$190 once. Registrar lock verified, two-factor on every account that can move the domain, auto-renew confirmed, DNSSEC on, and SPF, DKIM and DMARC set so nobody can send email pretending to be you.
Registrar "domain protection" add-ons are typically a transfer lock plus two-factor approval on changes. Both already exist for free, and the two-factor on your account protects more.
| What the add-on offers | What it actually is | Free version |
|---|---|---|
| Stops unauthorised transfer or deletion | The ICANN registrar lock | On by default — verify it |
| Two-factor approval for major changes | 2FA, limited to domain actions | Account 2FA — covers everything |
| Keeps your details out of public records | WHOIS privacy | Already free at most registrars |
| — | DNS record tampering | DNSSEC, free on Cloudflare |
The risk these products are sold against is a hacker. The risk that actually takes domains away from small businesses is an expired card. Auto-renew and a valid payment method prevent more losses than any paid add-on, and cost nothing.
The second real risk is your email. Whoever controls the inbox that can reset your registrar account controls your domain, whatever add-ons are attached to it. That is why the hardening starts with the email account, not the domain.
Nine checks, each verified rather than assumed, and a one-page record of what was set so you or anyone after you can confirm it.
A site that is just files has no database to leak, no login page to attack, no plugin to go unpatched and no server to break into. The remaining risk is your accounts.
No admin login on the public site. No database holding customer records. No plugin ecosystem where one abandoned extension becomes a way in. No server process to keep patched. Most published website compromises need one of those to exist first.
Four accounts: the registrar, the host, the code repository, and the email that can reset all three. Each is secured the same way — an authenticator app, a password used nowhere else, and recovery codes kept offline. None of it is purchasable and all of it is free.
Forms are the exception worth naming. Any page that collects a message, a booking or a file is handling other people's information, and it gets treated accordingly: no data stored where it does not need to be, and no personal details put in a URL.
Not wasted, but you are probably paying monthly for a lock and a two-factor prompt that are free. Cancel it after the hardening is done and confirmed, not before — check the lock is still showing on the live WHOIS record afterwards, which takes about a minute and is part of the job.
You can have you@yourdomain.com without buying a mailbox. Cloudflare Email Routing forwards it into the Gmail you already use, free, and sending as that address needs one free relay configured once. If you want a real mailbox with its own storage and calendar, buy one — but do not buy one because you assumed a branded address requires it.
Nothing changes. The domain is registered in your name, the accounts are yours, the two-factor is on your phone and the written record is in your possession. There is no account of mine in the middle of it. That is the point of the exercise.
Not if it is introduced properly. It starts in monitor mode, which changes nothing and only collects reports about who is sending as your domain. After a couple of weeks of clean reports it is tightened. Setting it to enforce on day one is how people accidentally block their own newsletters.
Yes. It is account and DNS work, entirely independent of who built the site or where it is hosted. The site-header portion needs whatever access your host allows, and if the platform will not let those headers be set, I will tell you rather than charge for it.
$190 once, done properly, written down. Or included at no extra cost inside any of the three bundles.