Who Actually Owns Your Website? (And How to Check in 10 Minutes)
You paid for it, so you own it. Often not — the domain, the hosting and the Google listing are routinely in someone else's name. Here's how to check each one.
An invoice is not a deed. You can pay for a website in full, be delighted with it, and still not own the one part of it that matters.
This isn't a warning about scams. It's about something much more ordinary, which is why it catches so many people: the accounts that hold your business online were opened by whoever was closest to a keyboard on day one, and nobody wrote down whose name went on them.
Here's how to find out where you actually stand, including the part where your developer isn't the villain.
Why this happens, and why it usually isn't theft
Almost every case I've seen started as a convenience, not a trap.
Someone is building your site. They need a domain today. Asking you to create a registrar account, verify an email, and put a card on file adds a day and a phone call — so they register it on the account they already have open, fully intending to move it later. Then the site launches, everyone is pleased, and "later" never arrives.
Multiply that by hosting, by the Google listing, by the analytics property, and by four years. Add the very common Indian version, where a small agency runs everything through a single reseller panel because that's how their hosting is priced. Then add the part that turns it from untidy into a problem: the person who set it up moves on, and the agency that inherits the account has no idea which of their two hundred domains is yours.
Nobody set out to hold your business hostage. That's exactly why nobody fixed it.
The five things you should own
They're separate accounts, and they can each sit with a different person. Check them one at a time.
1. The domain
The single one that matters. Everything else can be rebuilt in a fortnight; a domain your customers have had on a signboard for six years cannot.
How to check: a WHOIS lookup will often show a privacy service, which tells you nothing useful. The real test is simpler — who gets the renewal email? If it doesn't land in your inbox, it isn't your account. The second test: log in to the registrar yourself and see whether you can generate a transfer code without asking anyone.
A bad answer sounds like: "Don't worry, it's on our account, it renews automatically."
2. The hosting account
Where the site actually lives. Less critical than the domain — hosting is replaceable, and a site can move over a weekend — but it's the thing that gets switched off first when a relationship sours.
How to check: ask for the login. Not a screenshot of the dashboard, the login. If you're on a reseller panel, you may not be able to have one, which is itself the answer.
A bad answer sounds like: "It's bundled into the maintenance plan."
3. The site itself — code, content and database
For a custom build, this is the source code. For WordPress, it's the theme, the plugin licences and the database, which together hold every page you've ever published and every enquiry you've ever received.
How to check: ask for a full export, today, for your records. A developer who owns their work will send it. If the request produces friction rather than a file, you've learned something more useful than the file.
A bad answer sounds like: "You wouldn't be able to do anything with it anyway."
That last one is often true and completely beside the point.
4. The Google Business Profile
The most commonly misplaced item on this list, and for a local business frequently worth more traffic than the website. Google distinguishes between an owner and a manager, and a great many business owners are, on paper, managers of their own listing.
How to check: open the profile and look at who's listed as the primary owner. If that's your agency, you can be removed from your own reviews.
A bad answer sounds like: "We handle the Google page for you."
5. Analytics and Search Console
The least urgent and the most quietly annoying to lose, because history doesn't transfer. Start a new analytics property and you start at zero — every year of before-and-after evidence stays behind.
How to check: you should be listed with admin rights on the Google Analytics property and as an owner in Search Console. If you've never seen either, that's your answer. (If you're not sure the site is even being measured properly, that's a related and very common problem.)
The ten-minute audit
Go down this list before you read any further. It genuinely takes about ten minutes.
| What | The question | You're fine if |
|---|---|---|
| Domain — renewals | Who receives the renewal notice? | It arrives in your inbox. If you've never seen one, the account isn't yours. |
| Domain — control | Can you log in and generate a transfer code? | You can, without asking anyone. Needing permission is itself the answer. |
| Hosting | Do you have the account credentials? | You have a login. "It's on our server" is not a login. |
| Code and content | Can you get a full export today? | The file arrives. A request that stalls tells you more than the file would. |
| Google Business Profile | Are you the listed owner? | You're the owner. Manager — or not listed at all — is a gap. |
| Analytics | Do you have admin on the property? | You can log in yourself. Emailed screenshots mean you can't. |
| Business email | Whose account is the domain on? | Yours. If it's someone else's, they hold your password resets too. |
Nobody scores seven out of seven. Two or three gaps is normal. The domain row is the one that's worth acting on this week.
Why it only ever surfaces at the worst possible moment
This sits harmlessly for years, and then all of it arrives at once — because the moment you discover it is, by definition, the moment you wanted to change something.
You want to move to a new developer. You're negotiating a renewal you think is too expensive. The agency has stopped replying to emails. Your card expired, the auto-renewal failed, and the notice went to an inbox nobody checks.
That last one is the genuinely dangerous version, and it doesn't require anybody to behave badly. A lapsed domain doesn't wait politely. It goes back on the market, and there is an entire industry watching for expiring domains with real traffic.
Whatever the trigger, you find out the same way: you ask for something, and the answer is that it'll take a while.
The test
One question, and it's not rhetorical:
Could you move your website to a new provider this month, without needing anybody's permission?
If the honest answer is no, then what you bought wasn't quite a website. It was a subscription to one — which is fine, if that's the deal you knowingly signed. The other post on pricing asks the same thing from the money side: if you stop paying, what do you still have? This is that question with the paperwork attached.
It's the same distinction as renting your audience on Instagram versus owning a site — except here, most people believe they're already on the owning side.
If the answers were bad, fix it without starting a fight
Assume a mess, not a motive. It's the accurate assumption almost every time, and it's also the one that gets you your domain back fastest.
- Ask plainly, in writing. "I'm tidying up our accounts. Could you transfer the domain to a registrar account in the business's name, and add me as owner on the Google profile?" No accusation, no lawyer voice. Most of the time this is the entire process.
- Ask for the auth code. Domain transfers between registrars need one — variously called an auth code, an EPP code or a transfer key. Asking for it by name signals you know what you're doing, which tends to shorten the conversation.
- Expect a lock, and don't panic about it. If the domain was registered or transferred recently, or the contact details just changed, there's typically a 60-day window where it can't move again. It's a standard anti-hijacking rule, not obstruction.
- Claim the Google profile properly. There's a request-ownership flow built into Google Business Profile. The current owner gets a window of a few days to respond; if they ignore it, you can generally take it over. Slow, but it works without their cooperation.
- Get the export while everyone is still friendly. Content and database now, not during the argument.
- If it's genuinely stuck, remember the leverage isn't as one-sided as it feels. You can rebuild on a new domain — it costs you rankings and reprints, which is a real cost and not a fatal one. Knowing that changes how the conversation goes.
What to put in the next contract
Four lines, whoever builds your next site — including me. Any builder who objects to these has told you something important for free.
- The domain is registered to the business, in the business's own registrar account.
- Hosting is in the business's name, or is portable on request.
- Source code, content and database are handed over on request, in a usable form, at any time.
- Google Business Profile, Analytics and Search Console list the business as owner. The builder gets access, not ownership.
Questions people actually ask
My developer says the domain has to be in their name for technical reasons. Is that true?
No. There's no technical reason a domain must sit in the builder's account. They can be given full management access to a domain you own and do every single thing they need to do. Convenience is a real reason and a fair one to state out loud — "technical necessity" isn't.
I don't want another login to look after.
You don't have to look after it. Owning an account and operating one are different jobs: the registrar account is in your name and your developer has access to it. You'll interact with it roughly once a year, when the renewal email arrives — which is exactly the email you want to be receiving.
I paid for the website. Doesn't that make the code mine?
Not automatically, and this surprises people. Unless the agreement says otherwise, what you bought may be a licence to use the work rather than ownership of it. It rarely matters until it does. One sentence in the contract settles it permanently, which is why it's on the list above.
Everything's working fine. Is this worth touching?
The check is worth ten minutes today regardless. Whether to act depends on one row: if the domain isn't yours, fix that this month. The rest can wait for a natural moment — a renewal, a redesign, a new developer. Fixing it calmly costs an email. Fixing it during a dispute costs weeks.
What about my business email?
Frequently the same account, and frequently overlooked. If your email runs on your domain, whoever controls the domain controls your email — including password resets for everything else you own. That's the quiet reason the domain row outranks the others.
The short version
The website is the visible part, and it's the replaceable part. What's worth protecting is duller: an account in your name, a renewal notice in your inbox, and a copy of your own content on your own drive.
Ten minutes. Do the audit before you need the answer, because the day you need it is the day it's hardest to get.
Not sure how to read what you found? Send it over — I'll tell you which rows actually matter for your situation, whether or not you ever build anything with me.