Domain privacy protection hides your name, email address, phone number and street address from the public WHOIS record of a domain you own, replacing them with the details of a privacy service or a "redacted" notice. You stay the legal owner, and genuine messages still reach you through a forwarding address. Domain protection is the related set of security features, such as registrar locks and two-factor sign-in, that stops someone else from transferring or hijacking the name. Here is how each one works, whether you need them and how to switch them on.
Quick answer: do you need domain privacy protection?
- Registered in your personal name or a home address? Yes. Privacy keeps those details out of public databases and spam lists.
- Registered to a company with a public office address? It is still worth having, because it cuts spam and scam renewal letters.
- Is it worth paying extra for? Usually not. Many registrars now include it free; at Allanux Web, WHOIS privacy comes with every domain.
- Is privacy enough on its own? No. Pair it with a registrar lock, a strong password and two-factor authentication.
How domain privacy protection works
When you register a domain, the registry needs contact details for the owner, known as the registrant, plus administrative and technical contacts. Historically, all of this appeared in the public WHOIS directory, which anyone could search. Domain privacy changes what the public sees, not what the registrar holds.
- You register the domain with your real details. The registrar keeps your correct contact information on file, as the rules require.
- The privacy service masks the public record. Instead of your details, a WHOIS search shows the privacy provider's name, a forwarding email address or the words "REDACTED FOR PRIVACY".
- Messages are forwarded to you. Legitimate emails sent to the masked address, such as a buyer's enquiry, are passed on to your real inbox.
- Disclosure only happens for valid reasons. Law enforcement or a party with a proper legal claim can request the underlying data, and the registrar decides each request on its merits.
You can see the effect for yourself by running a search on any domain. Our guide to how a WHOIS lookup works shows what a public record looks like with and without privacy switched on.
Domain privacy vs domain protection: what is the difference?
The two terms are often sold together, but they solve different problems. Privacy is about who can see your details. Protection is about who can change or move your domain.
| Domain privacy | Domain protection | |
|---|---|---|
| Main purpose | Hide personal contact details from WHOIS | Prevent unauthorised transfers, changes and hijacking |
| Typical features | Masked contact data, forwarding email address | Registrar transfer lock, EPP or authorisation code, two-factor sign-in, change alerts |
| Protects you from | Spam, scam invoices, cold calls, data harvesting | Domain theft, unwanted DNS changes, losing your website and email |
| Who switches it on | Usually on by default or one setting at registration | Partly the registrar (locks), partly you (passwords and 2FA) |
| Typical cost | Often free, sometimes an annual add-on | Basic locks are free; advanced monitoring may be extra |
What domain privacy protection keeps out of view
Without privacy, the following details can appear in a public WHOIS record, depending on the extension and the registrar's policy:
- Your full name or the name of your business
- Your email address, which is the main target for spam bots
- Your phone number, often used for sales calls
- Your street address, which matters most if you work from home
The most common harm we see is not dramatic hacking. It is fake "domain renewal" invoices and letters that look official, sent to owners whose details were public. Some business owners pay them without realising they come from an unrelated company. Privacy does not stop every scam, but it removes the easiest source of your contact details. It is one reason we include it with every domain we register rather than selling it as an extra.
GDPR, POPIA and why many records are already hidden
Since the EU's GDPR took effect in 2018, registrars for generic domains such as .com and .net have redacted most personal data from public records by default. In South Africa, the POPI Act sets similar limits on how personal information is published, and the registry for .co.za restricts what its public WHOIS shows. The result is that much less personal data is public than ten years ago.
So why still use a privacy service? Default redaction rules vary between extensions and registrars, some fields such as your organisation name or country may still show, and policies can change. A privacy service gives you a consistent layer of cover, plus a forwarding address so genuine contacts can still reach you.
Do you need domain privacy protection? Two common cases
Switch it on if
- The domain is in your personal name.
- Your business runs from home and you do not want the address public.
- You own side projects or names you have not launched yet.
- You want fewer cold calls and fake invoices.
You might leave it off if
- Your company wants to show clear, verifiable ownership for trust reasons.
- The extension does not allow privacy services, as with .us domains.
- Your registrar already redacts everything and offers no extra benefit.
- You are preparing to sell and want buyers to find you easily.
For most South African small businesses, the answer is simple: keep privacy on. When you register a domain with us, WHOIS privacy is included at no extra cost, and a .co.za domain costs R109 a year with free DNS management.
How to switch on domain privacy protection
The steps are similar at almost every registrar.
- Sign in to your registrar's client area and open the list of domains.
- Select the domain and look for "WHOIS privacy", "ID protection" or "contact privacy".
- Switch it on and confirm. If it is a paid add-on, check the renewal price, not just the first year.
- Run a WHOIS search on your domain a few hours later to confirm your details are masked.
- Turn on the protection features at the same time: confirm the registrar lock is active and add two-factor authentication to your account.
If your current registrar charges for privacy every year, moving the domain may save you money. Our domain transfer service moves a .co.za for no upfront fee, renewing at R109 a year, with privacy included.
Domain protection: stop your name from being stolen
Losing a domain means losing your website and your email at the same moment, and recovering it can take weeks. These are the protection steps our team recommends for every client:
| Protection step | What it does | How to do it |
|---|---|---|
| Registrar lock | Blocks transfers to another registrar until you remove the lock | Check the status shows clientTransferProhibited |
| Two-factor authentication | Stops someone with your password from signing in | Turn on 2FA in your registrar account settings |
| Keep the authorisation code private | The EPP code is the key needed to move a domain | Only request it when you are transferring, and never email it around |
| Auto-renew and a working email | Prevents accidental expiry and missed warnings | Switch on auto-renew and keep the account email current |
| Register in your own name | Makes sure you, not a supplier, are the legal owner | Check the registrant on your WHOIS record |
Expiry is the most common way businesses lose a domain, and it is completely avoidable. Read what happens when a domain name expires to see how short the recovery window can be, and work through our website security checklist to cover the rest of your site.
If you would rather not track renewals, updates and backups yourself, our website maintenance plans include that, and you can always ask our team to check who controls your domain today.
