Who Owns Your Website? Domain, Hosting & Login Checklist

Here is the short answer: you, the business owner, should own the domain registrar account, the hosting account and the admin login to the website. Not your web designer, not your nephew, not the marketing company you used in 2019. They can have access. They should not have ownership. If you are not sure who owns what right now, the checklist below will tell you in about ten minutes.

I take over websites for Connecticut businesses fairly often, and the ownership question is the first thing I check, because it decides whether a project is a two-week job or a three-month recovery.

Why it matters

A website has three separate pieces, and each one has its own login:

1. The domain (yourbusiness.com), registered at a registrar such as GoDaddy, Namecheap, Google Domains (now Squarespace), Cloudflare or Network Solutions.
2. The hosting, the server space where the site's files and database are stored.
3. The website itself, meaning the WordPress, Wix, Squarespace or custom admin login where pages get edited.

Lose control of the third one and you cannot edit the site. Lose the second and the site can go offline. Lose the first and you lose the address itself, and with it your email if it runs on the same domain. The domain is the one that hurts the most, and it is the one owners think about the least.

What happens when a designer disappears

It is rarely dramatic. The designer retires, changes careers, stops answering email, or the agency gets bought. The site keeps working, so nobody notices. Then one of these happens:

• The domain comes up for renewal on a card that no longer works, and the renewal notices go to the designer's inbox. The site and the email stop working the same morning.
• You want a change made and nobody can get in.
• You hire someone new and they cannot move the site because the old provider will not hand over the hosting login.
• The business sells, and the buyer's lawyer asks for proof that the business owns its domain. There is none.

A consultant came to us this summer because her email had stopped and her domain was redirecting to another site. The domain was registered in 2004 and still renewing on a card every year, but nobody knew which registrar account held it. The web company that built the site had not had access since 2019. The account's recovery address was the very mailbox that had stopped working. Weeks of registrar support and bank statements later, the answer to "who owns your domain" was still "nobody, really." Do not let it get there.

When a domain expires, you are not out of options right away, but the clock runs fast. Under ICANN's Expired Registration Recovery Policy, registries have to offer a 30-day redemption period after a domain is deleted, during which the name can be recovered for a fee. Registrars usually have their own grace period before that. After the redemption window closes, the name can be released and anyone can register it, including domain squatters who watch for exactly this.

How to find out who owns your domain

This is the ten-minute check.

Step 1: Look it up. Go to lookup.icann.org and type in your domain. You will see the registrar (the company it is registered with), the creation and expiration dates, and the name servers. Most contact details are hidden by privacy services these days, but the registrar name and the expiration date are what you need.

Step 2: Find the registrar account. Do you have a login at that registrar? If the answer is "I think my designer set that up," email them today and ask for the account to be transferred into your name, or for you to be added as the account owner. The account should be under an email address at your business that more than one person can reach.

Step 3: Check the expiration date and the payment method. Turn on auto-renew with a company card, and set a calendar reminder a month before expiration anyway. Cards expire. Auto-renew fails quietly.

Step 4: Check the lock. Registrars apply a transfer lock to stop unauthorized moves. Note that after a change of registrant details, ICANN's transfer policy requires a 60-day hold before the domain can be moved to another registrar. That matters if you are planning to switch providers: update the ownership first, then wait, or move first and update after.

If you cannot get the registrar account back from whoever holds it, the registrar's support team can sometimes help if you can prove you are the business (an LLC filing, a utility bill, a trademark). It is slow and not guaranteed. This is why you want to settle it now, while everyone is still friendly.

The hosting account

Hosting is where things get murky, because a lot of designers host client sites on their own reseller account. That is not automatically a problem, and it is how I run things too, with sites hosted on a VPS in a secure, reliable data center. The difference is what you get in writing.

Ask your designer or hosting company these questions:

• Is the hosting account in my name, or yours?
• If it is yours, what happens to my site if you stop doing this?
• Can I get a full copy of my site (files and database) on request?
• Where are the backups, how often do they run, and have you ever restored one?

A good provider answers all four without flinching. Nightly backups and regular security scanning should be part of the plan, and you should be able to get a copy of your site any time you ask. I wrote more about what a hosting plan should actually include in What's included in website hosting.

The website admin login

For WordPress sites, you want an administrator account with your own email address, not an editor account. For Wix or Squarespace, the site should sit in an account you own, with your designer added as a contributor. For a custom-built site, you want the admin login and a written note on where the code is stored.

Then store all of it somewhere sane. A password manager with a shared business vault is the right tool. A sticky note in the designer's desk drawer is not.

The ownership checklist

Print this and fill it in. If any line is blank, that is your homework.

Two things on that list surprise people. First, DNS. Your domain can be registered at one company while the DNS records (the settings that point the domain at your website and your email) sit at another. You need both. Second, email. If your email runs on your domain, the domain controls your email. An expired domain means no email, which is a worse day than no website.

What to ask before you hire anyone

Whether you are hiring a freelancer, an agency, or a local company like mine, ask these up front and get the answers in writing:

1. Will the domain be registered in my name, in an account I control? The only acceptable answer is yes.
2. Will I have an admin login to the finished site? Yes, on day one.
3. If we part ways, what do I get, and how fast? You should get the full site and a clean handoff, not a ransom note.
4. Who owns the design, the photos and the written content? You paid for it. It should be yours.
5. Is the hosting month to month? You should be able to leave without a penalty. I host month to month with no long-term commitment, and I think that is the only fair way to do it.

A designer who gets defensive about any of these is telling you something.

How I handle it

When I build a site for $500 and host it for $35 a month, the domain is yours, the admin login is yours, and if you ever want to leave, you get a full copy of the site. I would rather keep clients by doing good work than by holding the keys. That is also why most of my clients can update their own hours, photos and specials without calling me.

If you already have a site and are not sure where the pieces are, that is a normal starting point. Takeovers are a regular part of my week.

The bottom line

Own your domain, own your hosting account, own your admin login, and keep the logins somewhere your business can reach them. Check it this week, not the week the designer stops answering. It costs nothing to verify and a great deal to recover.

Not sure who owns your website? I can sort it out as part of a rebuild or on its own. See how our websites work or get in touch and tell me what you have. Related reading: Moving your website off GoDaddy, Wix or Squarespace and What happens when nobody maintains your website.