Do I Own My Website, and the Four Things That Prove It

A website is not one thing you own.

It is four, and they can sit in four different places under four different names. Owners generally discover the split at the one moment it costs them, which is when they want to change something and find they cannot.

But none of that requires anybody to have behaved badly. The usual cause is a developer who registered a domain on your behalf years ago, using their own account because it was quicker, and nobody has thought about it since.

So the useful move is to check all four while nothing is urgent.

Why the question has four answers

Each of the four is bought separately and renewed separately. They arrive together on one invoice, so they feel like a single purchase. That invoice is exactly why the split stays invisible for years.

The difference shows up in what happens when one of them goes missing.

Row one is the one to check first. Because the domain carries both your website and every email address on it, a gap there is the only one of the four that can take the whole business offline at once.

The domain, and whose name is on it

That first row is also where the old advice stopped working. For years the answer was to look the registration up and read the owner's name. Redaction changed that. Public records no longer show who holds a domain.

What a lookup still gives you is worth having. ICANN Lookup is the official registration data service, and it shows which registrar the name sits with and when it is due for renewal, neither of which is hidden.

1. Find the registrar first: Look the domain up and note the company named as registrar, which is where the account lives.
2. Try to log in yourself: Go to that registrar and attempt a password reset using your own email address.
3. Read what the reset tells you: A reset link arriving means the account is tied to you. Nothing arriving means it is tied to somebody else.
4. Ask plainly if it is not yours: Request that the registration be transferred into an account in your name, which is a routine request.

Step three is the whole test. Two minutes settles it. ICANN's recovery policy calls the legal party the Registered Name Holder, and renewal warnings go to whichever address sits against that holder, so whoever receives them is whoever holds the name.

The hosting account

Once the domain is settled, hosting is the easier of the remaining three. HubSpot draws the line clearly in its explanation of what a domain is, noting that the address and the place the files live are separate services that can be bought from different companies.

Hosting is the less frightening one for a reason. Files can always be copied. Losing the account is expensive and inconvenient, and it is not permanent the way a lost domain is.

• Whose card pays for it: If the bill leaves your bank, you are usually the account holder, though not always.
• Whose email is on the account: The more reliable test, and the one to actually check.
• Whether you can take a backup: An account you can log into is an account you can export from.
• Whether it is a reseller plan: Some agencies resell space under their own account, so your site is a folder inside theirs and there is no login to give you.

The last one is worth asking about directly, because it changes the answer rather than the difficulty. A reseller arrangement is perfectly normal and is not a trap, though it does mean the only way to get an independent account is to move, which is the situation moving to a new host describes.

The site itself, and who can log in

Once hosting is settled, the next question is whether you can change a word on the page without asking. Plenty of owners have hosting in their own name and still cannot edit their opening hours, because the site login was never handed across.

Ahrefs makes the same point from the other direction in its migration guide, where knowing every person involved and holding the relevant accounts is treated as groundwork rather than detail.

1. An administrator login, not an editor one: Editors can change text. Only an administrator can add users, which is what independence actually means.
2. The platform, named: Knowing whether the site runs on a common content system or something custom decides who else could ever work on it.
3. Any licences attached to it: Paid themes and plugins are often registered to the builder, so renewals stop when the relationship does.
4. Where the backups go: A backup you cannot reach is a backup somebody else owns.

Point three is the quiet one. Licences lapse without announcing themselves, and the first sign is usually a feature breaking or a security update that no longer arrives.

The content you paid for

That leaves the fourth asset, and it is the one nobody thinks to ask about. Words, photographs and a logo were all paid for, so most owners assume they came with the invoice.

Often they did. Trouble comes from the pieces that were licensed rather than created, since a stock photograph bought under somebody else's account is licensed to that account and not to you.

The test that settles it is simple enough to ask in one line. If you rebuilt this site somewhere else tomorrow, which of these files could you legally take with you.

Logo files are where it bites hardest. A logo delivered only as a web image cannot be printed at any size worth having. Ask for the original working file while somebody still has a copy of it.

What a handover actually contains

None of these four needs a lawyer. None needs a difficult conversation either. A handover is a list, and asking for it reads as ordinary housekeeping rather than an accusation, particularly while everything is still fine.

1. Registrar name and account access: Which company holds the domain, and a login in your own name or an email address on the account.
2. Hosting account access: The same, plus a plain answer about whether the plan is resold.
3. An administrator login for the site: Created for your own email address, not shared.
4. The original files: Logo source files, photographs, and a note of anything licensed rather than owned.
5. Where the email is routed: Because the mail settings live on the domain, which is covered in business email on your domain.

Then write down where it all is

Store the list somewhere that survives a laptop, and put the renewal dates in the same place, since an account you own and forget behaves exactly like one you never had. Both of the failure modes in this batch start there, whether that is a lapse in when a domain expires or a certificate nobody renewed behind a not secure warning.

And if the answer to any of the four is currently no, that is a fixable Tuesday rather than a crisis. When you would rather the whole set sat in accounts with your name on them from the first day, that is how our websites service is set up, and what sits in each tier is broken out in the package tiers.

Frequently Asked Questions

My developer is unreachable. What can I still do?

Start at the registrar, since the domain is recoverable through a dispute process even when nobody answers. Hosting and the site are harder, and rebuilding from a copy of the public pages is often faster than chasing.

Is it rude to ask for the logins?

Any competent supplier expects it, and most have the list ready. Asking while the relationship is healthy is far easier than asking during a disagreement.

Does paying for the build mean I own everything?

Payment covers the work, though accounts opened in somebody else's name stay in that name until moved. Licensed stock and fonts can also sit outside what you bought.

Can I move a domain away without the current holder?

Not directly, because transfers need authorisation from the registered holder. Where that fails, the registrar's own dispute route is the path rather than the new provider.

What should a contract say about all this?

One line covering who the accounts are registered to, and one covering what files you receive at the end. Those two sentences prevent almost every version of the problem.