Website Ownership: Who Really Owns Your Domain, Hosting and Content?
Paying for a website doesn’t automatically grant you website ownership. Your domain name, hosting, code, themes, plugins, content, and analytics accounts all follow different rules: some may belong to you, while others are just licenses or access rights. When people search “who owns my website” online, it’s often too late, usually during a dispute. This guide breaks down every element, explains how to check what is in your name, what to include in your contract, and provides a method for switching web design companies without losing your site or SEO rankings. A self-assessment tool lets you evaluate your situation in minutes.
At a glance
- True website ownership means having the domain name, hosting, and analytics accounts in your name, along with the rights to the code and content created for you.
- The domain name is the most critical element: its official registrant controls everything else.
- The core of a CMS is open-source, but premium themes and plugins are just licenses, often in the buyer’s name.
- Rights to custom development and designs are transferred via a written assignment clause in your contract.
- Before switching web design companies, gather your logins, backups, and licenses, then plan the transfer to protect your SEO.
Website Ownership: What the Concept Really Means
True website ownership means having the power to decide its future alone: modifying it, moving it to another host, handing it over to a new provider, or shutting it down, without relying on someone else’s approval. In practical terms, this requires three things: essential accounts must be in your name, you must hold the rights to what was created for you, and you must have access to a full backup of the site.
A website is not a single object. It is an assembly of elements with different legal statuses: a domain name leased from a registry, hosting space provided by a host, open-source or proprietary software, licensed themes and plugins, custom-coded features, copyrighted text, photos, and fonts, plus third-party service accounts. Each must be verified separately.
Ownership, License, or Access Right: What Are the Differences?
Three concepts constantly come up, and confusing them is the root of most disputes.
- Ownership or Title: You are the official registrant (domain name) or the rights holder (assigned code and designs). You can make decisions independently.
- License: You have the right to use an element under conditions set by its publisher (premium theme, plugin, font, stock photo). This right is not always transferable and may be in the buyer’s name.
- Access: You have a login to connect (to the site admin, to a dashboard). Access can be revoked by the account owner.
| Element | What can be yours | What is just a license or access | Proof to keep |
|---|---|---|---|
| Domain name | Ownership, if you are the registered owner | Access to a third party’s registrar account | RDAP / WHOIS record, registrar account in your name |
| Hosting | The contract and account, if in your name | Space on an agency’s shared server | Contract, invoices, account credentials |
| Files and database | Your data and content | A copy held only by the provider | Recent, tested full backup |
| CMS (WordPress, PrestaShop…) | The right to use it freely (open-source license) | An agency’s proprietary CMS | CMS name and version, license |
| Theme, premium plugins | A license in your name | An agency “developer” license | Invoices and license keys in your name |
| Custom development | Economic rights, if assigned | A simple right of use | Assignment clause in the contract |
| Text, photos, logo | The rights, if assigned or created by you | A limited use license | Contract, stock image licenses |
| Analytics, Search Console, Ads | The account, if created in your name | Guest access on the agency’s account | Administrator or owner role |
The Domain Name: The Key to Website Ownership
The domain name is your website and email address. Whoever is the registrant decides where it points, can transfer it to another registrar, or let it expire. If your domain is registered in your agency’s name, they legally control your address.
A domain name is never bought permanently: it is leased for a renewable period from a registrar (like GoDaddy, Namecheap, OVHcloud, or Gandi), which registers it with the extension’s registry (Verisign for .com, CIRA for .ca, Nominet for .co.uk). What matters is the official registrant: the person or company named in the registration.
How to check who owns my domain name?
Use the ICANN lookup tool (lookup.icann.org) for generic extensions, or the national registry tool for country codes like .co.uk or .ca. Since data protection rules (like GDPR) took effect, the registrant’s name is often hidden for individuals, but the tool shows the registrar and expiration date. To be sure, log into the registrar account: if the domain isn’t in an account under your name, ask your provider for a screenshot of the registrant record, or request a domain transfer to your own account.
Transferring a domain name to your name
Two different operations exist: a change of registrant (the domain goes into your name, at the same registrar) and a registrar transfer (the domain moves to a new provider). For a transfer, you need an authorization code from the current registrar, and the domain must be unlocked. For generic extensions like .com, a registrar can deny a transfer within 60 days of registration or a previous transfer, and a registrant change can trigger a 60-day lock unless opted out beforehand (NameSilo). ICANN approved a reform of these rules in June 2026, which is still being implemented; national extensions follow their own procedures. For a national domain like .ca or .us, local presence requirements apply to the registrant.
Never let your domain expire
An expired domain can be bought by a third party, sometimes in just a few days, taking all the traffic and emails associated with it. Enable auto-renewal, use a contact email you actually check, and save a valid payment card. Think about emails too: if your company mailboxes use your domain name, losing the domain means losing the address your clients use to reach you. The DNS records that run your email, verify your Google accounts, or sign your emails (SPF, DKIM, DMARC) depend on the domain registrant. Note who manages the DNS zone, and make sure you have access to it. To understand each component’s role, read our article on domain names, hosting, and CMS.
Web Hosting and Databases: Demand Full Access
Hosting is the space where your site’s files and database are stored. Two situations are common: your site is hosted on an account in your name with a hosting provider, or it is installed on a server belonging to your agency, alongside their other clients’ sites. In the second case, you often have no direct access.
Getting full and secure access
At a minimum, request access to the hosting control panel, the database, and the files (SFTP or SSH), or alternatively, a regular full backup delivered to a space you control. If the agency provides the hosting, the contract must state that these elements will be handed over upon request within a specific timeframe, including at the end of the contract. If you need help managing this, our website maintenance plans include secure hosting management and regular backups.
The database data belongs to you
Orders, customer accounts, contact requests, and content saved in the database are your data. As the data controller, you are responsible for them under regulations like GDPR, CCPA, or PIPEDA. A provider cannot hold them hostage: they act as a data processor and must return them to you.
Source Code, CMS, Themes, and Plugins: What Do You Really Own?
This is the most technical part, and where misunderstandings happen most often.
The CMS core
WordPress, PrestaShop, Drupal, or Joomla are open-source software, distributed under the GPL or a similar license. Nobody “owns” them in the traditional sense: anyone can use, modify, and install them elsewhere. This is a major advantage for portability. Conversely, a proprietary CMS developed by an agency can make you dependent: check if it’s possible to export the site and its content if you leave.
Premium themes and plugins
Paid themes and plugins are sold under a license, often annual, which grants access to updates and support. Many agencies use “developer” licenses valid for all their clients. The day you leave, the theme usually keeps working, but without security updates. Request that important licenses be purchased in your name, or ensure their cost and transfer are outlined.
Custom development
A theme developed specifically for you, a custom plugin, or an ERP integration are works protected by copyright. In most jurisdictions, including the US and UK, economic rights remain with the creator unless they are assigned in writing with a specific clause (rights assigned, media, territory, duration). Without a written assignment, you often only have a right of use. Our guide on website intellectual property details these rules.
Our maintenance contract leaves all accounts in your name
Content, Photos, and Fonts: Copyright Traps
Text and visuals created for you
Text written by an agency, a logo designed by a graphic artist, or photos taken by a photographer remain the property of their creator until an assignment is signed. An invoice is not enough. Make sure the quote or contract specifies that the rights are assigned for the intended use (website, social media, print, advertising).
Stock photos and fonts
A photo purchased from a stock image bank comes with a license, often tied to a specific name. If the agency bought it in their name, you might not have the right to reuse it elsewhere. Fonts are also subject to licensing: some are free for web use, while others are billed based on website traffic. Ask for a list of the images and fonts used, along with their licenses.
What about AI-generated content?
Text and images produced by artificial intelligence raise a new issue: under current copyright laws in the US, UK, and Europe, a creation without sufficient human creative input is difficult to protect with copyright. If your provider uses AI, ensure the contract specifies who assumes responsibility for the content, how it is verified, and who owns it.
Analytics, Advertising, and Social Media Accounts
Your website’s data is often worth more than the site itself. Google Analytics, Google Search Console, Google Business Profile, Google Ads, Meta Business, Google Tag Manager, Bing Webmaster Tools: each of these accounts accumulates years of history.
Keeping control of your traffic data
Create these accounts yourself, using a company email address, and grant access to your provider, rather than the other way around. If an account already exists in the agency’s name, ask to become an administrator or owner. For Google Ads, campaign history and ad quality scores are tied to the account: losing access means starting from scratch.
Accounts you shouldn’t forget
Email accounts linked to the domain, the transactional email sending account, the email marketing tool and its contact lists, the store’s payment gateway account, the CDN or firewall (like Cloudflare), and the backup tool account. Any of these can block a migration if forgotten.
What to Write in the Contract
Most conflicts are resolved before they even start, right in the creation or maintenance contract. Here are the clauses we recommend.
- Ownership: The domain name, hosting, and third-party accounts are registered in the client’s name, who receives the login credentials.
- Assignment of rights: Economic rights to custom development and designs are assigned to the client upon receipt of payment, for the listed uses.
- Licenses: A list of licensed themes, plugins, images, and fonts, including the license holder and renewal cost for each.
- Portability: At the end of the contract, the provider delivers a full backup (files and database), access credentials, and minimal documentation, within a set timeframe.
- Personal data: The provider acts as a data processor, with commitments required by GDPR, CCPA, or other relevant privacy laws.
- Site status in case of non-payment or dispute: The conditions under which access can be suspended, and a guarantee that the site will not be deleted.
To compare service models, also check out our article on fixed-price, time-and-materials, or subscription models.
Self-Assessment: Do You Really Own Your Website?
Answer yes or no to each point. The result will show you the priorities to address with your provider.
Switching Web Design Companies: The 7-Step Method
Switching web design companies goes smoothly when you prepare your departure before announcing the split. This method minimizes the risk of lock-in and protects your SEO.
Protecting SEO during the transition
Changing providers shouldn’t cause a loss of traffic, provided you don’t modify anything without a plan. Avoid combining a handover and a complete redesign on the same day: first, migrate the site exactly as it is, then evolve the design and content gradually. If URLs change, prepare a page-by-page redirect plan. Our guide on a progressive website redesign explains how to move forward without losses, and our teams can assist with website migration services.
What to Do in Case of a Dispute?
Most providers hand over access without issue. If that’s not the case, proceed step by step.
- Make a written request, with a specific deadline and a list of expected items, referencing the contract clauses.
- Check for unpaid invoices: a financial dispute is often the real reason for a lock-in, and settling it resolves the situation.
- Contact the registrar if you can prove the domain belongs to you (invoices, contract, use of the name by your company): some allow a registrant change with proof.
- Send a formal demand letter, then involve a mediator or lawyer if necessary.
- Use domain name dispute resolution policies (like the UDRP for generic extensions, or specific procedures for national registries like Nominet or CIRA), especially if the domain uses your trademark.
These steps take time. That’s one more reason to sort out ownership from the start.
Special Cases: Wix, Shopify, Squarespace, and “Turnkey” Sites
On a hosted platform like Wix, Squarespace, or Shopify, you own your content and, usually, your domain name, but not the software or the theme as it operates on the platform. You can export some of your data (products, customers, orders, posts), but rarely the entire site. Switching solutions usually means rebuilding the site elsewhere. This isn’t a flaw in itself; it’s a choice to make with full awareness, as we explain in our Wix vs. WordPress comparison.
“Turnkey” website packages with an all-inclusive monthly subscription raise the same issue. Read carefully what happens at the end of the subscription: some state that the site remains the provider’s property, and they can deactivate it if you stop paying.
Website Ownership: Five Checks to Make Today
You don’t need to wait until you change providers to assess your situation. These five checks take less than an hour and resolve most risks.
- The domain: Log into the registrar account and verify that the domain is there, your company is the registrant, and the expiration date is far in the future.
- The backup: Request a full backup of the site and store it in a space you control, outside of the hosting environment.
- Access: Open the site admin with your own administrator account, without relying on the provider’s credentials.
- Data: Check your role in Google Analytics, Search Console, and Google Business Profile: you should be an owner or administrator, not just a viewer.
- The contract: Review the assignment of rights and portability clauses, and request an amendment if they are missing.
If one of these checks fails, it’s not necessarily a sign of a problem with your provider: it’s often just a hasty setup during launch. Simply request the correction in writing, explaining that you want to secure the business. A professional provider will understand the approach and will also benefit from the clarity. Ultimately, website ownership is about ensuring that no single person holds all the keys.
Common Mistakes
Letting the agency create everything in their name “to keep it simple”
It’s convenient at first, but it’s exactly what blocks everything when it’s time to switch. Create the accounts yourself, even if you give full access to the provider.
Using a personal email for key accounts
If the domain or Analytics account is linked to the personal inbox of an employee who leaves the company, you lose control. Use a generic company address shared by two people.
Confusing an invoice with an assignment of rights
Paying for a website’s creation does not equal an assignment of rights to the code or visuals. Only a written clause guarantees this.
Never testing the backup
A backup that has never been restored is just a hypothesis. Ask your provider, or your new provider, to verify that it can actually be used to rebuild the site.
Conclusion
Website ownership isn’t just declared: it must be verified, element by element. The domain name and accounts must be in your name, the rights to what was created for you must be assigned in writing, and you must be able to retrieve a full copy of the site at any time. These precautions don’t imply distrust toward your provider: they protect both parties and make future updates easier.
Our advice: take the self-assessment above once a year, and with every new contract. If you are preparing to switch providers, follow the seven-step method and take the time to recover your access credentials before announcing your departure. To help you choose your next partner, our comparison of WordPress freelancers, developers, or agencies can guide you.
Frequently Asked Questions About Website Ownership
What should I do if my web agency refuses to give me my domain name?
First, request the registrant change or transfer code in writing, setting a deadline and referencing the contract. Make sure no invoices are unpaid. If the block persists, contact the registrar with your proof, send a formal demand letter, and then consider a dispute resolution policy, like the UDRP for generic extensions.
How do I find out who owns my domain name?
Check the domain record using the ICANN lookup tool for generic extensions, or the national registry tool for country codes like .co.uk or .ca. The registrant’s name might be hidden, but the registrar and expiration date are shown. The safest way is to verify that the domain appears in a registrar account under your name.
Can I change hosts if I don’t have access?
You need at least a full backup of the site (files and database) and the ability to modify the domain’s DNS configuration. Without access, request these items from your current provider. With the backup, the new provider can reinstall the site, and then you point the domain to the new hosting.
Is a copyright assignment clause mandatory?
Without a written assignment clause, economic rights to custom code, design, and text generally remain with their creator, even if you paid for the service. You then only have a right of use. To freely modify, reuse, or evolve these creations, the assignment must be explicitly stated in the contract.
Do you own a website created on Wix, Squarespace, or Shopify?
You own your content and, usually, your domain name, but not the platform’s software. You can export some of your data, but rarely the entire site. Leaving the platform generally means rebuilding the site with another solution, using the exported content and data.
Which access credentials should I keep to maintain control of my website?
The domain name registrar account, the hosting account, administrator access to the site, Google Analytics, Search Console, and Business Profile accounts, advertising accounts, the domain’s email, and the backup tool. Keep these credentials in a corporate password manager, shared by at least two people.
