How to stop domain hijacking

How it happens

Almost always through the account, not the domain. Someone gets into the email inbox or the account that manages the domain, often with a reused password or a fake sign-in page. From there they unlock the domain, ask for the transfer code and move it somewhere else before the owner notices.

Less often, they change the owner contact first, so every warning goes to them instead of you.

The targets are not only big brands. A small business domain with years of history, a short memorable name or an inbox full of customer email is worth stealing too, whether to resell, to hold for ransom or to send convincing scam emails from an address people already trust.

Signs your domain was taken

• Your site suddenly shows a different page, an ad or an error.
• Email at your domain stops arriving, or replies say you sent things you did not.
• You get an email about a transfer, a lock change or a new owner address that you did not ask for.
• You cannot sign in, or your password no longer works.
• A public lookup of the domain shows contact details or a provider you do not recognize.

Hijacking or a DNS change?

Not every broken site is a stolen domain. DNS settings are the signposts that send visitors to your site and mail to your inbox. If someone edits them, or a setting is changed by mistake, the domain is still yours but traffic goes to the wrong place.

A hijack is different: control of the domain itself has moved. A quick way to tell is to sign in. If the domain is still in your account, with your details on it, look at the DNS settings first. If it has gone from your account, treat it as a hijack.

Keep the transfer lock on

The transfer lock blocks every move to another provider while it is on. Every domain you buy here starts locked, and it comes off only when you ask from your own signed-in account. How the transfer lock works has the details.

Use two-step sign-in

Two-step sign-in means a password alone is not enough: a second code, usually from your phone, is needed too. Turn it on for the email inbox you use to sign in to us. Whoever controls that inbox can reset passwords, so it is the key to everything else.

Use a password you do not use anywhere else, keep the sign-in email up to date and do not forward it to a shared mailbox.

Never share the transfer code

To move a domain away, the new provider asks for a code. Only you should ever have it. We will never email it to you, and no one from us will ask for it. Anyone who does is not on your side.

An extra check before anything sensitive changes

Domain Guard adds a 2-step sign-in before a transfer or a change to who owns the domain, and sends you an email alert when something changes. It is optional, and worth it for a domain your business depends on.

What to do if it happens

1. Contact us straight away. The sooner we hear, the more we can do.
2. Secure your email first: change the password, sign out every other session and check for forwarding rules you did not set up.
3. Change your account password and turn on two-step sign-in wherever you can.
4. Check the owner contact details and the DNS settings on every domain you have.
5. Keep any emails about the change. They show what happened and when.

For a domain moved without your permission, recovery means proving you are the rightful owner, so old invoices and account emails help.

While it is being sorted, tell your customers through another channel, like social media or a phone message, not to trust email from your domain for now. Once the domain is back, check every setting before you relax.