You ran a lookup, saw clientTransferProhibited next to “Domain Status”, and wondered whether the domain is stolen, disputed or stuck. Usually it is none of those. The clientTransferProhibited domain status is a lock your registrar sets to stop the name moving to another registrar without the owner’s say-so.
ICANN publishes the reference for every code, and its wording is quoted throughout this guide. Its intro is blunt: “Every domain has at least one status code, but they can also have more than one.” The skill is knowing which ones are protective and which ones mean something needs fixing.
What clientTransferProhibited means
ICANN’s definition: “This status code tells your domain’s registry to reject requests to transfer the domain from your current registrar to another.” Its advice on what to do follows straight on: the status “will help prevent unauthorized transfers resulting from hijacking and/or fraud. If you do want to transfer your domain, you must first contact your registrar and request that they remove this status code.”
So the clientTransferProhibited meaning, in plain terms, is “transfer lock on”. It tells you nothing about whether the name is for sale, in a dispute or about to expire. Not every registrar applies it by default either. ICANN says “Some registrars automatically enact certain status codes when you register a domain name, while others do so when you request it.”
It usually travels with two siblings. clientUpdateProhibited tells the registry to “reject requests to update the domain”, and clientDeleteProhibited to “reject requests to delete the domain”. Together they are what most people mean by domain lock.
How to read domain status codes in a lookup
The quickest check is ICANN Lookup at lookup.icann.org, which ICANN describes as a tool to “look up the current registration data for domain names” using RDAP, the replacement for port-43 WHOIS. Your registrar’s own lookup works too. (ICANN’s older EPP page still points to an InterNIC WHOIS form; use ICANN Lookup instead.)
Here is what Verisign’s WHOIS returned for example.com on 18 October 2026:
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibitedThe address after each code jumps to ICANN’s explanation of that code. RDAP shows the same three in spaced-out wording: “client delete prohibited”, “client transfer prohibited”, “client update prohibited”. A name maintained by the Internet Assigned Numbers Authority carries all three locks, which is a fair sign they are ordinary.
Client codes vs server codes: who set the lock
The prefix tells you who to talk to. ICANN: “Client status codes are set by registrars … Server status codes are set by registries, and they take precedence over client codes.” A client code can be lifted by your registrar on request. A server code cannot be removed by you; ICANN says your registrar has to “work with the Registry Operator”.
| Code | Set by | What it means (ICANN) | What to do (ICANN) |
|---|---|---|---|
clientTransferProhibited | Registrar | Registry will “reject requests to transfer the domain” | Ask your registrar to remove it before a transfer |
clientUpdateProhibited | Registrar | “reject requests to update the domain” | Ask your registrar to remove it to update |
clientDeleteProhibited | Registrar | “reject requests to delete the domain” | Ask your registrar to remove it to delete |
clientHold | Registrar | Not activated in the DNS; “it will not resolve” | Contact your registrar |
serverTransferProhibited | Registry | Prevents transfer; “uncommon”; may be a Registry Lock | Registrar must work with the Registry Operator |
serverHold | Registry | “Your domain is not activated in the DNS.” | Contact your registrar |
ok | Registry table | “no pending operations or prohibitions” | Consider asking for the client locks |
pendingTransfer | Registry table | A transfer request is “being processed” | Didn’t ask? Have the registrar “deny the transfer request” |
serverTransferProhibited is sometimes a feature rather than a problem. ICANN notes that some registries offer a Registry Lock Service as “an extra protection against unauthorized transfers”, and that removing it “can take longer than it does for clientTransferProhibited”.
Status codes that signal trouble
A second group means the domain is down or something needs resolving. For clientHold, clientRenewProhibited and the server versions, ICANN’s advice opens the same way: “Often, this status indicates an issue with your domain that needs resolution.”
clientHold: “usually enacted during legal disputes, non-payment, or when your domain is subject to deletion”. The site will not resolve.serverHold: set by the registry; the domain “is not activated in the DNS”.clientRenewProhibited: “an uncommon status that is usually enacted during legal disputes or when your domain is subject to deletion”.inactive: no name servers are associated, so the domain “will not resolve”.
One more deserves its own line. pendingTransfer on a name you own and did not move is a hijack warning. ICANN says to “contact your registrar immediately to request that they deny the transfer request on your behalf.”
Lifecycle codes: where a name sits in expiry
The third group tracks a registration’s life. addPeriod, renewPeriod, autoRenewPeriod and transferPeriod are grace periods after a registration, renewal or transfer; ICANN calls addPeriod “an informative status” and gives no fixed lengths beyond “first several days” and “limited time”.
redemptionPeriod means “your registrar has asked the registry to delete your domain”, and ICANN says it is held there for 30 days. pendingDelete follows if nobody restores it, before the name is purged. ICANN’s page is not consistent on how long that last stage lasts, so read our guide on when expired domains become available rather than trusting a single day count. The free Domain Expiry Checker shows which stage a lapsed domain is in (grace, redemption or pending delete) and when it could become available.
What to do when a domain lock is in the way
Moving your own domain. Unlock it at your registrar, then get the authorization code; our guide to the domain authorization code covers that step. ICANN’s Transfer Policy says that on request the registrar “must remove the lock or provide a reasonably accessible method” for you to remove it “within five (5) calendar days”. A separate 60-day lock can apply after registration, a transfer or a change of registrant, and that one is not a status you can ask to lift. Handing the name to someone else at the same registrar is a different process: see how to transfer a domain to another person.
Buying a domain. The client locks on a seller’s name are normal and the seller lifts them at transfer time. A server lock or a hold is a question for the seller before you pay. A name in redemptionPeriod or pendingDelete is an expiring name, which is a different purchase; our checklist on how to check an expired domain covers it. If a status history suggests the name dropped and was registered again, the Domain Age Checker flags domains that were dropped and re-registered.
Owning a domain. If your lookup shows only ok, ICANN suggests “Asking your registrar to enact status restrictions, like clientTransferProhibited, clientDeleteProhibited, and clientUpdateProhibited”.
A limitation: these codes come from EPP practice for gTLDs like .com. Country-code registries can use their own statuses, and a code tells you the current state, not why a registrar set it. For the reason, ask the registrar. ICANN’s full table is on its EPP status codes page.
Frequently asked questions
Is clientTransferProhibited bad?
No. ICANN describes it as protection against “unauthorized transfers resulting from hijacking and/or fraud”. Many domains carry it, including example.com.
How do I remove clientTransferProhibited?
Ask your registrar. ICANN: “contact your registrar and request that they remove this status code.” Under ICANN’s Transfer Policy, the registrar must remove it or give you a way to do so within five calendar days of your request.
What is the difference between clientTransferProhibited and serverTransferProhibited?
The registrar sets the client code; the registry sets the server code, which takes precedence. Removing a server lock means your registrar has to work with the Registry Operator, which can take longer.
What does clientUpdateProhibited mean?
The registry will “reject requests to update the domain”. To change contacts or name servers, you may need your registrar to lift it first.
The takeaway The three client locks are normal protection. Holds, renewal blocks, an unexpected pending transfer and the expiry codes are the ones that call for action, and the prefix tells you whether your registrar or the registry has to act.
