Who owns my website? Usually more than one person
"Who owns my website" has no single answer, because a website is several assets held in several accounts. The domain belongs to whoever is listed as its registrant. Each account, from hosting to Google Analytics, belongs to whoever controls it. Copyright in the design, code, text, and photos depends on who made them and what was signed. A business can pay for every part and still not hold several of them.
The problem usually surfaces when a designer stops replying, an employee leaves, or a renewal notice goes to someone else's inbox. The audit below checks every asset in one sitting; the recovery steps after it show what to fix first. This is a procedure, not legal advice. Never try to get into an account you are not authorized to use.
Domain vs hosting: the parts of a website and who can hold each
The domain. The name is registered through a registrar. ICANN, which oversees domain registration, treats the person or organization listed as the registered name holder (opens in a new tab) as the holder of record, with the right to move the domain between registrars. If a designer registered your domain in their own name, they are the registrant.
DNS. These records, often managed at the registrar, point the name at your web host and email provider.
Email. MX records tell other mail servers where to deliver mail for your domain (opens in a new tab). The mailboxes live in an email account, which may or may not be in your name.
Hosting and the site admin. Hosting is where the site runs; the admin account in WordPress, Squarespace, or another builder is where pages are edited. On a hosted builder, they can be one account.
Content, design, code, and photos. Copyright governs these, not account access.
The Google accounts around the site. Your Google Business Profile, Google Analytics, and Search Console each have their own owners and users.
The one-sitting website ownership audit
Set aside an hour and copy this table into a spreadsheet. In the last column, note the provider, the account holder, and whether you can sign in yourself, but never passwords. Any row that matches its red flag goes on your recovery list.
| Asset | How to check | Who should hold it | Red flag | What you found |
|---|---|---|---|---|
| Domain registrant | Find the registrar at lookup.icann.org, then view the registrant contact in that registrar account | The business, with an email address the business controls | The designer, an agency, or a former employee is the registrant | |
| Registrar account | Can you sign in yourself? Is auto-renew on? When does the domain expire? | A business owner, with two-step sign-in | Only the designer can sign in; renewal notices go elsewhere | |
| DNS | Find where the nameservers point, then sign in there | A business account, or a provider with documented access | DNS sits in someone's personal account | |
| Email and MX records | Which provider do the MX records point to? Who is the email admin? | A business admin account | Mailboxes were created inside the designer's account | |
| Hosting | Whose name and card are on the hosting invoice? | The business, or a care provider under written terms | Nobody can name the host | |
| Site admin | Do you have an owner or administrator login? | At least one owner-level account in the business's name | You have editor access only | |
| Content and photos | Do you hold copies? Who created them? What did you sign? | Copies held by the business, rights stated in writing | No copies and no written terms | |
| Business Profile | Check the profile's owners and managers | The business as primary owner | The designer is the only owner | |
| Google Analytics | Check account-level access management | The business as account-level Administrator | The property sits in an agency's account | |
| Search Console | Check users and permissions, and unused ownership tokens | The business as a verified owner | A former developer is still a verified owner |
A public lookup shows the registrar and dates, but under ICANN's Registration Data Policy (opens in a new tab), in effect since August 21, 2025, the registrant's name and email are often redacted, so check the registrant record inside the registrar account.
Do you own the design and content you paid for?
This is general information, not legal advice about your contract.
The U.S. Copyright Office's Circular 30 (opens in a new tab) (revised August 2024) explains that ordinarily the author of a work is the person who created it. A "work made for hire," where the hiring party is the author instead, arises in only two situations:
- An employee creates the work as part of their regular duties.
- A commissioned work falls into one of nine listed categories, such as a contribution to a collective work or a compilation, and both parties sign a written agreement expressly calling it a work made for hire.
If any of those requirements is missing, the work is not made for hire. Separately, Circular 1 (opens in a new tab) says a transfer of copyright generally must be in writing and signed by the owner, and that owning a copy of a work does not give you the copyright in it.
So paying for a website does not by itself give you the copyright in its design, code, text, or photos. What you signed matters, and only a lawyer can tell you what your contract means. When you hire someone, ask in writing what transfers to you on payment and which parts, such as a theme, plugins, or stock photos, are licensed from someone else.
How to get your website back from a web designer
Start with a written request that says what you need and by when. Adapt this outline to your red-flag rows; it is a business request, not a legal document.
- Domain: change the registrant to the business's legal name and a business email address, or move the domain into a registrar account the business controls.
- DNS: send a copy of every DNS record, or an export from the DNS host, before anything changes.
- Hosting and site: add a business email address as an owner or administrator on the hosting and site accounts, and send a full backup or export.
- Business Profile: add the business as an owner, then make it the primary owner.
- Analytics and Search Console: add the business as an account-level Administrator in Google Analytics and as an owner in Search Console. The business then verifies its own Search Console ownership from its own Google account; a designer can add owners but cannot verify for you.
- Content: confirm in writing which design, code, text, and photos transfer to the business and which are licensed from someone else.
- Deadline: ask for a reply by a specific date, and ask that no passwords be sent by email.
Whether or not the designer cooperates, recover the assets in this order; each step depends on the one before.
The domain. If the designer is the registrant, the designer has to make one of the changes in item 1. As of October 2026, ICANN's Transfer Policy (opens in a new tab) (section I.A.1.1) says the registrant is the only party that can approve or deny a transfer between registrars. The registrar must provide the transfer code within five calendar days of the registrant's request (unless the registrant can generate it) and must impose a 60-day transfer lock after a change of registrant, unless the registrar offered an opt-out and the holder used it before the change. If you plan to change the registrant and move registrars, ask your registrar which to do first because of that lock. The ICANN Board adopted the Transfer Policy Review recommendations (opens in a new tab) on June 7, 2026, but as of October 2026 neither the resolution nor the review's project page (opens in a new tab) gives an effective date, so the current rules still apply. Can break: if the old registrar also hosts your DNS, the site and email can stop working when the domain moves.
DNS and email. Before changing any DNS provider, copy every record, especially MX records. Google notes that old or incorrect MX records can break email and that new ones can take up to 72 hours to be recognized. If form notifications start landing in spam after a DNS change, the contact form diagnosis shows where to look. Can break: incoming email, if MX records are lost or mistyped.
Hosting and site files. Get the full backup or export before any account closes. WordPress's export tool (opens in a new tab) produces a file of posts, pages, comments, custom fields, taxonomies, and users, not a full copy of the site. Hosted builders can be narrower: Squarespace's export (opens in a new tab) leaves out many page types, drafts, style settings, and custom CSS. On those platforms, transferring the account may matter more than the files. Can break: the live site, if hosting is canceled before the move.
The site admin. Get an owner-level account in the business's name, confirm it works, and only then remove former users.
Business Profile. Once you are an owner (opens in a new tab), have primary ownership transferred to you. New owners must wait seven days before they can transfer primary ownership or remove other users. If the current owner does not respond, Google's request-ownership process (opens in a new tab) gives them three days to reply; service-area businesses are directed to Google support instead.
Google Analytics and Search Console. In Analytics, deleting users requires the Administrator role at the account level (opens in a new tab). In Search Console, verify the business's own ownership first: Google says a property must have at least one verified owner (opens in a new tab), or no users will have access to it. Then remove the former owner and delete their verification tokens, which Google says are not revoked automatically. Can break: removing a token shared with another Google service, such as Analytics, can affect that service.
If the designer refuses, claims they are owed money, or the contract is unclear, stop and talk to a lawyer. ICANN's transfer guidance (opens in a new tab) lists the limited reasons a registrar may deny a transfer, and its registrant FAQ (opens in a new tab) explains how to file a transfer complaint.
How to keep control of your website from now on
- Register the domain in the business's name, with a business email address and auto-renew on.
- Give designers and agencies their own user access; never make them the only owner.
- Keep the completed audit table as your access record, with no passwords. Update it whenever a designer, agency, or employee joins or leaves, and recheck it in your yearly website audit.
- Put ownership and handover in the written scope before work starts, and ask any new designer the ownership and exit-test questions before you sign. The redesign preparation guide covers what else to gather.
- Learn what each Google account holds: the Business Profile checklist and the Search Console and GA4 guide cover them.
Cleland & Co. agrees ownership, account responsibilities, and handover in the written scope, and Google accounts stay under the client's ownership. If your audit turned up gaps, website design and care starts with reviewing the access you already have.
