Checking who really controls your website

Four places ownership hides

The domain registration, the hosting account, the website admin login and the content and files are four separate things. They can sit under four different names without anybody noticing.

A site can look like yours in every visible way while one of these belongs to a former designer. The checklist below is how you find out. This page is general information and not legal advice.

The usual surprise is that nobody acted in bad faith. They end up under another name because it was convenient on day one, when nobody thought about year five.

Start with the domain registrar

Look up your domain in a public registration lookup and see which company registered it. Then find out whose login manages it. The registrant should be your business, with an email you read.

If the registration shows a designer or an agency, ask them to transfer it to you in writing. Our page on domain, hosting and website explains how the pieces fit.

If you cannot find a registrant at all, the details may be hidden behind a privacy service. In that case, ask your registrar to show which account holds the domain and who its listed contact is.

Then the host and the site login

Find out who pays for hosting and whose card is on file. If a builder runs your site, check who created the account and which email is the owner.

An account opened by a freelancer on their own email is theirs to close. Ask for owner access and add a second person from your own side so no single login holds everything.

Do the same for any service connected to the site, such as an analytics account, a booking tool or a form service. Each has its own login, and each can quietly belong to somebody else.

A checklist to run once a year

Run the list below at least yearly, and again whenever somebody who touched the site leaves. Write down the answers where more than one person can find them.

Store the answers somewhere safe but shared, such as a password manager that supports a second person. A note in one person's email is the very situation you are trying to avoid.

• Domain registrant is your business, not a person or vendor
• Domain login email is an address you control
• Domain auto-renews on a card that is current
• Hosting or builder account is under your own email
• At least two trusted people hold admin access
• You can download the site files or an export
• Passwords live in a password manager, not an email thread

Content, photos and the files

Text and photographs may have been supplied by you, by a writer or by a stock library. Ask for licenses for any images you did not take, and keep the originals of anything you did.

If a provider made your site, ask what you receive if the relationship ends. A full copy of the files is the plainest answer, and a refusal is worth knowing before you need it.

Where a photo came from matters too. A picture lifted from a search result may belong to someone else, so keep a record of where each image on your site was obtained.

What happens if you leave a provider

Ask any provider what happens to your site when you cancel, and get the answer in writing. In Website Builder Studio, published sites stay live for 30 days after you cancel and you can download your site files.

Your domain stays at your registrar either way, because going live on your own domain needs only one DNS record. Legal pages are yours too: you upload them and they publish as given. Our contract checklist covers what to confirm with any vendor.

Take one more precaution: write a single page that says who to call, which accounts exist and where the logins live. Print it and keep it with the business papers.