EnterraHost
The lock on a domain is a registrar-level block on moving it to another registrar. It does not affect your website, your mail, your DNS records or your ability to edit any of them. The only thing it stops is a transfer out.
It is on by default, and leaving it on is the right answer for almost every domain almost all of the time.
Where it is in the toolbox
The Domains page has a Lock column, and the state reads either Locked or Unlocked. Clicking it toggles the state, and the change is pushed to the registry for you.
The same control appears on the domain's own page. Where a registry does not support the lock, or where the registrar has not yet reported the domain's state, the control is disabled with a note saying so rather than failing when pressed. Only the account holding the domain can see or change this, which is why the state is shown to you and to nobody else.
What it actually protects against
A transfer needs the transfer code from the current registrar. If somebody obtains that code — through a compromised email account, most often — the lock is the thing that stops them using it.
That is the whole value. The lock is not about preventing mistakes by you, it is about making a stolen code insufficient on its own. Turning it off to move a domain and forgetting to turn it back on leaves the domain protected only by the secrecy of a code that lives in an email.
When it has to come off
Only when you are transferring the domain to a different registrar. There is no other reason to unlock it, and no other operation here is affected by it.
Turn it off, start the transfer, and turn it back on once the transfer has completed at the other end. The window in which it is off is the window in which the code alone is enough.
If you are moving a domain to us rather than away, the lock at the current registrar is theirs to turn off, and transferring a domain in covers the whole sequence.
The lock is not the only reason a transfer is refused
Worth knowing, because an unlocked domain that still will not transfer looks like a fault.
Most registries refuse a transfer within a short period after a domain is registered or was last transferred, usually sixty days. That applies no matter who is asking and no matter what the lock says, and there is no setting anywhere that overrides it. A domain registered this month simply cannot be moved until the window passes.
The other common refusal is a missing transfer code rather than a lock, and a registry that has suspended the domain for an unverified owner address will refuse as well. A registry that has suspended the domain for an unverified owner address will refuse as well, which is the case people least expect.