Domain status codes are the EPP (Extensible Provisioning Protocol) status codes that appear in WHOIS records to tell you what state a domain is in and what actions are allowed on it. When you are buying or researching an expired domain, reading the status codes correctly tells you whether the owner can still renew it, whether the domain is locked against transfer, and whether it will drop to the public soon. Every domain in the registry has one or more status codes, and they are the source of truth for what you can and cannot do with that domain.
What an EPP status code means
EPP status codes are set by the registry (like Verisign for .com) or by the registrar (the company where the domain is registered). They control what operations are allowed. Some codes prevent the owner from taking action, like clientTransferProhibited, which blocks transfer to another registrar. Others show the domain's lifecycle stage, like redemptionPeriod, which means it is in the 30-day recovery window after expiry.
When you check WHOIS, the status field may list one code or several. Multiple codes just mean multiple conditions apply at once. For example, a domain might be clientTransferProhibited and also autoRenewPeriod if the owner has enabled transfer lock and the domain is in the grace period after expiry.
The registrar and registry follow these codes, so they are binding. If a domain shows clientTransferProhibited, the registrar will not transfer it, period. You cannot override them; you have to wait for them to clear or ask the registrant to remove them.
Status codes for expired and expiring domains
The codes most relevant to expired domain research are the ones that show the domain's position in the expiry timeline.
autoRenewPeriod means the domain has expired and is in the auto-renewal grace period, typically 30 to 45 days depending on the registrar. The owner can renew at the normal price. Some registrars keep the website and email running during this stage, while many stop them within days of expiry. This is the stage when recovery is cheapest and easiest for the owner.
redemptionPeriod means the domain has missed the grace period and is now in the 30-day redemption window. Only the previous owner can restore it, and only through their registrar, for a restore fee on top of the renewal price. Nobody else can register it yet. Once redemption expires, the domain moves to pending delete.
pendingDelete means the domain is in the final five days before the registry deletes it and releases it to the public. The owner cannot renew it, and nobody else can register it yet. After five days, the domain drops and becomes available first-come, first-served. For .com and .net, the drop happens around 19:00 UTC in the early afternoon US Eastern time.
These three codes are mutually exclusive; a domain shows one or none of them at any given time. If a domain shows none of these, it is either active (not expired) or already dropped. Check the full expiry timeline to understand how domains move through these stages.
Lock codes: transfer and update restrictions
Lock codes prevent certain operations even on an active domain.
clientTransferProhibited is the most common. It locks the domain against transfer to another registrar while the domain is active. This is a protective measure. The owner set it, or the registrar set it by default. To transfer to another registrar, the owner must unlock it first. A domain in pendingDelete cannot be renewed, restored or transferred by anyone, so a transfer lock is no longer the question there.
clientUpdateProhibited prevents updates to registrant contact or nameserver information without unlocking first. clientDeleteProhibited prevents the owner from deleting the domain from the registrar's account.
These lock codes are normal on active domains and are not a red flag. They protect the owner. If you are hoping to catch a domain in pendingDelete status, lock codes are not what decides whether you can get it. They matter mainly on active domains, for example when you buy one from its owner.
Hold codes: domain suspended
clientHold and serverHold are suspension codes. They mean the website is not resolving and email is not working, even though the domain is technically registered.
clientHold is set by the registrar, for example because of a billing problem, a terms-of-service violation, or at the owner's request. The owner can contact the registrar and ask what it takes to remove it.
serverHold is set by the registry. Removing it requires resolving the underlying issue, which can be a legal matter. If you are considering buying a domain and it shows serverHold, investigate why before proceeding, because a domain under dispute is not a clean acquisition. hunter.domains shows risk flags such as trademark risk and parked periods next to each domain, but it cannot see everything, so do your own checks too.
A quick reference table
| Code | Meaning | What it tells a buyer |
|---|---|---|
| autoRenewPeriod | In grace period after expiry | Owner can still renew at normal price for the registrar's grace period (roughly 30–45 days); the website may or may not still work. |
| redemptionPeriod | In redemption window after grace | Only the owner can restore it, for a higher fee; 30 days to go. |
| pendingDelete | In final 5-day countdown | Domain will drop soon; owner cannot save it; use a backorder service. |
| clientTransferProhibited | Locked against transfer | Domain is active and owner has locked it. Not relevant on expired domains. |
| clientUpdateProhibited | Locked against contact/NS changes | Updates blocked; not relevant to buying an expired domain. |
| clientDeleteProhibited | Owner cannot delete it | Not relevant to a purchase. |
| clientHold | Suspended by registrar | Website is down; set by the registrar. Investigate the reason. |
| serverHold | Suspended by registry | Website is down; set by the registry. Find out why before considering it. |
Estimating the drop date from pending delete
When a domain shows pendingDelete status, you know it will drop within five days. The exact day depends on when pending delete started. If pendingDelete began on Monday, the domain will drop on Saturday (five days later). A WHOIS lookup shows the current status, so find out when it began before you count.
The time of drop for .com and .net is in the early afternoon US Eastern time, around 19:00 UTC. Other extensions and country-code TLDs may have different drop times. Check the registry's rules if you are watching a non-gTLD domain.
The pending delete list shows domains in pendingDelete status. If you are hunting for a specific domain, consider which backorder service to use, or monitor the registrar's availability checker on your expected drop day.
Reading a real WHOIS record
When you pull a WHOIS record, the status field may look like this:
Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
The code is before the first space. Some WHOIS records show multiple status lines for multiple codes. Read each one and check the timeline: if you see autoRenewPeriod, the owner can still renew until the registrar's grace period ends (roughly 30–45 days after expiry). If you see pendingDelete, it will drop within five days.
Frequently asked questions
Is clientTransferProhibited bad?
No. clientTransferProhibited is a lock that prevents the domain from being transferred to another registrar while it is active. It is set by the owner or applied by the registrar by default, and it is completely normal. It does not affect the value of the domain or the quality of the backlinks. However, if you are buying the domain and want to move it to another registrar afterward, the owner will need to unlock it first. Ask the seller to confirm they will unlock it before transfer or to walk you through the process.
How long does pendingDelete last?
Pending delete lasts exactly five days. The domain cannot be renewed, restored, or registered by anyone during this window. After the five days, the registry deletes the domain and it drops to the public as available to the first person who registers it. For .com and .net, the drop happens once per day around 19:00 UTC. Other registries have different timings; check the registry's documentation.
Why is a domain on clientHold?
clientHold means the registrar has suspended the domain, usually due to a billing problem, a violation of the registrar's terms of service, or a dispute. The website stops resolving and email stops working. The owner can usually contact the registrar and ask them to remove the hold once the issue is resolved. If you are considering buying a domain on clientHold, clarify with the seller why it is held and whether the issue has been resolved. A hold suggests past trouble and may be a sign to look elsewhere.
