No update lock is set on the domain
Updated
What this check looks for
The registry shows no clientUpdateProhibited status, so the domain's nameservers and contact details can be changed from inside the registrar account with no further step. The update lock stops those changes without an extra step, but not every registrar lets you turn it on yourself.
Why it matters
Changing the nameservers is the quiet version of stealing a domain: the registration still says your name, but the site, the email and every certificate that can be issued for the name now belong to whoever made the change. It is often noticed hours later, through a failing mailbox rather than an alert.
When the check passes, your report says: “An update lock is set, so nameservers cannot be changed quietly”.
What it costs your score
When this check fails it removes 10 points from your Domain registration score, before the status, confidence and repeat multipliers are applied. Domain registration carries a weight of 5 in the overall score.
It shares the domain.locks family ceiling of 30 points: however many findings that family produces, together they cannot remove more than that from Domain registration. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 10 points
- Family cap
- domain.locks · 30
- Category
- Domain registration
- Module
- Domain rdap
- Fix owned by
- registrar
- In the ruleset since
- 2026.09
How to fix it
Turn on the update lock (clientUpdateProhibited) if your registrar offers it, and secure the registrar account either way.
It blocks the fastest route to a hijacked domain, a silent nameserver change, but not every registrar lets you set it yourself.
Look in the domain's settings at your registrar for an update, modification or domain lock. Some registrars offer it in the account settings, some only as a paid service or an enterprise registry lock, and some do not offer it at all. If you cannot find it, ask support for
clientUpdateProhibitedby name, and if they do not offer it, rely on the next two steps. At Cloudflare Registrar we observed no such setting in the dashboard in 2026-10; Cloudflare documents a registry lock only through Enterprise Custom Domain Protection.Whatever your registrar offers, turn on two-factor sign-in for the registrar account, ideally with a hardware security key, and keep the transfer lock (
clientTransferProhibited) on.If the update lock is on, expect to unlock the domain when you next change DNS host. That one extra step is the protection working.
How to confirm it worked
If your registrar offers the lock, re-run this scan and confirm
clientUpdateProhibitednow appears in the domain's status codes.Confirm the transfer lock (
clientTransferProhibited) appears in the status codes as well.
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The registry reports these status codes: ‹statuses›. clientUpdateProhibited is not among them, and neither is the registry-level serverUpdateProhibited.
With the lock set (EPP clientUpdateProhibited, RFC 5731 §2.3) the registrar refuses nameserver and contact changes until it is explicitly lifted. It is a smaller protection than the transfer lock — it does not survive an attacker who can also lift it — but where it is available it removes the fastest, quietest route to a hijacked domain.
Availability varies by registrar. Some let you switch the update lock on in the domain's settings; some sell it as a paid service or as an enterprise "registry lock" that is set through an account manager; some do not offer it at all. For example, we observed no update-lock setting in the Cloudflare dashboard in 2026-10, and Cloudflare documents a registry lock only through Custom Domain Protection, available to Enterprise-plan customers with high-profile domains through their account team (developers.cloudflare.com/registrar/custom-domain-protection). A registry lock (serverUpdateProhibited) is stronger than the registrar lock, so a domain that has one does not get this warning.
What protects the domain whichever registrar you use: two-factor sign-in on the registrar account, ideally with a hardware security key, and the transfer lock (clientTransferProhibited). If your registrar does offer the update lock and you change DNS providers regularly, it adds one unlock step to that work.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.