A WordPress website can be fully patched and still disappear, redirect visitors, or lose email when the domain account is compromised. The registrar, DNS provider, recovery email, nameservers, and certificate controls sit outside WordPress, yet they determine where every visitor and message goes. Domain security therefore deserves the same ownership, authentication, monitoring, and recovery planning as the website itself.
Map the domain control chain
Record the registrar, registrant contact, DNS provider, nameservers, hosting origin, CDN, certificate issuer, renewal date, recovery email, billing owner, and every person or vendor with access. Confirm that the organization—not an individual employee or temporary developer—controls the account and recovery channels.
Book a free, no-obligation strategy call and we'll map out your next move.
Use our WordPress security audit checklist to connect domain controls with hosting, administrator accounts, integrations, code, and recovery evidence.
Protect the registrar account
Use a unique password, multi-factor authentication, individual user accounts where available, and a protected recovery email address. Remove former staff and vendors promptly. Store recovery codes safely outside the website and ensure billing failures cannot silently interrupt renewal.
Enable domain transfer lock and change notifications. For high-value domains, consider stronger provider features such as registry lock or an approval process for nameserver and ownership changes. Record who is authorized to approve a transfer and how their identity will be verified.
Apply the account principles in our WordPress two-factor authentication guide to the registrar, DNS, hosting, CDN, and recovery email accounts.
Secure DNS administration
Grant the lowest practical DNS role and separate routine record editing from ownership or billing administration. Avoid shared credentials and unnecessary API tokens. Limit each automation token to the required zone and operation, then rotate and revoke tokens through a documented process.
Export a known-good DNS record set after meaningful changes. Document A, AAAA, CNAME, MX, TXT, CAA, and nameserver records with their business purpose and owner. The backup should be stored outside the DNS account so it remains available during an incident.
Consider DNSSEC carefully
DNSSEC adds cryptographic validation to DNS responses, helping resolvers detect certain types of forged data. It requires coordination between the registrar and authoritative DNS provider. Enable it only with a documented change plan, confirmed provider support, and rollback steps; stale or incorrect delegation-signer records can cause an outage.
Protect email and account recovery
Domain email often controls password resets for the registrar, hosting, WordPress, payment systems, and other critical services. Protect administrative mailboxes with multi-factor authentication and individual access. Review forwarding rules, recovery addresses, delegated access, and suspicious sign-ins.
Use appropriate SPF, DKIM, and DMARC records for the mail systems actually sending on behalf of the domain. These controls reduce spoofing risk but need testing and monitoring so legitimate mail is not unexpectedly rejected.
Manage HTTPS certificates
Automate renewal where possible, alert well before expiry, and monitor every production hostname. Restrict who can change certificate and CDN settings. Certificate transparency monitoring can reveal unexpected certificates issued for the domain, but an alert still requires investigation and a response owner.