Originally published at Sites You Own.
Here's a fun little game. Ask your web developer, "Hey, whose name is the domain in?" Then watch his face.
If he says "yours, obviously" and sends you a login, lovely. Close this tab and go have a coffee. If there's a pause, a nervous laugh, and the phrase "it's kind of complicated", stay with me. You might be paying rent on a website you think you own.
I've been building websites since 2007. I have seen domains registered to a developer's personal Gmail, hosting billed to an agency's card at a 400% markup, and one "proprietary CMS" that turned out to be WordPress with the logo swapped out. Most of these people weren't villains. Some were just disorganized. A few were absolutely running a protection racket with a nice logo.
Either way, the fix starts with knowing. And knowing takes about five minutes.
Minute 1: Who Owns the Domain?
Your domain is the big one. It's your web address and, usually, your email too. Lose it and both go quiet on the same morning.
Go to ICANN Lookup and type in your domain. You'll see the registrar (the company it was bought from) and the expiry date. If the owner details show, check the registrant name. Is it your business? Or is it "Dave's Web Solutions"?
Often the details are hidden behind privacy protection. Fine. The real test is simpler: can you log into the registrar account yourself? Not "Dave can log in for you". You, with your own email and password.
If the answer is no, the domain is yours in the same way a hotel room is yours. Nice while it lasts.
The classic move here is the developer who "helpfully" registered your domain in his own name, "just to save you the hassle". Very kind. He also saved you the hassle of ever being able to leave.
Minute 2: Who Owns the Hosting, and Who Pays?
Hosting is where your website's files actually live. Ask two questions. Whose account is it? And whose card gets charged?
If you get a yearly invoice from your developer for "hosting and maintenance", that's not automatically bad. Some people do look after things properly. But if you've never seen the hosting company's name, never had a login, and the invoice went up 30% because "server costs", it's worth a closer look. Decent hosting for a small business site costs somewhere around $5 to $30 a month. I've seen people pay $90.
The healthy setup: the account is in your name, billed to your card, and your developer is added as a user you can remove. When the project ends, you click a button. No awkward phone calls.
Minute 3: Are You an Admin, or Just an "Editor"?
Log into your website's back end. (If you don't have a login, that's your answer, and it's not a great one.)
On WordPress, go to Users and look at your role. If it says Administrator, good. If it says Editor, you can change text and photos but you can't install anything, add users, or take a backup. You're allowed to rearrange the furniture. You're not allowed to own the house.
Now the "proprietary CMS". If your agency built your site on its own special system that nobody else can touch, ask one question: "If I leave, can I take a working copy of my site with me?" A long silence is a complete sentence.
While you're there, check your contract. In the US, a site built by an independent contractor belongs to the contractor unless a written agreement transfers the rights. Paying for it isn't the same as owning it. Annoying, but true.
Minute 4: Analytics, Search Console and Google Business Profile
This is the sneaky one, because nobody thinks about it until they need it.
Your Google Analytics holds years of visitor history. Search Console tells you how Google sees your site. Your Google Business Profile is what shows up on Maps when someone searches "plumber near me" at 11pm with water on the floor. All three should belong to your Google account.
Open each one and look at the users or owners list. If you aren't listed as an owner, or you can't even get in, ask for owner access. A developer only ever needs to be a user. If your Business Profile is owned by an agency, you are one canceled contract away from losing your reviews. Those took years. Don't hand them over for free.
Minute 5: Email and DNS
DNS is the switchboard that tells the internet where your website and email live. It sits either with your registrar or with a service like Cloudflare. Same rule as everything else: you should have your own login.
Then check your business email. Is it on a Google Workspace or Microsoft account you control? Or is it "set up somewhere" by the same developer who now replies to texts once a lunar cycle? If someone else controls DNS, they control whether your email arrives. That's a lot of trust to place in a guy whose last message to you was a thumbs-up emoji in March.
So the Answer Was "Not Me". Now What?
First, breathe. Don't send the angry email. I know you want to. Put it in drafts and sleep on it.
In my experience most of these messes are laziness, not evil. The developer set it up in his own account because it was quicker, then got busy, then forgot. Make it easy for him to say yes.
Ask politely, and ask in writing. Something like: "Hi, I'm tidying up my business accounts. Could you move the domain and hosting into accounts in my name, and make me an administrator on the site? Happy to pay for an hour of your time." That last line works wonders.
Ask for the auth code. To move a domain to a registrar you control, you need its transfer code (also called an Auth-Code or EPP code). Under ICANN's rules, the registrar has to make it available to the domain holder. Open your own registrar account first, then ask for the code.
Mind the order. Changing the registrant name or email can trigger a 60-day transfer lock at many registrars. If you're moving registrars anyway, transfer first, update the details after. My blog on who should own your domain and hosting walks through this step by step.
Get a full backup. Files and database, not just "I'll send you a zip of the images". Keep it somewhere that isn't his laptop.
Don't burn the bridge. You might still want this person's help. Even if you don't, people who feel cornered get slow. People who feel thanked get fast.
Keep the paper trail. Invoices, contracts, emails. If someone flat out refuses, that evidence is what the registrar's dispute team, or eventually a lawyer, will want to see. Honey first. Lawyers much, much later.
The Five-Minute Scorecard
If you can say yes to all of these, congratulations, you own your website:
- I can log into the domain's registrar account, and the domain is in my business's name.
- The hosting account is mine and it's billed to my card.
- I'm an Administrator on my website, and I can take a working copy if I leave.
- I'm an owner on Analytics, Search Console and my Google Business Profile.
- I control my DNS and my business email.
Three yeses out of five? Pretty normal, honestly. Pick the missing two and sort them this month, before a renewal reminder lands in someone else's inbox.
Why I Bang On About This
I didn't call my business Sites You Own by accident. Every site I build starts with the domain, hosting and admin accounts in the client's name. I get user access, not the keys. When we're done, you get everything, in writing, with no "exit fee" and no hostage negotiation. You can read exactly how that works on my process page.
Not sure who owns what on your current site? Or you checked, and the answer was "Dave"? Send me a message and I'll help you work it out. If it's time for a fresh start, we build sites you actually own. That's the whole idea. See what we do.
Your Turn
Did you run the check? How many yeses did you get out of five?
And if you're a developer reading this: whose name do you register client domains in? Be honest. 👇
Want a second pair of eyes? Read the original post or book a free 20-minute call and we'll work out who owns what, together.
Top comments (0)