On this page
Most people find out the answer to this at the worst possible moment: when they want to change agency, or when the person who built the site five years ago stops replying to emails.
“My website” is not one thing. It is five, they can each be owned by a different party, and only one of them is genuinely hard to replace.
The five pieces
| Piece | What it is | If you lose access |
|---|---|---|
| Domain name | The address people type | Serious. This is the one that really hurts. |
| Hosting | The server the files sit on | Annoying, but you can move |
| The code | Theme, templates, custom work | Depends entirely on the contract |
| Content | Words, images, your customer data | Recoverable if you have a backup |
| Accounts | Analytics, Search Console, DNS, email | Rebuildable, but the history is gone for good |
The domain is the one that matters
Everything else on that list can be rebuilt given time and money. The domain cannot — it is either registered to you or it is not, and if it is not, your options are to ask nicely or to start again at a different address.
It should be registered in your company’s name, in an account somebody at your company can log into, with billing on a card you control and renewal notices going to an address that will still exist after a particular employee leaves. A shared inbox beats a personal one.
If your agency registered it for you as a convenience — extremely common, and usually done with no bad intent at all — it should be transferred into your name. There is no reason to wait for a reason.
Check it in two minutes
Look your domain up on any WHOIS service and see whose name is on it. If privacy protection hides the details, log into the registrar directly — and if you cannot log into the registrar, you have just found the problem.
While you are in there, check two more things: that auto-renew is on, and that the card attached has not expired. A domain that lapses goes through a grace period and then becomes available to anybody, and there is a small industry built on catching exactly that.
Hosting: on your account or theirs?
Plenty of agencies resell hosting. There is nothing wrong with it — it is often cheaper than buying your own, and it means one person to call when something breaks.
The question is not who pays the bill. It is whether you could leave. You want to know you can get a complete copy of the site files and the database on request, without a negotiation and without a delay.
Ask for a backup once a year even if you never use it. An agency that hands one over without fuss is one you can trust. An agency that gets defensive about it has just told you something important, and it is better to learn it on a quiet Tuesday than in the middle of a dispute.
The code is where contracts matter
This is the genuinely grey area, and it is far easier to settle before the work starts than after.
- Work made for you — your custom theme, templates and any bespoke features. Normally yours outright, but only if the contract says so. In the absence of a clause, the default in many jurisdictions is that the creator keeps copyright and you have a licence to use it, which is not what most clients assume they bought.
- Licensed third-party code — premium plugins, fonts, stock photography. Licensed, not owned, and licences are often per-site and annually renewable. Find out whose account they sit in, because that account is what receives the security updates.
- The studio’s own toolkit — internal frameworks reused across clients. You are unlikely to own this and that is entirely reasonable. What you want in writing is a perpetual right to keep using it on your site, including if you take the site elsewhere.
One practical point that costs nothing to consider at the start and a great deal to discover later: a site built on an open platform like WordPress can be exported, handed over and hosted anywhere. A site built inside a closed platform generally cannot leave that platform at all — you would be rebuilding, not migrating.
That is not a reason to avoid closed platforms; they have real strengths and for many businesses they are the right answer. It should simply be a decision you made rather than a fact you found out. We go through the trade-offs in four platforms, honestly compared.
The accounts everyone forgets
These should all be created under your organisation’s accounts, with your agency added as a user. Not the other way round. The difference costs nothing on day one and is the whole ballgame on the day you part company.
- Google Analytics and Search Console — years of history you cannot recreate. Losing these means losing the ability to tell whether anything you do next works.
- Google Business Profile — for anyone with a location, this often sends more customers than the website does.
- DNS — sometimes at the registrar, sometimes somewhere else entirely. Whoever controls DNS controls where your website and your email point.
- Email, if it runs on your domain.
- Payment gateway and newsletter accounts — these hold customer data, which makes them your responsibility regardless of who set them up.
- Any SSL certificate that is not issued automatically.
A checklist worth doing this afternoon
Whatever state things are in, half an hour spent on this is the cheapest insurance available to you.
- The domain is registered in the company’s name, and somebody here can log in
- Auto-renew is on, with a card that is not about to expire
- Renewal notices go to an address that survives staff changes
- You hold a recent backup of the files and the database, somewhere other than the server
- Analytics and Search Console are owned by your organisation
- You know who controls DNS
- The contract says who owns the custom code
- More than one person internally knows where all of this lives
That last point is the one most often missed. Plenty of businesses have everything correctly in their own name and exactly one person who knows the passwords.
This is not about distrust
Good agencies want clients to have all of this, because a client who could leave and chooses not to is a far better relationship than one who is stuck. Being hard to leave is not a business model worth having.
If you are not sure where you stand and want a second opinion, ask us. It is a short conversation and we are not going to charge you for it.
