your domain's good name can also be damaged from the website side, which is covered in contact forms used to send spam to strangers.

Frequently asked questions

Why does the registrar account matter so much?

It decides where your website and email are delivered. Whoever can sign in can redirect both, transfer the domain away or let it lapse.

What does two-step verification add?

A code from a phone app or text message, entered after the password. A stolen or guessed password is no longer enough to get into the account.

Is an app better than text messages?

Generally yes. Text messages can be diverted by someone who persuades a phone company to move your number, while an app's codes stay on the phone itself.

What does a transfer lock do?

It blocks any attempt to move the domain to another registrar until the lock is lifted from inside the account. Many registrars turn it on by default, but check.

What if my web designer holds the account?

That is normal. Ask them to confirm in writing that your business is the registrant, and how you would get the transfer code if you ever needed it.

Which email address should the account use?

One that would keep working if the domain stopped, and that someone reads. An address at the domain itself fails at exactly the moment you need it.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure who controls your domain account?

Ask us to look. We will find out whose name, email and phone are on the account and help secure it.

Start a Conversation