Every few months a client tells me the same thing: "The site is mine, I log in every week." Then we open the WordPress menu together, and it turns out they cannot install a plugin, cannot switch the theme and cannot add a second administrator. The login was real. The control was not.
A business website is not one object. It is five records in five separate systems, each with its own provider and its own login, so a change in one changes nothing in the other four. Below are all five, with a test for each that you can run yourself in about fifteen minutes.
One honest note. Two sections are jurisdiction specific: the domain part describes Poland's .pl registry run by NASK, and the rights part describes the Polish copyright act. The WordPress, hosting and Google Business Profile parts are universal, because those are product rules rather than national law. Every quote below is my working translation from the Polish original, not an official English text.
The five records
- Domain registrant - the entity written into the domain name registry.
- Hosting account - the server holding your files, database and mail.
- Administrator role in WordPress - the account allowed to touch plugins, themes and users.
- Owner of the Google Business Profile - the account steering your listing in Maps and Search.
- Rights to the code and graphics - the contract saying what you may do with the site.
1. The menu test: five seconds, no guessing
Log in and look at the left-hand menu for four items: Plugins, Appearance, Users, Settings. If any is missing, you are not an administrator.
That is not guesswork. WordPress gates each of those items behind a capability:
// Menu item => capability required to see it
'Plugins' => 'activate_plugins',
'Appearance' => 'switch_themes', // or edit_theme_options
'Users' => 'list_users',
'Settings' => 'manage_options',
Administrator holds all four, plus install_plugins and edit_users. Those two decide who else ever gets into the site.
Editor holds none of the four, even though an Editor publishes other authors' content. An Editor gets edit_others_posts, publish_pages, manage_categories, moderate_comments and upload_files, among others.
Here is the trap nobody warns you about:
'Tools' => 'edit_posts', // an Editor has this, so an Editor sees Tools
Tools requires only edit_posts, so its presence proves nothing. This is why the test fails silently: you look at Posts, Media, Pages, Comments and Tools, decide the panel looks complete, and never register the four items that are gone. Absence is much harder to notice than presence.
Contractors usually do this for an innocent reason: an Editor cannot break the plugins or the theme. The cost to the client is still hard. An Editor cannot install a plugin, change the theme, add a second administrator or revoke anyone else's access, which means cannot move the site, cannot secure it, cannot hand it to somebody new.
The role is a row in a database that any administrator changes in one click. If the test failed, ask for Administrator in writing and state the address the account should use. Then keep two admin accounts, one daily and one spare.
2. The domain: registrant, not payer
Under .pl there is no owner in the everyday sense. The NASK regulations use the term subscriber (Polish: abonent), the entity that concluded the agreement to maintain the domain name, and define the handover as:
"Change of Subscriber - transfer of all rights vested in the Subscriber and obligations burdening the Subscriber under the Agreement, to a third party."
Subscriber data goes into WHOIS, the public database run by NASK. But publication is consent based:
"In the case of natural persons, their consent is required for the publication of personal data, in accordance with applicable law."
A sole proprietorship is a natural person too, so without consent the field stays blank, and a blank field is not evidence that the domain is somebody else's. WHOIS also lags the authoritative registry by up to fifteen minutes.
Separate two roles that get conflated: the registrar is the company you buy and renew from, while NASK is the registry running the rules, the central system and WHOIS.
Check in this order: WHOIS first, because it is one click and shows the registrar even when subscriber data is hidden. Then the registrar panel, where you need your own login. Then the renewal invoice, which shows who pays and to whom, since paying is not the same as being the registrant. Renewal reminders go to the email on the registrar account, so if that inbox is your developer's, you learn about expiry last.
3. The hosting account: files, database, backups
Hosting is not WordPress. WordPress is the application, hosting is the server it runs on.
The hosting panel is where you manage site files, the database and the mailboxes in your company domain, and where you download a full backup. A WordPress login gives you none of that, so you cannot migrate the site, and you cannot recover it if somebody drops the database.
Verify three things in the panel:
- Your own login, not one shared with your developer.
- Your company name in the account details.
- The email attached to the account, because password resets and server invoices land there. If it is your developer's inbox, the account is not yours.
Mail is often the most painful loss, since losing hosting means losing every address in your company domain along with the correspondence. DNS is configured in the same panel, which is exactly why the two services get confused.
4. Google Business Profile and measurement accounts
The profile knows two roles, owner and manager, with a primary owner singled out. Google puts the difference in one sentence:
"Managers have almost the same access to the profile as owners. The only exception is that they cannot add or remove users, or delete the profile."
A manager publishes posts and answers reviews, but cannot remove the contractor from the user list and cannot pass the profile to anyone else.
Check your role under More, then Business profile settings, then Users and access. Google also names one condition for the transfer:
"to transfer primary ownership, the profile must have at least 1 other owner or manager."
Think of a photo studio that spent years collecting reviews. That history belongs to the profile, not to the person, and whichever account governs the profile governs the history. Analytics and Search Console work the same way and are often created on an agency account, so run the same check in both.
5. Code, theme and photos
A paid invoice proves settlement, not a transfer of copyright. The Polish copyright act sets three conditions, all easy to check against your own paperwork (working translations):
- Form, art. 53: "An agreement on the transfer of economic copyright requires written form under pain of nullity."
- Scope, art. 41(2): a transfer or licence "covers the fields of exploitation expressly listed therein."
- Silence, art. 65: "In the absence of an express provision on the transfer of the right, it is deemed that the author has granted a licence."
The code is a work as well, art. 74(1): "Computer programs are protected like literary works."
So no written agreement means no economic rights, an agreement moves only the fields of exploitation it names, and silence means a licence rather than ownership. Premium theme and plugin licences are a separate problem when bought on the contractor's account, because the site stops receiving updates once the cooperation ends.
Ask for three things: the premium plugin list with the account each was bought on, the source files of the graphics, and the logo. Without source files, every banner edit starts from zero.
This is not legal advice. A dispute over rights ends at a lawyer, not at a web designer.
The fifteen minute audit
| What you check | Where you click | Red flag |
|---|---|---|
| Domain registrant | WHOIS, then registrar panel | No login of your own to the panel |
| Hosting account | Account owner details | The account email is your developer's |
| WordPress role | The left-hand menu | Plugins, Appearance, Users or Settings missing |
| Google Business Profile | Profile settings, Users and access | Your account is listed as manager |
| Rights to code and photos | Contract and licence list | No fields of exploitation named |
What I learned
The menu test is the cheapest diagnostic I know and the one clients believe instantly, because it turns a vague worry into a yes or no in five seconds without anyone's cooperation.
The pattern also travels where the statutes do not. Registry records, hosting account holders, product roles and written transfers of rights exist in every jurisdiction under different names, so the same five checks surface the same five gaps. And do not accept screenshots as proof: you have access when you log in yourself, change the password, and see where the reset email lands.
Originally published on mrdesigngarwolin.pl - my Polish blog about WordPress, web design, and SEO for small businesses.
Top comments (0)