# Keep a domain secure

> Every domain has a Security Advisor that checks how well it's protected and fixes issues in one click — showing only the actions your registrar and domain…

Source: https://infranest.io/docs/domain-security
Last updated: 2026-10-26

---

Keep your domains safe from hijacking, accidental loss, and silent tampering — this article is for anyone managing domains in InfraNest, no technical background needed.

## Overview
- The **Security Advisor** checks how well each domain is protected and flags anything that needs attention.
- It only shows actions your registrar and domain ending actually support, so you won't see fixes that can't apply.
- Many issues can be fixed with a **one-click fix** sent straight to your registrar.

## Run the Security Advisor
1. Open a domain from your **Domains** list.
2. Look at the **Security Advisor** panel. Each recommendation explains why it matters and, where supported, offers a one-click fix that's sent straight to your registrar.

<!-- docs-screenshots:start -->

![Keep a domain secure](/media/b8f3d91a-318e-4c1c-9e74-d17609971936)

<!-- docs-screenshots:end -->

## What it checks
- **Transfer lock** — should be on, to stop anyone moving your domain away without permission.
- **WHOIS privacy** — should be on, to keep your personal details out of the public record.
- **DNSSEC** — recommended, to protect your DNS from tampering. It is set in two places and can take a domain offline if it goes wrong — see **Turn on DNSSEC (and what to do when it breaks)**.
- **Auto-renew** — recommended, so the domain isn't lost at expiry.
- **Nameserver health** — checks the domain's live nameservers for problems or unexpected changes.

## Other registrar actions
From the same domain page you can also change nameservers, edit contacts, manage DNSSEC, and get the EPP / auth code (to move the domain elsewhere). Only the actions your registrar supports are shown; the rest are greyed out with a reason.

> [!NOTE]
> InfraNest watches for drift — if a domain's nameservers or status change outside InfraNest, it flags them so you can check.