Make Sure Your Business Owns Its Domain, Hosting and Accounts
Check that your business, not a former developer or employee, controls its domain, hosting, email, website admin and analytics, and how to get access back if it does not.
Table of Contents
Many businesses discover too late that their domain is registered in a former developer's name, their hosting is paid from a freelancer's account, or the only admin login belongs to an employee who left. Check now that your business is the registrant of its domain and the owner of its hosting, email, website admin, analytics and key service accounts, with credentials the business controls. If not, fix it while everyone is still cooperative.
What your business should own
| Asset | What "owned" looks like |
|---|---|
| Domain | Registered in the business's legal name; registrant email is a business address; account login held by the business |
| DNS | Managed in an account the business controls |
| Hosting | Account in the business's name, paid by the business, with admin access |
| Mailboxes on the business domain, managed in a business account | |
| Website admin | At least one administrator login belonging to the business (not shared with the developer) |
| Code and design files | The business has a copy and the rights agreed in writing |
| Analytics and Search Console | The business owns the properties; agencies get user access |
| Social media and ad accounts | Owned by a business account; staff and agencies get roles |
| Payment and courier accounts | In the business's name, with business banking |
How to check your domain
- Do a WHOIS lookup on your domain (for example with the ServerNeed WHOIS lookup) to see the registrar and status. Personal details may be hidden; see what is WHOIS.
- Log in to the registrar account, or ask whoever manages it, and check the registrant name and email.
- Check the expiry date and that auto-renew is on.
Why it matters
- Leverage: whoever controls the domain controls your website and email.
- Continuity: if the person holding access leaves, falls out with you or simply stops responding, you may be locked out.
- Legal clarity: in a dispute, the registrant is the domain's holder.
- Security: accounts you cannot see are accounts you cannot secure.
If someone else holds your accounts
- Ask politely and in writing for the registrant details to be changed to the business, and for admin access to be granted to a business account.
- Transfer the domain to a registrar account the business owns, if needed; see domain transfer explained. Note that a change of registrant can trigger a temporary transfer lock.
- Move hosting to a business account, or have the provider transfer ownership.
- Create business-owned admin accounts on the website, analytics and social platforms, and downgrade others to appropriate roles.
- Change passwords and enable 2FA once you hold the accounts.
If cooperation fails, registrars and platforms have processes to prove ownership, which are much easier with documents showing the business paid for and used the service. Keep invoices and contracts.
Example: recovering control after a developer left
A shop's website was built three years ago by a freelancer who has since stopped responding. The owner can edit products but has no hosting or domain logins. The steps they took:
- WHOIS lookup: the domain is registered at a well-known registrar, expiring in five months, with registrant details redacted.
- Evidence gathered: invoices showing the business paid for the domain and hosting, emails with the freelancer about the website, business registration documents.
- Registrar contact: the owner contacted the registrar's support, explained the situation and followed its process for proving ownership, which involved documents and verification.
- Hosting: the hosting company was identified from the server's IP address and the site's response headers; its support had a similar ownership process for the account, which was in the freelancer's name.
- Meanwhile, a backup plan: the owner exported products and content from the WordPress admin (which they could still access) and prepared new hosting, in case recovery failed.
- Outcome: after the registrar's verification, the domain was moved into a new account in the business's name, with 2FA and auto-renew on.
The process took weeks. Five minutes spent on correct ownership at the start would have avoided it.
A yearly ownership review
- Domain registrant is the business; contact email is a business address
- Hosting account in the business's name, with two people able to log in
- All admin logins in the business password manager
- Analytics, Search Console and social accounts owned by business accounts
- Former staff and contractors removed
- Renewal dates and auto-renew checked
Good practice going forward
- Register everything in the business's name, using role email addresses such as
[email protected]. - Store credentials in a business password manager, accessible to at least two trusted people.
- Give developers and agencies their own user accounts with appropriate roles, never your main login.
- Remove access promptly when people leave.
- Include ownership and handover terms in every web development contract.
- Review access once a year.
Questions to ask your developer or agency
- In whose name is our domain registered, and at which registrar?
- Who owns the hosting account, and can we have admin access?
- Do we have an administrator login to the website that only we use?
- Will we receive the code, design files and documentation?
- What happens to our accounts if we stop working together?
Frequently Asked Questions
Is it a bad sign if my developer registered the domain?
It is common and often done with good intentions, but the domain should be in the business's name. Ask for it to be updated.
Can a former developer take my website down?
If they control the domain, DNS or hosting, they technically can. That is why ownership should sit with the business.
Do I need my own hosting account if the agency manages everything?
The business should own it, or at least have a contract that guarantees access and handover. Agencies can still manage it with their own user roles.
Related reading
See preventing domain hijacking and how to take your business online. Register domains in your business's name with the ServerNeed domain search.
Sources
Featured image: “Leeds Castle 22-04-2012” by Karen Roe, licensed under CC BY 2.0.
Last updated 7 October 2026
