# clientTransferProhibited and other domain status codes, explained

Look up any domain in WHOIS or [ICANN Lookup](https://lookup.icann.org) and
you'll see one or more status codes:

```
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
```

They come from EPP, the protocol registrars use to talk to registries.
Newer RDAP lookups show the same codes in plain words ("client transfer
prohibited"). Most are locks or harmless notes. A few mean your domain is
off the internet or about to be lost.

## clientTransferProhibited

The most common status, and a good one. ICANN's description: "This status
code tells your domain's registry to reject requests to transfer the
domain." It's what registrars call **domain lock** or **transfer lock**,
and it stops someone moving your domain to another registrar.

Leave it on unless you're transferring. To move the domain, turn the lock
off in your registrar's control panel. If the registrar gives you no way to
do that, ICANN's Transfer Policy requires it to remove the lock within five
calendar days of your request.

Removing the lock isn't always enough. Under the current policy a registrar
may still refuse a transfer:

- within **60 days of registration**;
- within **60 days of a previous transfer**;
- for **60 days after a change of registrant** (new owner name or
  organisation), unless you opted out before the change.

For the steps, see [transfer a domain safely](/guides/transfer-domain-safely).

## The codes, grouped by what they mean

### Locks: good to have

| Status | Meaning |
|---|---|
| `clientTransferProhibited` | Registrar lock against transfers |
| `clientUpdateProhibited` | Registrar lock against changes (contacts, nameservers) |
| `clientDeleteProhibited` | Registrar lock against deletion |
| `serverTransferProhibited`, `serverUpdateProhibited`, `serverDeleteProhibited` | The same locks set at the registry: either a [registry lock](/guides/registry-lock) you asked for, or the registry's own action |

`client` codes are set by your registrar, `server` codes by the registry
itself. Your registrar can't remove a `server` code; the registry has to.

### Normal: nothing to do

| Status | Meaning |
|---|---|
| `ok` (RDAP: active) | No locks and nothing pending |
| `addPeriod` | Grace period just after registration |
| `autoRenewPeriod` | The registry renewed it at expiry; a grace period follows |

### Act now

| Status | Meaning | What to do |
|---|---|---|
| `clientHold` | Your registrar has taken the domain out of DNS: often unpaid, expired, or a dispute | Contact the registrar |
| `serverHold` | The registry has taken it out of DNS | Contact the registrar, which deals with the registry |
| `redemptionPeriod` | The domain was deleted after expiry; you have 30 days to restore it | Contact the registrar immediately; restoring costs extra |
| `pendingDelete` | Redemption is over; it will be released within days | Usually too late to restore |
| `pendingTransfer` | A transfer to another registrar is in progress | If you didn't ask for it, contact your registrar immediately |
| `inactive` | No nameservers are set | Set nameservers if the domain should be in use |

A hold means the domain doesn't resolve at all: website, email,
everything. For expiry, see [domain expired](/guides/domain-expired). For a
transfer or change nobody on your side asked for, see
[nameservers changed without permission](/guides/nameservers-changed-without-permission).

`serverTransferProhibited` that you didn't ask for can also mean a dispute
or a problem the registry wants sorted out; ask your registrar.

## What a well-protected domain shows

```
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
```

plus the three `server` versions if you use a registry lock. A domain that
only shows `ok` has no lock at all: turn on the transfer lock at your
registrar.

## Check your domain

The [domain expiry checker](/tools/domain-expiry-checker) shows your
domain's status codes, registrar and expiry date. Nameward's monitoring
alerts you if the transfer lock is turned off, or the registrar or
nameservers change.

## Sources

- [ICANN: EPP status codes, what do they mean and why should I know?](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en)
- [ICANN: Transfer Policy (2024), I.A.3.7, I.A.5, II.C.2](https://www.icann.org/resources/pages/transfer-policy-2024-02-21-en)
- [RFC 5731: EPP domain mapping (2.3 status values)](https://www.rfc-editor.org/rfc/rfc5731)
- [RFC 8056: EPP and RDAP status mapping](https://www.rfc-editor.org/rfc/rfc8056)

---
Source: https://nameward.app/guides/clienttransferprohibited (updated 2026-10-31)