# Turn on WHOIS privacy and transfer lock

> Hide your contact details from WHOIS and stop anyone transferring a domain away while it is locked.

Source: https://docs.coritan.com/websites/domains/whois-privacy-and-transfer-lock/

In the dashboard:

- /dashboard/websites/…/settings: https://www.coritan.com/dashboard/websites

Two switches protect a domain registered with Coritan. *WHOIS privacy* hides your contact details from public WHOIS lookups. The *transfer lock* makes the registry refuse transfer requests from other registrars. A new registration starts with the transfer lock on, and with WHOIS privacy on if you chose it when you registered.

## Before you begin

The domain must be registered with Coritan, and its registration must be `active` ([Statuses](/websites/domains/#statuses)).

## Change the switches

1. In the dashboard, go to [Websites](https://www.coritan.com/dashboard/websites), open the domain and select the **Settings** tab.
2. In the **Domain options** card:
   - Turn **WHOIS privacy** on to hide your contact details, or off to show them.
   - Turn **Transfer lock** on to refuse transfers, or off before you move the domain to another registrar.

## Result

The dashboard confirms each change. The **Registration** card shows **WHOIS privacy** as `On` or `Off` and **Transfer lock** as `Locked` or `Unlocked`, and the Websites list shows the **WHOIS privacy** and **Locked** badges.

Keep the transfer lock on unless you are moving the domain. [Transfer a domain to another registrar](/websites/domains/transfer-a-domain-away/) explains when to turn it off.

## Troubleshooting

`Could not save the WHOIS privacy setting` or `Could not save the Transfer lock setting`
: The change did not reach the registry. The registration may not be `active`, or the registry did not answer. Try again later.

`Failed to update WHOIS privacy: …` or `Failed to update lock: …`
: The registry refused the change. Contact [support](/support/) if it keeps failing.

## Related

- [How domain registration works](/websites/domains/)
- [Website settings](/websites/settings/)

## With the API

Both calls take `enabled`:

```bash
curl -X PUT https://api.coritan.com/api/v1/domains/registrations/7/whois-privacy \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"enabled": true}'
```

```json
{"message": "WHOIS privacy enabled", "domain": "example.com"}
```

```bash
curl -X PUT https://api.coritan.com/api/v1/domains/registrations/7/lock \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"enabled": false}'
```

```json
{"message": "Domain unlocked", "domain": "example.com"}
```

Both answer `404` with `Registration not found` when the registration is not yours or not `active`.

## API

- `PUT /api/v1/domains/registrations/{reg_id}/whois-privacy`: Toggle WHOIS privacy for a domain (https://docs.coritan.com/api/reference/client/domains/#op-put-api-v1-domains-registrations-reg-id-whois-privacy)
- `PUT /api/v1/domains/registrations/{reg_id}/lock`: Lock or unlock a domain (https://docs.coritan.com/api/reference/client/domains/#op-put-api-v1-domains-registrations-reg-id-lock)