Registrar Lock (clientTransferProhibited)
A registrar lock is the standard, registrar-level lock that blocks a domain from being transferred away — visible in RDAP or WHOIS as the EPP status clientTransferProhibited. Most registrars enable it by default on every domain, and you toggle it off yourself in the dashboard when you genuinely intend to transfer.
Registrar lock vs. registry lock
The names sound alike; the security levels are not. A registrar lock is a client-side status you (or anyone in your registrar account) can switch off instantly — it stops accidents and casual hijack attempts, not an attacker who has compromised the account. A registry lock is set at the registry itself (serverTransferProhibited and companions), usually a paid service requiring out-of-band verification to release. High-value names warrant the registry version.
When the lock is not yours
A 60-day transfer restriction after a new registration, a recent inbound transfer, or a registrant change is ICANN policy, not a toggle — waiting out the window is the only option. If a lock will not release and the domain is not in one of those windows, contact the registrar.
Frequently Asked Questions
Should I keep registrar lock enabled?
Yes, on every domain, all the time. Disable it only for the minutes-to-days it takes to complete an intentional outbound transfer, then let the gaining registrar re-lock.
Why can't I remove clientTransferProhibited?
Either the registrar requires you to unlock via a specific dashboard flow, or the domain sits in a mandatory 60-day window after registration, transfer, or a registrant change. Check the domain's history first.