You've run whois example.com and in the Status section you get a list of strange strings like clientTransferProhibited, ok, and pendingDelete. The real question is: which of these blocks a transfer, which is a serious warning, and which is just a harmless label. This article is exactly that list, with the operational meaning of each code.
What exactly is a domain status code and where does it come from
Domain status is a field in the EPP protocol, not a promotional message from the registrar. A domain can have several codes at once at any given moment, because these codes are not exclusive. The registry (such as the .com registry or IRNIC for .ir) is the ultimate source; what you see in the registrar panel is only a reflection of that same value.
There are two general families: codes that start with client, which the registrar has applied, and codes that start with server, which the registry has applied. To remove a client* lock, it's enough to submit a request from the registrar panel. To remove a server* lock, it must be pursued through the registry or via the registrar, and it usually takes time.
Codes that block transfers
If you intend to transfer a domain, check these before doing anything. The presence of any of these codes causes the transfer request to be rejected with the error EPP status prohibits operation.
| Code | Meaning | Practical effect |
|---|---|---|
clientTransferProhibited | Transfer lock applied by the registrar | The transfer request is rejected |
serverTransferProhibited | Transfer lock applied by the registry | It is rejected and removing it is not up to you |
clientUpdateProhibited | Prohibition on changing information | You cannot change NS or the owner |
clientDeleteProhibited | Prohibition on deletion | Prevents accidental deletion |
clientHold | Suspension of service | The domain is removed from DNS |
serverHold | Suspension from the registry side | Usually due to a violation or failure to verify identity |
A point many people get wrong: clientTransferProhibited and clientUpdateProhibited are different. The first only blocks transfers between registrars; the second does not allow you to change NS records or ownership information. I've seen someone unlock the transfer lock and then be surprised why they can't change the nameservers.
Codes that are signs of a problem, not normal settings
Some codes are part of the natural life cycle of a domain and some are a red flag. Take these seriously:
pendingDelete: The domain is in the final deletion stage. Five days remain until it is fully released, and during this window you can't do anything.redemptionPeriod: The domain has expired and has entered the redemption period. Restoring it costs extra and cannot be done from the normal panel.pendingTransfer: A transfer request has been submitted and is awaiting confirmation. If you didn't request it, check immediately.autoRenewPeriod: Auto-renewal has been performed but the final payment hasn't been completed. If the payment isn't completed, it goes toredemptionPeriod.inactive: The domain is registered but no nameservers are attached to it. The site won't come up.
The order of these stages in .com domains is roughly fixed: expiration, then autoRenewPeriod for about 45 days, then redemptionPeriod for about 30 days, and finally pendingDelete for 5 days. For .ir domains these windows are shorter and the rules are different; the exact details are in the complete guide to registering and managing .ir domains with an IRNIC ID.
This is where people make mistakes
The most common mistake I see in tickets is this: the user renews the domain, the registrar panel shows the status as "active," but the site still won't come up. The reason is that domain status and DNS status are two separate things. A domain can be ok but its nameservers point to a server that no longer exists.
The sign is this: whois shows everything as healthy, but dig example.com NS returns the old nameservers. The solution is at the DNS layer, not the domain registration layer. If you run into this situation, follow the order of checking records in the practical DNS troubleshooting guide.
Mistake number two: unlocking the transfer lock without checking clientUpdateProhibited. The result is that the transfer goes through but the NS settings aren't applied at the new registrar and the site stays down for hours.
How to read status correctly
For public domains, the whois output is enough. For .ir domains, which have limited public WHOIS, you must query through the IRNIC panel or via the registrar. A useful command for a quick check:
whois example.com | grep -i "status"If you want to make sure the domain is actually connected to the right server, after checking the status, check the DNS records separately. The DNS record lookup tool does this without needing a terminal.
For domains you've just registered and want to connect to a server, the order of work is this: first see the status as ok or active, then set the nameservers, then create the A record. If you don't follow this order, you may wait hours for DNS propagation without there being any real problem. The full explanation of this process is in the guide to connecting a domain to a virtual server.
Which code to leave open and which to close
My practical recommendation is this: always keep clientTransferProhibited enabled, except during a period when you actually intend to transfer. This lock prevents domain theft and costs nothing. But only set clientUpdateProhibited when the settings are final and you don't want anyone touching them; because every NS change requires manually unlocking it and it becomes time-consuming in emergencies.
If you have a domain that's close to expiring and you don't want to lose it, check the status weekly. The guide to domain renewal and the expiration stages explains exactly these windows with dates. And if you've just registered your domain and want to get hosting running on a server, a Linux host with full DNS and SSL access is usually the fastest way to start.
Frequently asked questions
What does the clientTransferProhibited code mean and how do I unlock it?
It means the current registrar does not allow the domain to be transferred to another registrar. To unlock it, go to the registrar panel, find the domain lock section, and disable the Transfer Lock option. After unlocking, you usually need to get an EPP code or Auth Code and give it to the destination registrar.
What's the difference between pendingDelete and redemptionPeriod?
redemptionPeriod is the stage where the domain has expired but can still be restored, usually by paying an extra fee. pendingDelete is the stage after that, in which the domain is in the final deletion window and there is no way to restore it. If your domain has reached pendingDelete, you must wait for it to be released and re-register it.
Why does my domain have ok status but the site won't come up?
The ok status only says the domain has no registration problems. A site not coming up is almost always a DNS or server problem: wrong nameserver, an old A record, or a server that's down. First check the nameservers and A record with dig, then check the server.
Can I have several status codes at the same time?
Yes, and this is normal. A domain can have clientTransferProhibited, clientUpdateProhibited, and clientDeleteProhibited at the same time. Just note that some combinations completely lock actions like changing nameservers or transferring, and you must check all of them before taking any action.