What it does
With the lock on, your domain cannot be transferred to another registrar without you first unlocking it and obtaining an authorisation code. With it off, a transfer needs considerably less to go through.
This protects against two things. Someone with access to your registrar account moving the domain away, and an accidental transfer initiated during a supplier change or a website rebuild.
Turn it on
- Log in to your registrar. The setting is usually on the domain's page, sometimes labelled registrar lock, transfer lock, or theft protection.
- Switch it on. There is no cost and no waiting period.
- Confirm the domain status afterwards shows
clientTransferProhibited.
Why it is off
Some registrars enable it by default and some do not. It is also switched off during a legitimate transfer and frequently never switched back on afterwards, which is the most common reason a long-held domain is unlocked.
When to turn it off again
Only when you are actually transferring the domain, and turn it back on once the transfer completes. That last step is the one people forget, which is how this ends up in a check years later.
What it does not protect against
It does not stop the domain expiring, and it does not stop someone with full access to your registrar account from unlocking it. It is one layer, and the more important ones are a strong registrar login with two-factor authentication and a contact address that survives someone leaving.
On the other status codes: the domain status codes field guide.