Do You Own Your Website? Domain, Hosting & Code Checklist

Audit who controls your domain, hosting, email, platform accounts, analytics and code rights, then use a handover checklist before the final payment.

Written by Pixel2Tech Team
Topic: Web Development
Published September 10, 2026
8 min read

Key takeaways

You own your website only if your business holds the domain registration, the hosting and platform accounts, the email admin, the analytics and ad accounts, and a written copyright assignment for the custom design and code.
Check the domain first. The registrant should be your business, the registrar login should be yours, and auto-renew should be on. ICANN requires registrars to give the domain holder the transfer code within five calendar days of a request.
On Shopify, agencies should work through collaborator accounts. Shopify doesn't allow store ownership to be transferred to a collaborator.
Make your business a verified owner in Search Console, an Administrator in Google Analytics and the primary owner of your Google Business Profile.
Under US copyright rules, commissioned work counts as made for hire only in nine categories with a signed agreement. Ask for an explicit assignment clause and have an attorney review it.

In this article (11 sections)

Who owns your website after a developer builds it?

You own your website only if you control its parts: the domain registration in your name, the hosting and platform accounts, the business email, the analytics and ad accounts, and a written contract that assigns the design and code copyright to you. Paying the final invoice doesn't transfer all of that on its own.

Most ownership problems stay invisible until you need something. You want to switch agencies, your freelancer stops replying, you're selling the business, or a renewal notice goes to someone else's inbox and the domain lapses.

Each of those moments is easy if the accounts are already in your name and hard if they aren't. This checklist walks through every layer in the order you should check it, and ends with a handover list to complete before you make the final payment.

One note before you start: this is practical guidance, not legal advice. For contract wording and disputes, talk to an attorney in your jurisdiction.

Step 1: check the domain, DNS and SSL

The domain is the one asset you can't replace, so the registrant (the person or organization listed as holding it) should be your business.

Log into the registrar where the domain is registered, or ask your developer which registrar it is. Public lookup tools often show redacted details now, so the registrar account is the reliable place to check. Confirm three things: the registrant name or organization is your business, the account email is one you control, and auto-renew is on with a payment method you own.

As of September 2026, ICANN's registrant FAQs say your registrar must give you the transfer authorization code within five calendar days of your request. A transfer to another registrar can be refused within 60 days of the initial registration or a previous transfer, and changing the registrant's name, organization or email address can also block transfers for 60 days. Registrars handle these rules slightly differently, so read your registrar's help page before you start.

Next, check DNS. If the domain points to a separate DNS provider, such as a CDN or your host, that account needs to be yours too, because whoever controls DNS controls where your website and email go. SSL certificates are usually issued automatically by the host, but note who receives the renewal warnings.

If the domain is registered in your developer's name

This is common, and usually not malicious: it was quicker for the developer to buy the domain on their own account. Fix it calmly:

Ask in writing for the registrant details to be changed to your business, or for the domain to be moved to a registrar account you create.
Offer to repay any renewal fees they covered on your behalf.
Don't change contact details and start a registrar transfer on the same day without checking the lock rules above.
If a registrar won't provide the authorization code to the listed registrant, ICANN accepts transfer complaints.

Step 2: hosting, business email and backups

Hosting and email should be billed to your business and owned by an admin login you control, with the developer added as a separate user.

The billing contact is often the real owner in practice. If hosting is paid on your agency's card as part of a bundle, you don't control the account, and leaving the agency can mean rebuilding somewhere else under time pressure.

Hosting account: owned and billed by your business.
Developer access: a separate user or collaborator login, never your own password.
Business email, for example Google Workspace or Microsoft 365: your business holds the top-level admin account.
Backups: you know where they are, how often they run, and you've downloaded a full copy at least once.
Staging sites: you know where they live, and they're blocked from search engines.

Step 3: platform accounts and licenses

On hosted platforms, ownership is a role inside the account, so check who holds the owner role rather than who has a login.

Each platform handles this differently. The principle is the same: the business owns the account, and outside help gets its own access that you can remove.

Shopify

Shopify separates the store owner from staff and collaborators. Collaborator accounts are how Shopify Partners, such as agencies and freelancers, get access: you give them a request code, and you can generate a new code at any time to invalidate old ones. Collaborators don't count toward your store's user limit, and the store owner can remove them.

Shopify also states that you can't transfer store ownership to a collaborator. If your developer created the store under their own login and you work in it as staff, ownership needs to be transferred to you properly, not just shared.

WordPress

You should have an Administrator login of your own. Premium themes and plugins are licensed per account, and if the licenses sit in your developer's account, updates and support stop when that relationship ends. Ask for licenses to be bought in your business's name or transferred to it, and keep a list of every paid plugin with its renewal date.

Webflow and Squarespace

The site should live in a workspace or account owned by your business, with the agency added as a guest or contributor. Moving a site between accounts later is usually possible, but it's slower than setting it up correctly on day one. If you're still choosing a platform, our WordPress vs Webflow vs Squarespace comparison covers how hard each one is to leave.

Step 4: data and marketing accounts

Your analytics, search and ad history are business records. If the accounts belong to your agency, the history leaves when the agency does.

Check each account below and note the role your business holds today. Anything other than the role in the middle column is a gap to close.

Data and marketing accounts to audit
Account	Role your business needs	What to check
Google Search Console	Verified owner	Who else is listed as an owner, and whether former owners' verification tokens were removed
Google Analytics	Administrator on the account	Only Administrators can add and delete users and assign roles
Google Business Profile	Primary owner	A profile has one primary owner; managers can't add or remove users
Google Ads and Meta ads	Admin on an account or business portfolio your business owns	The agency should be a partner or user, not the owner
Tag Manager, call tracking, CRM, email marketing	Admin or owner	Billing in your name, with the agency as a user

A Search Console detail worth knowing

Search Console distinguishes verified owners, who proved ownership with a token such as an uploaded HTML file, from delegated owners, who were added by a verified owner. Both have the same permissions.

When you remove a former owner, Google says you must also delete their verification tokens, or they can re-verify later. And if all verified owners are removed, the remaining users and delegated owners lose access after a grace period. Make sure at least one verified owner is someone inside your business.

Step 5: code, design files and IP clauses

Having a copy of the files isn't the same as owning the rights to them; the contract decides who holds the copyright.

The US Copyright Office's Circular 30 explains that a work is "made for hire" in two situations: when an employee creates it as part of their regular duties, or when a commissioned work falls into one of nine specific categories and both parties sign a written agreement saying it's a work made for hire. If a work fails any of those requirements, it isn't a work made for hire.

Websites built by an outside agency or freelancer don't clearly fit those nine categories, so a "work for hire" sentence on its own may not do what you expect. Ask an attorney to review the contract, and look for these clauses:

Assignment of copyright in the custom design and code to your business on final payment.
A license to any pre-existing code, frameworks or tools the agency reuses, so you can keep running and changing the site.
A list of third-party licenses (themes, plugins, fonts, stock photos) and whose name each is in.
Delivery of source files: design files, code repository access and exported content.
No license keys, kill switches or hosting lock-ins that stop the site working if you leave.

Before you sign the next contract

If you're choosing a vendor now, add these clauses to your brief and weigh them when comparing website development quotes. Agencies that hesitate over ownership terms before the project starts rarely become easier about them after it ends.

.pk domains and PKNIC accounts

PKNIC runs the .pk registry, and its site says the domain name holder is responsible for keeping the registered contact information up to date.

Many businesses in Pakistan registered their .pk or .com.pk domain through a reseller, or through the freelancer who built the site. PKNIC notes that its appointed resellers and agents are independent companies, so the account that controls your domain may sit with a third party rather than with PKNIC directly.

PKNIC's site has separate options for changing a domain's registered details and for changing its registrar. Ask whoever registered the domain to update the holder and contact details to your business, and get the login for the account that manages it. PKNIC also states that a domain name can't be modified after registration, so a new name means a new registration, not an edit.

How to recover access politely and legally

Most access problems end with a clear written request and an offer to settle anything owed. Escalation is for the cases where that fails.

Work through these steps in order:

List every account from this checklist and mark which ones you can't access.
Email the developer with the list, what you need for each (owner role, transfer or login) and a reasonable deadline.
Offer to pay outstanding invoices or renewal fees; many disputes are about money, not access.
For the domain, contact the registrar's support team and ask what proof of ownership it accepts.
For Google accounts, use each product's own ownership or access request process.
If a registrar refuses to release the authorization code to the listed registrant, file a transfer complaint with ICANN.
If the developer refuses and you believe the contract gives you ownership, talk to an attorney before you take the site down or rebuild it.

What not to do

Don't log into accounts registered to someone else with credentials you weren't given, and don't change their passwords, even if you still have an old login. It can create legal problems and makes a friendly resolution less likely. Keep every request in writing so there's a record of what you asked for and when.

Printable handover checklist before the final payment

Make the final payment conditional on this list being complete.

Print it, attach it to the contract, and tick each line with your developer on the handover call:

Domain registered to your business, registrar login in your name, auto-renew on.
DNS provider account in your name.
Hosting or platform account owned and billed by your business.
Business email admin account held by your business.
CMS administrator login for you, with the developer on a separate account.
Shopify store owned by your business, with the agency as a collaborator.
Theme, plugin, app and font licenses in your name, with a written list and renewal dates.
Search Console: your business is a verified owner.
Google Analytics: your business has Administrator access.
Google Business Profile: your business is the primary owner.
Ad accounts, pixels and tags in accounts your business owns.
Design files and code repository delivered or shared.
A full site backup downloaded and stored by you.
Signed copyright assignment for the custom design and code.
A one-page document listing every service the site depends on and who to contact about each.

Make ownership part of the project from day one

The cheapest time to settle ownership is before work starts. Put the checklist in your brief, create the accounts yourself, and add your agency as a user. When you later change agencies or platforms, you'll be moving a site you already control.

If you're not sure what you own today, Pixel2Tech's website development team can run this audit on your current site and tell you which accounts need to move, and in what order.

Sources and further reading

Frequently asked questions

Who owns my website if a developer built it?

It depends on the accounts and the contract. You own the domain if it's registered to your business, and the hosting and platform accounts if they're in your name. The copyright in custom design and code ordinarily belongs to whoever created it, unless the work legally qualifies as made for hire or the contract assigns it to you. Check both the accounts and the contract.

How do I transfer my domain from my web designer?

First ask the designer to change the registrant details to your business or move the domain into a registrar account you own. For a move to a new registrar, have the transfer lock removed and request the authorization code; ICANN's rules require the registrar to provide it to the domain holder within five calendar days. Watch for 60-day locks after registration, transfers or registrant changes.

Can a developer take my website down?

If they control the hosting, domain or platform account, they technically can, which is why those accounts should be in your name. Whether they're allowed to depends on your contract and any unpaid invoices. If you're worried, move the accounts into your business's name now, keep your own backup, and talk to an attorney if a dispute is already underway.

Should the domain be in my name or the agency's?

Your business's name, always. The registrant is the legal holder of the domain, and the registrar account controls renewals, DNS and transfers. An agency can manage the domain with delegated access or a separate login without owning it. If a registrar or agency suggests otherwise for convenience, ask for the arrangement and the exit process in writing.

What should a website handover include?

At minimum: the domain and registrar login in your name, the hosting or platform account owned by your business, admin access to the CMS, analytics, Search Console and Business Profile, all licenses listed and transferred, design files and code, a full backup, and a signed copyright assignment for the custom work. Tie the final payment to that list.

About the author: Pixel2Tech Team

Pixel2Tech is a Lahore studio for brand, web, video and automation work. We write about problems we see in client projects.

Meet the team

Not sure who holds the keys to your website?

Send us your domain and a list of the logins you have. We'll tell you which accounts your business controls, which it doesn't, and the order to fix them in.

Send a project brief

Web Development · September 11, 2026
WordPress vs Webflow vs Squarespace for a Service Business Site
WordPress, Webflow and Squarespace compared for law firms, clinics and contractors: editing, lead capture, exit costs and three-year subscription cost.
Web Development · September 23, 2026
Website Redesign Cost for Small Businesses: Line-by-Line Budget
What a small business website redesign costs, line by line: design, build, content, SEO migration and accessibility, plus a worksheet to fill in before quotes.
Web Development · September 10, 2026
How to Compare Website Development Quotes (Apples to Apples)
A brief template, line-by-line comparison table, three-year cost view and weighted scoring matrix for judging website proposals with very different prices.
Web Development · September 27, 2026
WordPress 7.1.2 Security Fix: What Business Owners Must Do Now
WordPress 7.1.2 fixes CVE-2026-87902, attacked on release day. A 15-minute owner check, safe update steps and signs your site was hit before you patched.

Related Pixel2Tech services

Leave your email and we'll send new posts when they're published.