Who actually owns your business website?

Most owners answer the ownership question with the part they can see. They paid for the website, so they assume they own it. Paying the invoices and controlling the website are different things, and the gap usually stays invisible until something needs to change: a new provider, an urgent fix, a renewal nobody receives, or a person who has left.

None of this needs bad intent. A designer registers the domain in their own account because it is quicker at the time. A former employee sets up Google Analytics with a personal address. The person who knew where everything lived moves on. Each decision made sense on the day. Together they leave the business depending on people it may no longer be able to reach.

Use this as a map. For each part, the question is not only "who has it?" but "could we get it back, or replace it, without that person's help?"

It would be easy to conclude that a business should hold every account itself. That is not always practical or even safer. A provider who operates your DNS and hosting properly, with documented access and a written exit process, is often a better arrangement than an owner holding passwords they never use and cannot safely operate.

The useful distinction is this:

• Hold it yourself: the domain registration and the registrar account. This is the one part almost every other recovery depends on. Whoever controls the registrar can move the nameservers, and the nameservers decide where the website and email point.
• Know who holds it, and on what terms: everything else. DNS, hosting, code and security services can sensibly sit with a provider, as long as the business knows exactly where they are, who can act on them, and what it receives if the relationship ends.

A provider operating parts of your website is not the risk. Not being able to name what they hold, or not having a way to get it back, is the risk.

The agency registered the domain in its own account

This is common and usually started as a convenience. While the relationship is good, it causes no visible problem. It means, though, that the agency controls renewal, the nameservers and any future transfer. Ask for the domain to be moved into a registrar account in the business's name. Most registrars support moving a domain between accounts, or a transfer to another registrar, and a cooperative provider can do it in a short session.

The freelancer who built the site cannot be reached

The urgency depends on what they held. If the domain is already in your name, most other things can be rebuilt or reconnected. If the domain, DNS and hosting were all in their accounts, recovery is slower and needs care. Our guide to what to do if your web designer disappears sets out the order to work in.

Nobody knows the Cloudflare login

If your domain's nameservers point to Cloudflare, whoever holds that Cloudflare account controls your DNS, including the records your email depends on. Find out whose account it is. If it is a provider's account, that can be perfectly reasonable, as long as it is written down and you have a current export of the records. If nobody knows, the DNS can still be moved by changing the nameservers at the registrar, but only after you have a full copy of the records, or email can stop working.

A former employee owns the Google Analytics property

Analytics and Search Console are often set up with whichever address was to hand. When that person leaves, the business can lose access to years of data. Add a business account as an owner or administrator while the person is still reachable, then remove personal accounts. For Search Console, the business can verify ownership again itself through a DNS record, which is one reason knowing who controls DNS matters.

The business pays the invoices but has no administrative access

Paying for a service gives you a contract, not a login. If every account is administered by the provider, the business relies entirely on that relationship continuing. That can be a deliberate and sensible choice. It should still come with a written description of what the provider holds, what you receive if you leave, and how quickly.

You can answer most of this in an afternoon, without technical help.

1. 1. Look up your domain. A domain lookup service shows the registrar and the nameservers. For .uk domains, Nominet's WHOIS lookup shows the registrar; for most other endings, ICANN's lookup does the same.
2. 2. Sign in to the registrar account. If you cannot sign in today without asking someone, you do not yet control the domain.
3. 3. Check the recovery details. The account's email address and phone number should belong to the business, not to a provider or a former employee.
4. 4. Find out who hosts the DNS. The nameservers tell you which company. Then find out whose account it is.
5. 5. Ask your provider for a written list of every account they hold for you, and what you receive if you leave.
6. 6. Check Google Analytics and Search Console and confirm a business account is an owner or administrator.
7. 7. List every recurring charge connected to the website, and who receives each renewal notice.

Our website access checklist goes through each category in more detail, including who should have access and how to remove access that is no longer needed.

Ownership problems are cheapest to prevent before a website is built. Before signing with any provider, check that the agreement says:

• whose account the domain will be registered in;
• who will hold the DNS, hosting and code, and in whose name;
• who owns the content, copy and design once they are paid for, and which parts the provider keeps and licenses to you;
• what you receive when the relationship ends, how quickly, and whether anything is held back until invoices are paid;
• that email records will be kept working during any handover.

If you are already planning a change, our guide to moving your website to a new provider sets out the order to work in.

A good provider will be able to answer each of these in writing without hesitation. Our guide to website hosting versus website management covers the other half of the question: who is responsible for operating the website day to day.

On every Dettogni service, the domain and the registrar account stay in the client's name. Dettogni operates the DNS and hosting, and does not need the client's registrar password to do it. Where a change is needed at the registrar, the client makes it from written instructions, or grants limited access for that job. If a client leaves, every DNS and email record is handed over within two working days, and the site files follow once the account is settled.

• What website access should a business owner keep?
• How to move your website to a new provider
• What happens if your web designer disappears?

All resources