Who Actually Owns Your Website, Code and Accounts?

Most business owners assume they own their website. A surprising number are wrong, and they find out at the worst possible moment — when they want to change supplier, when a renewal lapses, or when the person who set everything up stops answering.

This isn't usually malice. It's how things get set up when nobody asks the question at the start. Someone needed a domain quickly, so they registered it on their own account. Someone needed hosting, so it went on the agency's reseller plan. Nobody wrote down who controls what, and years later it's a problem.

Here's what you should control, how to check whether you do, and what to do if you don't.

The nine things you should own

1. The domain name. The single most important one. It should be registered to your company, in an account you control, with your billing on it. If it expires or someone else holds it, nothing else matters.
2. The hosting account. Where the site actually lives. Being on an agency's reseller plan isn't automatically bad — it's often cheaper and better managed — but you should be able to get a full backup and move if you choose to.
3. The code. Whatever was built for you, in a form you can hand to another developer. If it's custom, that means a repository you can access, not a zip file someone might email you.
4. The CMS admin. An administrator login, not an editor one. Editor access means you can change text but not permissions, plugins or other users.
5. The DNS. Where the domain points. Whoever controls DNS controls where your email and website go — which makes it more powerful than most people realise.
6. Business email. The mailbox accounts themselves and the admin console. If your email runs through a supplier's account, a dispute can take your email down with it.
7. Analytics and search tools. Your own Google account should own the property, with others invited as users. Historic data is difficult or impossible to recover if it lives in someone else's account.
8. Ad accounts. If you run advertising, the account and its payment method should be yours, with the agency added as a user. An agency-owned ad account means their history, their pixel, and your audiences left behind if you leave.
9. Design source files. The editable originals — logo vectors, brand files, design files. Exported PNGs and PDFs are outputs, not sources. Without the originals, the next designer has to rebuild from scratch. (More on what a full set looks like in logo vs brand identity.)

How to check, this week

Take thirty minutes and answer these honestly:

• Can you log into your domain registrar right now, without asking anyone?
• Whose name and email are on the domain registration?
• Can you reach your hosting control panel and download a full backup?
• Do you have administrator access to the CMS, with the ability to add and remove users?
• Do you know where DNS is managed?
• Is your Google Analytics property owned by an account your company controls?
• If you asked for the design source files today, would you receive them within a week?

Anything you answered "I'd have to ask" to is a dependency. It may be a perfectly comfortable one — plenty of businesses are happy for a trusted supplier to manage all of it — but you should be choosing that, not discovering it.

What a good arrangement looks like

Managed access is fine. Missing access is not.

A reasonable setup: you own the accounts, and your supplier is added as an administrator or user. They do all the work, you never log in, and if the relationship ends they're removed. Nothing has to move, nothing has to be recovered, nothing is negotiated under pressure.

The version that causes problems: everything is in the supplier's accounts and you're a guest, or not present at all. It usually works fine until the day it doesn't.

What your contract should say

Worth checking before you sign anything, and worth reading if you already have:

1. Ownership on final payment. Deliverables, source code and source files transfer to you when the project is paid. Some agreements retain rights indefinitely, or grant only a licence to use what you paid for.
2. Handover is defined. What you receive, in what format, at what point. "Files" is not a specification.
3. Third-party components are identified. Most builds include licensed elements — themes, plugins, fonts, stock images. You should know which licences are yours, which are transferred, and which are the supplier's.
4. Exit terms exist. What happens when the relationship ends, who assists with migration, and whether that assistance costs extra. A supplier confident in their work has no reason to resist this clause.
5. Maintenance and ownership are separate. Paying for a care plan shouldn't be what keeps you in control of your own domain.

If ownership is already contested, or the contract says something different to what you were told, that's a question for a lawyer rather than an article. The specifics vary by jurisdiction and by exactly what was signed.

If you don't have access

Don't start with an accusation. Most of the time this is disorganisation, not hostility, and a calm request gets it resolved.

1. Ask plainly and in writing. List exactly what you want: registrar login, hosting access, admin user, DNS, analytics ownership, source files. Written requests create a record and tend to get actioned.
2. Offer the managed-access route. "We'd like the accounts in our name, and we'll keep you on as administrator" removes the fear that you're leaving, which is often what's behind the delay.
3. Know what's replaceable. Hosting can be rebuilt. Code can be rewritten, expensively. A domain with your traffic and email on it cannot simply be recreated — that one is worth escalating quickly.
4. Get the domain sorted first, whatever else happens. Everything else has a workaround.

How we handle it

Everything we build transfers to you on final payment: source code, source files, accounts, documentation. That applies whether it's a website, an app or a brand.

Where practical we set accounts up in your name from the beginning and add ourselves as administrators, rather than the other way round. It's a small administrative difference at the start and it removes an entire category of problem later.

And if you leave, we help you go. Assisting a migration is a cheaper thing to be known for than being the agency that made leaving difficult.

If you're about to commission a new site rather than untangle an old one, how to brief a project before you ask for quotes is the place to start, and what a website costs in Dubai covers the other questions worth asking before you pay a deposit.

The short version

You should own the domain, the hosting, the code, the CMS, the DNS, your email, your analytics, your ad accounts and your design source files.

Your supplier can manage all of it. That's a different thing from holding it.

Spend thirty minutes this week checking. If it turns out you control everything, you've lost half an hour. If it turns out you don't, you've found out while it's still a conversation rather than a crisis.