registrar lock.

A registrar lock is a single EPP status code — clientTransferProhibited — that instructs the registry to reject transfer requests for the domain. Most registrars apply it automatically to every domain you hold, and clearing it is a toggle in the domain's settings that takes effect in seconds.

It should stay on. Unauthorised transfer is the domain hijack that actually matters, because once a name has moved registrar and its DNS has been repointed, recovering it stops being a support ticket and becomes a formal dispute measured in weeks. The lock costs you nothing and converts that attack into one that also requires your auth code and access to your registrant email.

The one thing it is not is the 60-day transfer lock. That is an ICANN rule applied to recently registered or recently transferred domains, it is not a status you control, and no amount of clicking will clear it. If your registrar shows the domain as unlocked but transfers are still being refused, the 60-day rule is the usual explanation.

For genuinely valuable names, two related codes are worth adding: clientUpdateProhibited and clientDeleteProhibited, which block changes to the domain's records and its deletion respectively. Some registries also offer a registry-level lock service, setting server-side codes that only the registry can lift, typically with out-of-band verification — slow to change by design, which is the point. When you do want to move, unlock, fetch the auth code, and check the destination price first on the price pages.