Your registrar’s transfer lock is on, which protects against hijacking.
The sponsoring registrar has told the registry to reject any request to move the domain to another registrar. It is the most common protective status and what most registrars mean by “domain lock”.
- EPP code
- clientTransferProhibited
- In RDAP
- client transfer prohibited
- Set by
- Your registrar (client status)
- Defined in
- RFC 5731 §2.3
- How serious
- Nothing wrong
Why it matters
It is what you want on a domain that runs your website and email: a stolen account password alone can’t move the domain away.
When you’d see it
Most registrars turn this on automatically. When you decide to move to a different registrar, the transfer request is rejected until you switch the lock off in the old registrar's dashboard and get the authorisation (EPP) code.
How it shows up in a lookup
In a gTLD WHOIS lookup it appears as “Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited”; RDAP shows it as “client transfer prohibited”. It is a client status, so only your registrar can add or remove it; the registry enforces it.
What to do
If you meant to transfer the domain to another registrar, sign in at your registrar and turn off the lock (often called "domain lock" or "transfer lock"), or ask their support to remove it. The change shows up in RDAP within minutes to hours.
Combination rules
pendingTransfer must not be combined with clientTransferProhibited (RFC 5731 §2.3).
Related codes
Sources
Sources
- RFC 5731 §2.3 (EPP Domain Name Mapping) · checked 5 Oct 2026
- ICANN: EPP Status Codes, What do they mean, and why should I know? · checked 5 Oct 2026
- RFC 8056: EPP and RDAP status mapping · checked 5 Oct 2026