Who really owns your website?
Here’s a situation we see more often than we’d like. A business wants to update its website, change developers or fix something urgent, and discovers it can’t. The domain is registered in a former web designer’s name. The hosting account belongs to an agency that stopped replying. Nobody has an administrator login.
The business paid for the website. But on paper, and in practice, someone else controls it.
It’s rarely malicious. A developer registered the domain to save the client a job, or set up hosting on their own account because it was quicker. Years later, people move on, and the shortcut becomes a lock. Here’s what your business should hold in its own name, and how to check.
The domain name: the one that matters most
Your domain is your address online, and your email almost certainly depends on it too. Whoever controls the domain controls both.
- Registered to your business. The registrant, the legal holder of the domain, should be your business, not someone at an agency. Public lookups often hide these details for privacy now, so your registrar account is the reliable place to check.
- In a registrar account you control, with a login email at your own company and two-factor authentication turned on.
- Set to auto-renew, with a payment card that won’t expire unnoticed, and renewal reminders going to an address someone reads. Once a lapsed domain’s grace period ends, someone else can register it.
- Transfer lock on, so the domain can’t be moved to another registrar without your approval.
DNS
DNS is where your domain’s records live: where the website is hosted, where email is delivered, and the records that prove your emails are genuine. It’s often managed at the registrar, but can be elsewhere, such as Cloudflare. Wherever it is, you should have your own login, and an exported copy of the records somewhere safe. Why your website’s emails land in spam explains the email records.
Hosting
- The hosting account should be in your business’s name, paid for by you, with your own login. Developers can be added as extra users where the host allows it.
- If an agency hosts your site on its own account, which is common and can be perfectly fine, get it in writing that you can have a full copy of the site and database at any time, and that they’ll help move it if you part ways.
The website itself
- Your own administrator account in WordPress, in your name, with two-factor authentication. Not a shared login, and not only the developer’s account.
- A copy of the site. Backups you can reach yourself, not only inside the developer’s systems.
- The code. Custom themes, plugins and apps should live in a code repository your business owns, on GitHub for example, with developers added as collaborators.
- Premium licences. Paid themes and plugins should be licensed to your business. A licence on a developer’s account stops receiving updates, including security fixes, when that relationship ends.
Everything connected to it
- Google Search Console and Google Analytics, where your business’s own Google account is an owner or administrator, not just a user an agency added.
- Google Business Profile, owned by your business.
- Your email provider, such as Google Workspace or Microsoft 365, with an administrator login you hold.
- Payment gateways, such as Paystack, Stripe or PayPal, in the business’s name. That’s where the money goes, so this one isn’t negotiable.
- Every other service the site relies on: newsletters, forms, maps, the CDN and any API keys.
Keep the keys somewhere safe
Store every login in a business password manager with shared vaults, not in a spreadsheet or someone’s memory. When a developer needs access, give them their own account and remove it when the work ends. It’s safer than sharing your password, and you can see who did what.
If someone else holds the keys
Start with a friendly request. Most developers are happy to hand things over. Often, nobody has ever asked.
- Make a list of everything above, and who controls each item today.
- Ask for transfers in order of importance: the domain first, then DNS, hosting, email, the WordPress admin and everything else.
- For the domain, the registrar can usually move it into your own account, or the developer can unlock it and give you the transfer code so you can move it to a registrar of your choice.
- Change passwords and remove old accounts as each item comes into your hands.
- Keep your records. Invoices showing you paid for the website and domain matter if a transfer is refused, because registrars have processes for ownership disputes, and proof helps.
Starting a new project?
Put it in the contract: your business owns the domain, hosting, code, content and every account, and the developer works inside them. Good developers welcome it.
It’s one of the things we care about most. Sites we build are built to hand over, on accounts our clients own, so the next developer can pick up where we left off. And if you’re locked out of a site someone else built, our WordPress support can help you get control back.