Who owns my website? A guide for business owners

The call usually starts the same way. "Our web guy has stopped answering, the site's down, and we can't get into the email." Then the real question: who owns my website, if he has all the passwords?

The short answer: you should own every piece of it, in your company's registered name, with logins you control. A website is really nine separate things, from the domain to the ad accounts, and each has its own owner on paper. If any of them sits in your designer's name, you own less than you think.

Website ownership is really nine separate questions

Most articles on this topic stop at "make sure you own your domain". But a business can have the domain in the right name and still be stuck, because the Google Ads account, the hosting login and the only copy of the code belong to a freelancer who has since moved on.

Piece	Whose name it should be in	What goes wrong if it isn't
Domain name	Your company, as registrant, with a company email address	You can't move registrars or renew without the other person
Hosting account	Yours, or the agency's with a written right to your files	Site disappears when their invoice goes unpaid
Files and database	Yours, with a downloadable copy	You rebuild from scratch
CMS or admin login	An administrator account in your name	You can't change a phone number without asking
Business email	Your domain, your admin account	Staff mailboxes held by an outsider
Google Business Profile	You as primary owner	Your reviews and map listing sit in someone else's account
Google Analytics and Search Console	You as administrator or owner	Years of traffic history lost on handover
Google Ads and Meta ad accounts	Your business, agency added as partner	Campaign history and audiences leave with the agency
Images, fonts and code copyright	Licenses and a written assignment in your name	Takedown notices, or a dispute over who may reuse the code

The domain: who actually holds it

A domain such as yourcompany.com is sold to you by a registrar (the company you pay each year) and recorded in a central registry for that ending. For .com, .net, .org and most other common endings, registrars work under rules set by ICANN, the body that coordinates domain names. Three points are worth knowing.

First, you don't own a domain the way you own a vehicle. You register it for a set period and keep it by renewing. Whoever is listed as the registrant holds that registration, so the registrant field is the closest thing you have to a title deed.

Second, the registrant is free to move the domain to another registrar. ICANN's transfer rules for registrants say a registrar must provide the transfer authorization code within five calendar days of a request, and may refuse a transfer only in limited circumstances. That protection belongs to the registrant, though. If your designer registered the domain under their own business, the rules protect them.

Third, and most people miss this: transfer codes and approval emails go to the contacts on the registration. If the registrant email is your designer's Gmail address, the approval lands in their inbox. The same ICANN rules say that changing the registrant's name, organization or email can block a move to another registrar for 60 days, so fix those details well before you need to transfer. Your company name with somebody else's email is half a fix.

Hosting, files and the admin login

It's normal for an agency to host your site on its own servers, and often better, because someone who knows the build is watching it. (Ours are run by our own in-house Unix team.) What matters is what happens when you leave: you should get a full copy of your files and database on request, in a format another host can use.

The admin login is the day-to-day test. You need your own administrator account, not a shared password the designer can change. If updating your business hours means emailing someone, you're renting.

One warning from our own work. When we rebuilt a page-builder site into custom PHP, the old site's backups turned out to contain exposed SSH keys and database credentials. Handovers are where this surfaces, so when access comes back to you, change every password and have someone look at what's actually on the server.

Email, Google and ad accounts

These get forgotten, and they're often worth more than the website.

Start with your Google Business Profile. Your map listing and every review you've collected live here. Google lets only the current primary owner transfer primary ownership, and only to someone who's already an owner or manager on the profile. If a marketing person set it up under their own Google account, they have to add you first. Ask while you're on good terms.

Analytics and Search Console work the same way: your agency should be a user on your property. A new property starts with no history.

Google Ads and Meta ad accounts should sit under your own business, with the agency given partner access. Campaign history, audiences and pixel data belong to the account, so they leave with whoever owns it. We run ads for clients ourselves, and this is the one we'd push hardest on: an agency that insists on running your spend from its own account is making it expensive to leave.

Then email. Whoever controls the domain's DNS controls where your mail goes, so your company needs the admin login for the mailbox service as well as the mailboxes.

Copyright in the code: the part nobody explains

Paying for a website doesn't automatically give you the copyright. Under the US Copyright Act, work an employee creates as part of their job is a "work made for hire", and the employer is treated as its author. An outside designer or agency is different.

For an independent contractor, the Act's definition of a work made for hire only covers a commissioned work if it falls into one of nine listed categories (a contribution to a collective work, a translation, a compilation and so on) and both parties have signed a written agreement saying so. A custom website's code doesn't fit neatly into that list, so don't rely on it. Where the work isn't made for hire, the copyright starts with whoever created it, even though they were paid. And section 204(a) of the Act says a transfer of copyright ownership isn't valid unless it's in writing and signed by the owner of the rights. A verbal "of course it's yours" transfers nothing.

In practice: get a clause assigning copyright in the work to your company once it's paid for. Open-source libraries and an agency's reusable tools are fair exceptions, licensed rather than assigned. Images work the same way. A stock license bought on the designer's account is the designer's license, so ask for it in your name.

This is general information, not legal advice. For a dispute, speak to an intellectual property attorney.

Platform lock-in is a quieter kind of not owning your website

Some website builders don't let you take your site with you at all. Wix's help center says plainly that your site must run on Wix's servers. You can move the domain and copy your text out by hand, but the site stays. For a small business that can be a fair trade. For a company spending real money, know it before you start.

WordPress is better: the files and database move to any host, though you're tied to its plugins and page builder and their licenses. A custom site in plain HTML, CSS, JavaScript and PHP is the most portable of all, and runs on practically any standard Linux server. We compared the three in custom website vs WordPress vs an AI builder.

Check this today: a ten-minute ownership audit

Look up your domain in the ICANN Lookup tool. Check who is listed as the registrant, and note the registrar and expiry date. Registrant details are often redacted for privacy, so if your company doesn't show, log in to the registrar account and check there.
Check which email sits on the registrant contact, and change it to a company address like domains@yourcompany.com.
Log into your hosting control panel yourself. No login? Ask for one, or for a full backup.
Confirm you have your own website administrator account.
In Google Business Profile, open People and access and check who the primary owner is.
In Google Analytics and Search Console, check that someone at your company is an administrator or owner.
In Google Ads and Meta Business settings, check which business owns the ad account.
Search your website contract for "copyright" and "assign".

If all eight come back in your name, you're ahead of most businesses we speak to.

What to do if your web designer won't give access

Usually the designer isn't malicious, just overloaded, unpaid or gone. Start there.

Ask in writing. One email listing what you need (registrant change, transfer code, hosting backup, logins, Google and Meta access) with a reasonable date.
Settle anything genuinely owed. It's usually the cheapest route.
Go to the registrar. If the domain is in your company's name, the registrar can help you update the contact details and get back into the account.
Use the domain dispute process if it fits. If someone registered a domain matching your trademark in bad faith, ICANN's Uniform Domain-Name Dispute-Resolution Policy lets you file a complaint with an approved dispute-resolution provider. It's built for trademark disputes, so take advice before you rely on it.
Recover what you can on your own. Google has a process for requesting ownership of a Business Profile, and your content can be copied from the live site.
Get an attorney involved if the amounts are meaningful or the copyright is in dispute.

What a good handover looks like

Picture the version where none of this is a problem. The registrant record shows your company and a company email. You have every login and a copy of the files. Your agency is a user on your Google and Meta accounts. If you move on, it's a week of admin.

At X3WEB, the domain, website and ad accounts are always in the client's name, and we don't hold anything hostage when someone leaves. If you're comparing agencies, our guide on how to choose a web design company has the questions worth asking, and ownership is near the top.

If you've run the checklist and something came back in the wrong name, send us your domain and tell us what you found. We'll tell you honestly what it'll take to get it back, whether or not you work with us. You can meet the team first.

Frequently asked questions

Who owns my website if a designer built it?

The domain belongs to whoever is listed as registrant, and copyright in the code depends on your contract. Without a signed written assignment, it usually stays with whoever wrote it. To be safe, get the domain in your company's name and a signed written copyright assignment.

How do I check who owns my domain?

Look it up in the ICANN Lookup tool. It shows the registrar and expiry date, and sometimes the registrant organization; personal details are often redacted for privacy. If you can't see your company there, log in to your registrar account, where the registrant contact is shown in full.

Can I transfer my domain if my web designer won't give access?

If you're the registrant, yes. Ask the registrar for the transfer authorization code, which ICANN's rules say must be provided within five calendar days. If the domain is in the designer's name, they need to change the registrant first, or you'll need legal advice on your options.

Can my web designer legally keep my website?

They can keep what's genuinely theirs, like a hosting account in their name or code they own copyright in. Holding a domain registered to your business, or your Google and ad accounts, is much harder to justify. For a real dispute, speak to an attorney.

Do I own my Wix or website builder site?

You own your content and can move your domain, but a Wix site can't be exported to another host. If you leave, you rebuild. A WordPress or custom-coded site moves with its files and database.

Who owns my website? A plain guide for business owners