Who should own your domain, hosting and website logins?

Your business should own every account your website depends on: the domain, hosting, DNS, email, analytics, Search Console, Google Business Profile, social accounts, the code repository and the CMS admin. "Own" means the account is in the business's name, uses an email address the business controls, and is paid for by the business. Your web designer, agency or IT person should have their own login with a role that lets them do the work. That way, if the relationship ends, you remove one user instead of begging someone for your own website.

This sounds obvious, but it is one of the most common problems we see when a business comes to us for a redesign. Here is how to set it up correctly and how to check what you have today.

Why ownership matters more than access

Access lets someone use an account. Ownership decides who can add and remove people, transfer the asset, close the account or move it somewhere else.

When a vendor owns your accounts, you depend on them for things that have nothing to do with their work: renewing the domain, adding a new marketing hire, switching hosts, or proving to Google that you run your business. Most vendors are honest and will hand things over. But people retire, businesses close, email addresses stop working and relationships go sour. Ownership protects you from all of that.

The horror stories (all too common)

We will not name anyone, but these patterns come up again and again:

• The domain in the designer's personal account. The designer registered the domain years ago "to make it easy." Now they will not answer email, and the domain is about to expire.
• The agency-owned analytics. An agency set up Google Analytics under its own account. When the contract ended, the business lost access to years of traffic data.
• The ex-employee's Gmail. The Google Business Profile, Facebook page and hosting were all tied to a former employee's personal email. Getting them back took weeks of support tickets.
• The hostage website. A vendor built the site on their own server and will only release the files for a "transfer fee" that was never in the contract.
• The lapsed domain. The renewal notices went to an old email address nobody checked. The domain expired, email stopped working, and someone else nearly bought the name.

Every one of these is avoidable with an hour of setup.

The domain: be the registrant of record

Your domain name is the most important asset on this list. Whoever controls it controls your website address and your email.

Every domain has a registrant, the person or organization that holds the registration. That is the owner of record. The registrant contact should be your business's legal name and an email address the business controls, ideally a shared one like admin@ or it@ rather than one person's inbox.

ICANN, the organization that sets the rules for domains like .com and .net, has a Transfer Policy that explains what registrants can expect. According to ICANN's registrant FAQ:

ICANN's board approved a set of revisions to the Transfer Policy in 2026, and they will roll out over time. The basics above still apply as we write this, but check icann.org for the latest version before you plan a move.

A few practical steps:

• Turn on registrar lock so no one can transfer the domain until you turn the lock off. It is your main defense against domain hijacking.
• Turn on auto-renew with a card that will not expire soon.
• Use two-factor authentication on the registrar account.
• Keep renewal emails going to a shared inbox so they do not die with one person's job.

If you bought your domain through GoDaddy or a similar company, our guide to GoDaddy domains and hosting walks through where these settings live.

Hosting, DNS and email

Your web hosting account should also be in the business's name. If an agency hosts your site on its own server as part of a care plan, that can be fine, but get in writing that you own the files and database and can get a full copy on request.

DNS controls where your domain points: your website, your email and the records that prove your email is legitimate. Whoever controls DNS can break your email in seconds. It often lives at your registrar or at a service like Cloudflare. Make sure that account is yours too. Our post on DNS, SSL and email authentication explains what those records do.

Email (Google Workspace, Microsoft 365 or similar) should have a business-owned super admin account. That account controls every mailbox, so protect it carefully.

Analytics, Search Console and Google Business Profile

These three Google tools hold years of data about your customers and your search visibility. Each has its own role system, which makes it easy to give access without giving up ownership.

Google Analytics 4. The account and property should be created under a Google account your business controls. Google's access management guide lists five roles: Administrator (full control, including managing users), Editor (changes settings but cannot manage users), Marketer (manages audiences, events and key events), Analyst and Viewer. Keep at least two Administrators inside your business. Most agencies only need Editor or Marketer. See our GA4 setup guide for the rest.

Search Console. Google's permissions guide separates verified owners (who proved ownership with a token, such as a DNS record or HTML file), delegated owners, full users and restricted users. Your business should be a verified owner, ideally through a DNS record. Give your agency full user access. One catch from Google: removing someone's verification token does not delete it automatically, so a former owner can re-verify until the token is gone. When a vendor leaves, remove their user and their token.

Google Business Profile. Google's owners and managers page says a profile can have many owners but only one primary owner. Managers can do almost everything owners can, except add or remove users and delete the profile. Your business should be the primary owner. Your agency should be a manager.

Social accounts, code and the CMS

• Social media. Facebook and Instagram pages should belong to your business's Meta business portfolio, with your agency added as a partner. LinkedIn company pages should have at least two admins from inside your business.
• Code repository. If your site is custom built, the code should live in a GitHub (or similar) organization your business owns, with the developer invited as a member. Our GitHub guide for website owners shows how.
• CMS admin. In WordPress, Webflow, Shopify, Squarespace or Wix, the business should hold the top-level owner or administrator account. Developers get their own named login, not a shared password.

The ownership checklist

Use this table to audit your setup. Fill in the middle column with a name, then check it.

Store every login in a business password manager, not a spreadsheet, and give at least two trusted people access to the vault.

How to give agencies access the right way

1. Create accounts first, then invite. Set up each account under the business, then add the agency as a user.
2. Use the lowest role that works. This is called least privilege. An SEO contractor needs Search Console full user access, not ownership of your domain.
3. Use named logins. Each person gets their own user so you can see who did what and remove one person without changing everyone's password.
4. Put it in the contract. State that you own the domain, content, design files, code and accounts, and that the vendor will hand everything over when the work ends.
5. Review access every quarter. Remove anyone who no longer works with you.

What to do if a past vendor controls your domain

1. Ask nicely, in writing. Most vendors will hand things over. Ask them to change the registrant to your business or move the domain into your own account, and keep a record of the request.
2. Find out who the registrar is. A WHOIS or RDAP lookup will show the registrar even when contact details are hidden.
3. Contact the registrar's support team. If you can show you are the registrant, or that the domain belongs to your business, they can explain their recovery process. Have your business documents, invoices and old emails ready.
4. If a transfer is wrongly denied, use ICANN's complaint process. ICANN's registrant FAQ says you can submit a Transfer Complaint through ICANN's compliance forms if a registrar improperly denies a transfer or is not following the Transfer Policy. ICANN deals with registrar compliance; it does not decide who owns a name in a business dispute.
5. If the vendor is listed as the registrant and refuses, talk to an attorney. Your contract, invoices and trademark rights may matter.

While you sort it out, keep the domain from expiring. Losing it entirely is far worse than a slow transfer.

Get it right at launch

The easiest time to fix ownership is before a new site launches. If you are planning a project, our list of questions to ask a web agency includes ownership questions you should ask up front, and our guide to choosing web hosting covers what to look for in a host.

Not sure who owns what? Talk to us and we will help you run the audit and move everything into your business's name.