TL;DR: Check your domain's WHOIS record and registrar account as soon as you suspect a problem — the faster you act, the better the chance of recovering the domain before it's resold or the DNS is changed further.
How to Recover a Hijacked Domain or Website — a clear, step-by-step guide to what to do and how long it takes.
Step 1: Act immediately once you notice it
Check your domain's WHOIS record and registrar account as soon as you suspect a problem — the faster you act, the better the chance of recovering the domain before it's resold or the DNS is changed further.
Step 2: Contact your domain registrar
Reach out to your registrar's support immediately, explain the domain appears hijacked, and ask them to lock the domain to prevent any further transfer while they investigate.
Step 3: Try to regain access to your registrar account
If you still have any access, change your registrar account password immediately and enable two-factor authentication; if you're locked out entirely, use the registrar's account recovery process.
Step 4: File a dispute if the domain was transferred elsewhere
If the domain was transferred to another registrar without your authorization, your original registrar can often initiate a transfer dispute; for trademark-related domain disputes, ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP) provides a formal path.
Step 5: Secure related accounts and DNS settings
Once you regain control, review and reset your DNS records to their correct values, check for any unauthorized subdomains or mail forwarding rules the attacker may have added, and update your registrar and hosting account passwords.
If this looks similar to something else you've seen, it's worth reading How to Recover a Stolen Social Security Number.
This pattern shows up elsewhere too — see How to Recover Money Sent to a Scammer via Gift Card.
Frequently Asked Questions
Step 1: Act immediately once you notice it
Check your domain's WHOIS record and registrar account as soon as you suspect a problem — the faster you act, the better the chance of recovering the domain before it's resold or the DNS is changed further.
Step 2: Contact your domain registrar
Reach out to your registrar's support immediately, explain the domain appears hijacked, and ask them to lock the domain to prevent any further transfer while they investigate.
Step 3: Try to regain access to your registrar account
If you still have any access, change your registrar account password immediately and enable two-factor authentication; if you're locked out entirely, use the registrar's account recovery process.
Step 4: File a dispute if the domain was transferred elsewhere
If the domain was transferred to another registrar without your authorization, your original registrar can often initiate a transfer dispute; for trademark-related domain disputes, ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP) provides a formal path.
Step 5: Secure related accounts and DNS settings
Once you regain control, review and reset your DNS records to their correct values, check for any unauthorized subdomains or mail forwarding rules the attacker may have added, and update your registrar and hosting account passwords.