Owning a domain is a big step in establishing your online presence. Whether you’re creating a personal blog, running a small business, or launching an e-commerce store, your domain is your “digital real estate,” on top of which you can build your digital home (your website!). However, just like physical property, owning a domain involves certain considerations—including protecting your personal information.
What Happens When You Register a Domain?
Similar to when you buy property like real estate or a car, you must register your purchase. Domains are registered with the nonprofit organization that coordinates the domain system, ICANN (Internet Corporation for Assigned Names and Numbers). As part of your registration, you must provide ICANN with personal information including:
- Your full name
- Physical address (home or business)
- Phone number
- Email address
- Business or organization name (if applicable)
By default, this information is added by ICANN to WHOIS, a publicly accessible database with contact information for domain owners across the web. Anyone can use a WHOIS lookup tool to find information about a website’s owner.
In the early days of the internet, WHOIS was a useful tool for developers to collaborate with other domain owners, drive internet accountability and transparency, buy and sell domain names, and direct legal communications, such as digital copyright infringement cases. However, as the internet has grown from a niche community space into a global economy with billions of users, the WHOIS database has become a growing security risk for domain owners.
Luckily, many internet domain registrars, including WordPress.com, offer some level of domain privacy—also known as “WHOIS privacy”—to keep your personal information safe.
What is Domain Privacy?
Most people purchase their domains through domain registrars, companies that register and manage your domain on your behalf. In addition to helping you find and purchase your web address, your registrar manages the DNS connections between your domain and services like your host and email provider.
When you add domain privacy through your registrar, your registrar replaces your personal registration information in the WHOIS database with proxy contact information that directs communication to the registrar’s privacy service. When someone searches for registration information about your domain, they’ll see:
- A proxy organization name.
- A generic address and phone number that redirects to the registrar.
- An email forwarding service that filters out spam while ensuring legitimate messages about your domain (like legal outreach) make it to your inbox.
When you register a domain through WordPress.com, domain privacy is free and your WHOIS record will contain information for one of our three privacy services, depending on your domain’s registrar of record. If someone searches for your domain using a WHOIS lookup tool, they will see that privacy service’s contact information listed on your domain record.
For example, when I looked up one of my domains registered with WordPress.com using a public WHOIS database lookup tool, the registrant contact listed was Knock Knock WHOIS Not There, LLC (see what we did there?).
Without domain privacy, my name, address, phone number, and email address would be shown instead.
Why is Domain Privacy Worth Having?
As the internet has grown, so have privacy risks and spam. WHOIS was designed to be transparent, publicly accessible, and easily queryable by engineers, making it particularly easy to scrape domain holders’ names, emails, mailing addresses, and phone numbers.
Free domain lookup tools, which allow anyone to type in a website’s address and receive their full ICANN contact record, also make it easy for any individual to quickly find details on a particular domain holder.
These factors make WHOIS a potential target for data miners and bots, which could put domain owners at risk of:
- Spammers: Automated bots or people using digital tools can scrape WHOIS data, leading to issues like email spam, texts, and robocalls.
- Scammers: Scammers will often use information like your home address and phone number in phishing schemes. Using the information they already have, they will pretend to be one of your legitimate service providers—like your post office or bank—and attempt to get you to share your login credentials.
- Identity theft: Cybercriminals can try to use data from WHOIS to impersonate website owners in fraud schemes, like applying for credit cards or loans.
- Targeted doxxing and harassment: If you run a blog or organization that deals with controversial topics or sensitive issues, critics could use WHOIS lookup tools to find your email and physical addresses, which can lead to forms of harassment.
- Unwanted marketing: While it is technically illegal, companies may scrape WHOIS data or buy scraped domain data to send unsolicited business offers, often in the form of cold calls and ongoing marketing emails.
ICANN faces mounting pressure over the WHOIS database, which many feel opens domain owners to unnecessary privacy risks. New data protection laws, such as the EU’s General Data Protection Regulation (GDPR), have already made strides in protecting EU domain holder’s information. If you live in the EU or are registered as an EU company, you probably have some default protections automatically enabled by your domain provider.
What is Data Scraping, and How Does Domain Privacy Counter it?
Data scraping is a process where someone uses an automated tool or writes code to quickly extract and download a large amount of data from a website. The more standardized a website’s data structure is and the fewer protections the site uses to limit bots (like CAPTCHA or rate limiting), the easier it is to scrape.
Since WHOIS is publicly available and designed to be easily searched, it is particularly vulnerable to this practice. Some WHOIS lookup tools even allow bulk searches, meaning that a scammer can extract thousands of domain owners’ contact details in minutes.
How Does Domain Privacy Differ Across Registrars?
Not all domain privacy offerings are created equal: some registrars only offer domain privacy for an annual fee, while others have pieced-together offerings, allowing you to mix and match services like identity protection or email forwarding for an added cost.
At WordPress.com, we believe internet privacy should be a right, regardless of location, not an add-on, which is why domain privacy is automatically included when you purchase a domain through WordPress.com.
This service includes both a proxy address in the WHOIS database and digital and physical mail forwarding for relevant requests via WHOIS (please note that this is for domain-related requests only, please do not list this contact information on your website!).
How to Ensure Your Domain has Privacy Protection
Depending on where your domain is registered, your domain privacy settings may look a little different. There are a few places you may be able to verify that your domain has domain privacy enabled, including any domain registration emails you receive and your domain record on your registrar’s website.
If you still have questions, you can email your domain registrar for confirmation on whether or not your domain has domain privacy enabled.
Verifying Privacy Protection on WordPress.com
Depending on your location, domain privacy for domains registered on WordPress.com may be activated by default.
If you aren’t sure whether you have domain privacy enabled, you can check by following these directions or visiting our support article:
- Visit your WordPress.com dashboard.
- Click Upgrades → Domains (or Hosting → Domains in WP-Admin).
- Select your domain.
- Navigate to Contact Information.
- Check that the option “Privacy protection on” is shown. If the toggle is switched off, click it to turn on privacy protection for your domain.
If, for some reason, you’re uninterested in domain privacy protection or you’d like to transfer your domain to another registrar, you can also disable your domain privacy on the same page under Contact Information.
Keep Your Personal Information Private with Domain Privacy
With growing cyber threats and data privacy concerns, domain privacy is no longer just an optional feature—it’s a necessity. With WordPress.com, you can rest easy knowing you have free domain privacy without hidden fees.
In addition to protecting your personal information, WordPress.com domains offer a suite of great benefits, including blazing-fast DNS, free SSL certificates (aka even more domain security!), and super competitive pricing.
While many registrars have been raising their domain prices year-over-year, WordPress is committed to offering affordable plans for the long haul. Our prices are some of the most affordable on the market, averaging just $13/year for popular .com, .net, and .org addresses.
Anyone can host a domain through WordPress.com—even if you host your website on another platform. To sweeten the deal, WordPress.com users with a paid hosting plan get a domain name free for a year when they purchase or transfer an existing domain. Transferring is super easy—check out our domain transfer guide.
Ready to secure your domain (and your information)?
