Most business owners find out what they do not own at the worst possible moment: when a provider stops answering, retires, raises prices, or the relationship simply ends. The website goes dark, the email stops, and nobody has the logins. It is entirely preventable, and the prevention takes an afternoon.
On this page
- The principle worth holding on to
- Your domain name
- Hosting, files, and the database
- Administrator access to the website
- Google Business Profile, Analytics, and Search Console
- Advertising and social accounts
- Business email
- Photography, copy, and licenses
- Warning signs
- The ownership checklist
- Common questions
The principle worth holding on to
A provider can hold the keys day to day. That is normal and often sensible, since most owners do not want to manage DNS records. What matters is that the business is the account holder, and can regain sole control without anyone’s cooperation.
A single test covers most of it. If your provider disappeared tomorrow without warning, could you keep operating? If the honest answer is no, that is a risk sitting on your business regardless of how good the relationship currently is.
Your domain name
This is the most important item on the list, because the domain is your identity. Losing it means losing your website address and usually your email at the same time.
The domain should be registered in the business name, in an account the business controls, with billing on a business card and renewal notices going to an address you actually read. Not your web designer’s account, and not a personal account belonging to whoever set it up in 2014.
You can check the registrant on a public WHOIS lookup, although privacy protection may mask the details. If you cannot log in to the registrar yourself, treat that as the first thing to resolve. Expired domains are also a genuine hazard. Registrations lapse quietly when the renewal notice goes to an address nobody monitors.
Hosting, files, and the database
Hosting is where the website physically lives. Some providers resell hosting under their own account, which is a normal arrangement but means you have no direct access and cannot move without their help.
Ask two things: can you obtain a complete copy of the site files and database on request, and can the site be moved to another host if you decide to. A provider who cannot or will not produce an export is holding your business rather than serving it.
Ask about backups too. Where they are stored, how far back they go, and whether you could restore from one if the provider were unavailable.
Administrator access to the website
You should hold a genuine administrator account on your own website, not an editor account that stops short of the settings that matter.
This is also where the choice of platform has consequences. Open platforms such as WordPress can be exported and moved to any host. Proprietary builders, where the site only exists inside one company’s system, generally cannot be. That is not automatically wrong, and plenty of businesses run happily on them for years, but it is a decision to make deliberately rather than discover later. If you are weighing that trade-off, our guide to what a website costs covers how it affects the long-term number.
Google Business Profile, Analytics, and Search Console
These get overlooked constantly, and the Business Profile is often the most valuable marketing asset a local business has.
- Google Business Profile. Your own Google account should hold the primary owner role. Agencies should be added as managers. An agency holding ownership means your reviews and listing sit with them.
- Google Analytics. The property should live in an account you own, with the provider granted access. If it was created inside their account, your historical data leaves when they do.
- Search Console. Same principle. This is where you see what people search before they reach you, and losing the history is a real loss.
Historical data cannot be recreated. A profile can be recovered with effort, but four years of analytics simply vanishes.
Advertising and social accounts
Advertising accounts should be owned by the business with the agency granted access, so campaign history, conversion data, and audiences stay with you. Rebuilding an ad account from nothing means relearning what already worked.
Social accounts should be created under a business email address you control, with more than one person holding administrator rights. Business pages tied to a single departed employee’s personal account are a recurring and avoidable headache.
Business email
If you use Microsoft 365 or Google Workspace, the subscription should be in the business name with someone internal holding the administrator role. Email is usually the account everything else resets through, which makes it the one that matters most in a dispute.
Because email routing depends on DNS records at the domain, whoever controls the domain effectively controls the email. Another reason the domain sits at the top of this list.
Photography, copy, and licenses
Work produced for you is not automatically yours to use however you like. Photographers frequently license images for specific uses rather than transferring rights outright, which is normal practice. What matters is knowing which arrangement you have.
Ask whether you may use the photography in print and social as well as on the website, whether written content transfers to you, and how any stock imagery is licensed. Also ask which premium plugins or themes the site depends on, whose license they sit under, and what happens to updates if that license is not renewed. A site running unsupported paid plugins becomes a security problem over time.
Warning signs
- Vague or evasive answers when you ask who owns what
- Refusal to give you administrator access to your own website
- The domain registered to the provider rather than the business
- No written agreement covering what happens if the relationship ends
- An export of the site described as impossible rather than inconvenient
- A monthly fee with no clear statement of what you keep if you stop paying
- Google accounts created inside the provider’s own Google account
None of these prove bad intent. Plenty arise from convenience rather than strategy. They are still worth resolving while everyone is on good terms, because that is much easier than resolving them afterwards.
The ownership checklist
Work through this once and keep the answers somewhere your successor could find them.
- Domain registrar login, registrant name, and renewal billing
- Hosting account access, or a confirmed right to a full export
- Website administrator credentials
- DNS control, and where records are managed
- Google Business Profile primary ownership
- Analytics and Search Console account ownership
- Advertising account ownership
- Social account administrator access, held by at least two people
- Business email administrator role
- Photography and content usage rights
- Plugin, theme, and software license holder
- A current backup you could actually restore from
Ask these before hiring anyone, too. A provider who answers them clearly and in writing is telling you something useful about how they operate. The guide on choosing a web designer covers the rest of that conversation.
How we handle it
Every site we build runs on WordPress, and clients receive full website ownership and administrator access at launch. There is no proprietary builder and no platform holding your content. Where we manage hosting or accounts, it is because the client would rather not, not because it makes leaving difficult. You can read more on the about page or in how we approach website design and redesigns.
This guide is general information, not legal advice. Ownership of work and accounts is ultimately governed by your contracts and by applicable law. If ownership is disputed or a provider is refusing to release access, review your agreements and speak with a qualified attorney.
Common questions
My web designer registered my domain. Is that a problem?
It is very common and often done helpfully rather than cynically. Ask to have the registrant details updated to the business and to be given account access. A reasonable provider will arrange it without friction.
Can I move my website to a different provider?
If it is built on an open platform such as WordPress and you can obtain the files and database, yes. If it lives inside a proprietary builder, the design usually cannot move, though your content and domain can.
What if my provider has stopped responding?
Start with the domain registrar, since account recovery there is often possible with proof of business identity. Recovering the Google Business Profile has its own documented process. Where a provider is actively refusing to release access, that becomes a contractual matter and is worth a conversation with an attorney.
Should I keep my own copy of the website?
Yes. Request an export periodically and store it somewhere the business controls. It costs nothing and turns a crisis into an inconvenience.