GoDaddy Account and Domain Security Guide

Whoever controls your GoDaddy account controls your domains, and whoever controls your domains can redirect your website, your email and your password reset links. A registrar account is one of the highest value identities a business has, yet it is often protected by one person's password and a text message code. This guide covers the GoDaddy specific controls: identity verification methods and 2-step verification, Delegate Access levels, Domain Protection plans and domain lock, API Personal Access Tokens and classic keys for DNS automation, and hosting credentials such as cPanel and SSH. It is written for IT administrators, web and DNS owners and security teams who run domains at GoDaddy. Feature names and behaviour come from GoDaddy Help and the GoDaddy developer documentation as checked on 8 November 2026; GoDaddy changes its interface often, so confirm against the current help article.

This is an independent guide from NHI Mgmt Group, based on GoDaddy's public documentation as of November 2026. It is not sponsored or reviewed by GoDaddy. Product features change, so confirm settings against GoDaddy's current documentation.

Key takeaways

Use a passkey and a backup method. GoDaddy supports the GoDaddy app, authenticator apps, passkeys (including FIDO security keys) and SMS. It recommends passkeys for anyone wanting the highest security, with a backup method on a different device.
Turn on 2-step verification as well. With 2SV on, GoDaddy asks for your default method at every sign in and before high risk actions such as password changes.
Never share the owner login. Give staff and agencies Delegate Access at the lowest level that works; delegates cannot see passwords, the Support PIN or payment methods, or invite others.
Lock and protect every production domain. Keep domain lock on, and use a Domain Protection plan so high impact changes need a one-time password or 2-step code.
Treat API tokens as privileged credentials. GoDaddy recommends scoped Personal Access Tokens over classic sso-key credentials; store them like passwords and revoke on any doubt.

How identity and access work in GoDaddy

Every GoDaddy product sits under one customer account. The account owner signs in with a username or customer number and password, then proves identity with one of the verification methods below. Other people get access through Delegate Access, and machines through API credentials. For registrar security in general, including registry lock and the wider DNS threat model, see the Authoritative DNS and Registrar Account Security Guide; this page stays on GoDaddy.

Verification method	What GoDaddy says	Security notes
Passkey	Uses biometrics, a screen lock, or a USB or Bluetooth FIDO security key; recommended for domain investors or anyone wanting the highest security; a backup method is required	Phishing resistant. Register two keys or a key plus a second method, and test by signing out and back in
GoDaddy app	Recommended for most account holders	Push or in app approval; protect the phone with a screen lock
Authenticator app	Time based codes from a third party authenticator	Good backup on a second device such as a laptop
Phone number (SMS)	Text message code; internet telephone services cannot be used; may be less reliable outside the carrier's area	Exposed to SIM swap and number porting; use only as a fallback

Identity verification versus 2-step verification

Identity verification: once a method is added, GoDaddy can ask for it for high risk actions or when it suspects a fraudulent login, even if 2SV is off.
2-step verification: switched on from the Security page under Enhanced Security. It requires the default method at each sign in and before high risk actions. Turning 2SV off does not remove identity verification.
Separate verification number: changing the primary phone number in My Profile does not change the verification number. Update both when staff or numbers change.
Support calls: GoDaddy verifies callers with a code from an authenticator app such as the GoDaddy app, or a one-time code to the primary mobile number or email. Keep those contact details current and controlled by the organisation, not one employee. See the Account Takeover Prevention Guide.

Admin roles and privileged access

GoDaddy has a single account owner and four Delegate Access levels. The owner is the only identity that can manage payment methods, view credentials and the Support PIN, and invite people. That makes the owner login the break glass account: hold it in a shared organisational mailbox, protect it with passkeys, and keep it out of daily use.

Delegate level	Can do	Typical use
Products, Domains, & Purchase	Buy with the stored payment method, access products and control panels, cancel new products, domain management and transfer actions	Trusted internal administrator
Products & Domains	Access products and control panels, cancel new products, domain management and transfer actions; no purchases	Web agency managing hosting and DNS
Domains Only	Domain management actions, transfer actions, or both; no product access	DNS administrator
Accounts Connection Only	Stays connected for future work; cannot currently access or purchase products	Dormant supplier relationship

At every level a delegate cannot accept an incoming domain transfer, manage or add payment methods, invite others, view or change account credentials such as the password or Support PIN, view order history, or upgrade products. Domain level access can be narrowed further with delegate folder permissions.

Invite, do not share: the delegate needs their own GoDaddy account, which carries its own verification methods. Require agencies to enable passkeys or an authenticator on that account before you invite them.
Watch transfer rights: the top three levels can include transfer actions. Give Domains Only without transfer rights to anyone who only edits DNS records.
Expire stale access: pending invitations lapse after 48 to 72 hours, but accepted delegates stay until removed. Review the "People who can access my account" list each quarter and on every supplier offboarding. See the Privileged Access Management Guide for review practice.

Integrations, API tokens and service accounts

DNS automation, certificate renewal (ACME DNS challenges), infrastructure as code and monitoring tools all call the GoDaddy API. Those credentials are non-human identities with the power to change DNS for every domain in scope. See the API Key Management Guide.

Credential	Header	Status in GoDaddy docs	Hardening
Personal Access Token (PAT)	`Authorization: Bearer <token>`	Recommended; works with Domains v3, Hosting, Shopping and other PAT enabled APIs	Choose minimum scopes at generation, set an expiry, store server side; shown only once
Classic Developer Key	`Authorization: sso-key <key>:<secret>`	Deprecated for Domains (through 2026); still required for Auctions; works with Domains v1 and v2	Plan migration to PATs; rotate and remove unused keys

Least privilege scopes: PAT scopes are grouped by resource (Domains and DNS, Commerce, Email, Shopping, hosting.*). A write scope also satisfies reads, a read scope is refused on writes. A monitoring job needs only read scopes such as domains.domain:read; locking or unlocking a domain needs domains.domain:update.
Owner role for lock changes: GoDaddy's lock endpoint requires the Domain Owner role; a 403 means the credential needs write access granted. Keep tokens with that power to the smallest number of systems.
Revocation: PATs can be revoked individually and GoDaddy states revocation is instant. If a token is lost or exposed, revoke it and generate a new one rather than reusing it.
Storage: GoDaddy's examples load the token from an environment variable so it stays out of shell history. In production, keep it in a secrets manager and inject at run time. See the Secrets Management Guide.
Rate limits and errors: limits apply per credential (60 requests per minute on the documented example endpoint); a 429 includes Retry-After. A sudden run of 401 or 403 errors from a pipeline can mean a revoked token or a scope change, and should be checked, not just retried.

Hosting credentials

GoDaddy Web Hosting (cPanel) has its own credentials. SSH must be enabled from the hosting Dashboard Settings tab, and GoDaddy states the cPanel password doubles as the SSH password, so a weak or reused cPanel password exposes shell access too. Enable SSH only where it is needed, use a long unique cPanel password, and treat FTP, database and WordPress admin credentials as separate secrets. For control panel hardening see the Hosting control panels security guide.

Logging and detection

GoDaddy is a SaaS console, so detection depends on its notifications and activity records rather than server logs.

Signal	Where	What to watch for
Domain change alerts	Included in every Domain Protection plan	Nameserver, contact or lock changes nobody requested
Activity Log	Domain Protection plans	Actions such as "Unlock or lock my domain", especially unlock events
Verification prompts	Email or app prompts for one-time codes	Codes nobody asked for indicate someone holds the password (ATT&CK T1621)
Delegate notifications	Owner email when a delegate accepts	Acceptances you did not expect
External DNS monitoring	Your own monitoring of NS, MX, A and TXT records	Record changes that do not match a change ticket
API client logs	Your automation	Calls from new IPs or hosts, 401 or 403 bursts, write calls outside pipelines

Route alerts to a team: send GoDaddy account and domain emails to a monitored shared mailbox or ticket queue, not a personal inbox.
Monitor from outside: GoDaddy alerts tell you about the account; external DNS monitoring tells you whether resolvers see a change, which also catches compromise of a DNS provider outside GoDaddy. See the DNS Logging and Detection Guide.

Metrics

Percentage of GoDaddy identities (owner and delegates) with a passkey or authenticator method: target 100 percent.
Production domains locked and under a Domain Protection plan: target 100 percent.
Delegates reviewed in the last 90 days: target 100 percent.
API tokens with an owner, minimal scopes and an expiry date: target 100 percent; classic keys remaining: trending to zero.
Time from an unexpected DNS change to detection: minutes, not days.

Hardening baseline

Domain lock and Domain Protection

Domain lock blocks transfers to another registrar; the toggle sits under Transfer in Domain Settings and changes can take up to 90 minutes to show. For domains with Domain Protection, GoDaddy asks for extra verification to unlock: the SMS or authenticator code if 2SV has been on for at least 24 hours, otherwise a one-time password to the account email. That fallback is why the account email must itself be secured. Separately, a domain cannot transfer within 60 days of registration or a previous transfer, and a Change of Registrant triggers a 60 day transfer lock under ICANN's Transfer Policy.

Plan	What GoDaddy lists	Use for
Full	Change alerts, transfer protection against accidental or unauthorised transfers, one-time password or 2-step code approval for high impact changes, Activity Log	Every domain that carries a live website or email
Ultimate	Everything in Full plus 90 days to renew after expiry caused by failed billing, with no extra recovery fee	Business critical domains where a lapsed card would cause an outage
Ownership Protection	Everything in Ultimate; available on specific extensions only; can only be added or removed	Primary brand and email domains on supported extensions

GoDaddy notes that some extensions lack features such as transfer or renewal protection, so check each extension. Domain Privacy is a separate service and does not replace Domain Protection.

Rollout order

Secure the owner account: move the login to an organisational mailbox, add two passkeys or a passkey plus an authenticator, enable 2SV, and update the verification phone number.
Inventory: list every domain, its renewal date, lock state, protection plan, nameservers and who has delegate access.
Replace shared logins: invite each person or agency as a delegate at the lowest level, then change the owner password.
Lock and protect: turn on domain lock and a Domain Protection plan for production domains; enable auto renew with a valid payment method.
Move automation to PATs: issue one scoped PAT per pipeline with an expiry, test it, then delete the classic key it replaces. Record which systems used the old key before deleting it, so a failed cut over can be traced quickly.
Tighten hosting: disable unused SSH, rotate cPanel, FTP and database passwords, and keep CMS admin accounts separate.
Monitor: route alerts to a team queue and add external DNS change monitoring.

Common misconfigurations

One person's phone as the only factor: SMS on an employee's personal number. When they leave, or their number is ported, the organisation loses control or an attacker gains it.
Shared owner credentials: agencies and contractors given the owner login instead of Delegate Access, so they can see the Support PIN and payment details and nobody can tell who made a change.
Domains left unlocked: a domain unlocked for a transfer that never happened, or for a ccTLD registrant change, and never relocked.
Unprotected account email: the email that receives one-time passwords and resets has weaker security than the GoDaddy account it can unlock.
Over scoped, never expiring API credentials: a classic key with full domain rights in a CI variable or script, unchanged for years. See the Domain Registrar Compromise Playbook if one is exposed.
Expiry by accident: auto renew off or an expired card on a primary domain, letting it lapse and opening the door to re-registration.

Framework mapping

GoDaddy control	NIST SP 800-53 Rev 5	NIST CSF 2.0	MITRE ATT&CK
Passkeys, 2SV, verification methods	IA-2	PR.AA-01	T1110.003, T1621
Delegate Access levels and reviews	AC-6	PR.AA-05	T1078
Domain lock and Domain Protection	SC-20, CM-6	PR.PS-01	T1584.001
Scoped PATs, revocation, secret storage	IA-5	PR.AA-01	T1552.001
Change alerts, Activity Log, DNS monitoring	AU-6	DE.CM-01	T1584.001

Practitioner checklist

Hold the GoDaddy owner login in an organisational mailbox, protected with passkeys and a backup method on a separate device.
Enable 2-step verification and remove SMS as a primary method where possible.
Replace every shared login with Delegate Access at the lowest level, without transfer rights unless needed.
Review delegates every quarter and at every supplier or staff exit.
Keep domain lock on and a Domain Protection plan on every production domain; enable auto renew.
Secure the account email to at least the same standard as the GoDaddy account.
Move DNS automation to scoped, expiring PATs held in a secrets manager; retire classic keys.
Disable unused SSH on cPanel hosting and rotate hosting passwords after any GoDaddy security notice.
Send GoDaddy alerts to a team queue and monitor NS, MX and TXT records externally.

GoDaddy Account and Domain Security: Protect Domains, DNS, API Tokens and Hosting