Who Actually Owns Your Website and Domain Name?
Paying for it doesn't mean you control it — here's how to check who really owns your domain, hosting, and site files before it's too late.
You own your domain name and website if you control the accounts where they live. Paying someone to register a domain or build a site does not automatically give you that control. If your developer registered the domain under their own registrar account or built your site on hosting they manage, they own it until they hand you the logins — and many never do.
This matters most when the relationship ends. The developer moves on, stops responding, or closes up shop. You want to switch providers or update the site yourself. Suddenly you discover you cannot log in to your own domain registrar, you do not know where the site is hosted, and the credit card on file for renewals is not yours. Your domain expires or gets held hostage. It happens constantly.
The difference between paying for it and controlling it
When someone registers a domain, the registrar creates an account. Whoever controls that account controls the domain. The registrant listed in the public WHOIS record is supposed to be the legal owner, but what actually matters day-to-day is who can log in to the registrar and change settings, transfer the domain, or turn off auto-renew.
You can be listed as the registrant and still be locked out if the account login, password, and recovery email belong to someone else. You can pay the invoice every year and still not own it if the payment is going to a developer who then pays the registrar from their own master account.
The same applies to hosting. Your site files live on a server somewhere. Whoever controls the hosting account can delete the site, lock you out, or take it offline. The admin login to your WordPress or site builder account is a third layer — you can have that and still lose everything if someone else controls the hosting underneath it.
The audit: what to check right now
Run this checklist today, before you need it.
Your domain name
Go to a WHOIS lookup tool and search your domain. Note the registrar — the company where the domain is registered, like Namecheap, GoDaddy, or Cloudflare. That is where you need an account.
Try to log in to that registrar. If you do not have login credentials, you do not control the domain. Ask whoever set it up to either transfer the domain to your own registrar account or give you the login and help you change the account email and password to yours.
Check the payment method on file. Whose credit card is set for auto-renew? If it is not yours, the domain can lapse when that card expires or the other person cancels it.
Check the registrant contact in the domain settings inside the registrar. It should be you or your business. If it lists your developer or a privacy service, that is a red flag but not fatal — what matters more is account access.
Confirm you can access DNS settings. DNS is the address book that points your domain to your website and email. If you can log in and see DNS records, you control where your domain points. If those settings live somewhere else — like Cloudflare or your hosting provider — make sure you have login access there too.
Your hosting
Find out where your site is hosted. Your developer should tell you. If they will not or you cannot reach them, you can sometimes find clues by looking up your domain's IP address in the DNS records and running a reverse lookup, but that is not always conclusive.
Log in to the hosting account. You should have your own login, not a sub-account created under someone else's master account. Check the billing and confirm your payment method is on file.
Confirm you can access the site files. In most hosting accounts, that means cPanel, FTP, or SFTP access. If your site is on WordPress, log in to the WordPress admin and check that your account has the Administrator role. Then confirm you can access the hosting control panel behind it — WordPress admin is not enough if someone else controls the server.
Download a backup of your site files and database. If you can do that, you have what you need to move the site if you ever have to.
Everything else
Check your email hosting. If your business email runs through Google Workspace, Microsoft 365, or another provider, make sure you own that account and the payment is yours.
Check your analytics. If you use Google Analytics, confirm the account is yours or that you have Owner-level access. Same with Google Business Profile, Facebook Pages, or any other property tied to your business. These often get set up under a developer's personal Google account, and you lose access and all your history when they leave.
What a clean handoff looks like
When you hire someone to build your site or manage your domain, ask these questions up front:
Will the domain be registered in my name, under my own registrar account? If they register it for you, will they transfer it to an account I control as soon as it is set up?
Will I have my own hosting account, or will my site live under a reseller or agency master account? If the latter, what happens if I leave or you close?
Will I receive all logins — registrar, hosting, DNS, WordPress admin, email, analytics — along with recovery email access and two-factor backup codes?
A good provider will say yes to all of this and walk you through it. They may offer to manage renewals and backups for you, but you should still have the logins. Management is a service you can cancel. Ownership is not.
When the work is done, the handoff should include a simple document: every account name, every login URL, every username, and a password manager export or a secure way to reset passwords yourself. Test every login while they are still around to fix it if something is wrong.
What to do if you are locked out now
If you are locked out of your domain, start with the registrar's account recovery process. If the registrant email is yours, you may be able to reset the password. If it is not, contact the registrar's support and explain the situation. They will ask for proof you are the legitimate owner — business registration, trademark, prior invoices. It is slow and not guaranteed, but it is the formal path.
If your developer is reachable but uncooperative, send a written request for the transfer and document everything. In some cases, a lawyer's letter moves things along. If the domain is registered in your name or your business name in the WHOIS registrant field, you have a stronger legal claim.
If the domain is truly gone, you may have to register a new one and redirect the old one if you ever get it back. It is a nightmare. This is why the audit matters now, while everything is calm.
Why this happens
Most of the time, it is not malicious. A developer registers the domain under their own account because it is faster, or because they plan to manage renewals as part of the service. They do not think about what happens when the client wants to leave or they retire. Some developers use reseller hosting and genuinely believe the client "owns" the site because they can log in to WordPress — but the hosting account itself is still in the developer's name.
Sometimes it is intentional leverage. A client who cannot leave without losing their domain is a client who keeps paying.
Either way, the fix is the same: get the logins, confirm you control the accounts, and keep that documentation somewhere safe.
You should be able to fire any provider — including us — and walk away with everything that belongs to you. If you cannot, you do not own it yet.
Common questions
Can I own a domain if someone else registered it for me?
Yes, but only if they transfer it to a registrar account you control. Being listed as the registrant in WHOIS is not enough — you need the actual login credentials and account access to manage, renew, or transfer the domain.
How do I transfer a domain to my own registrar account?
Log in to the current registrar, unlock the domain, and request an authorization code (also called an EPP code or transfer code). Then create an account at your preferred registrar and initiate a transfer using that code. The process typically takes five to seven days.
What happens if my domain expires and I don't control the registrar account?
The domain will renew automatically if a valid payment method is on file in that account — or it will lapse if not. After expiration, most registrars hold the domain in a grace period, then a redemption period with higher fees, and eventually release it for anyone to register. If you don't control the account, you can't stop this process.
Do I need separate logins for my domain, hosting, and website admin?
Often yes. Your domain registrar account controls where the domain points. Your hosting account controls the server where your site files live. Your WordPress or site builder admin controls the content. You need access to all three to fully control your online presence.
Need a clean slate?
We'll build your site, hand you every login, and make sure you own it all from day one.