Who Owns Your Business Website? A Practical Handoff Checklist

Your business should control the accounts that keep its website online and connected to customers. A contract may say you own the finished website while the developer still controls the domain, hosting, analytics, or administrator login.

Ownership becomes visible when you change providers, fix an outage, recover a hacked site, or need access to your data.

Quick Answer

Your business should own or hold primary administrative control over the domain, hosting account, website files, database, CMS, analytics, Search Console, form destinations, business email, and licensed assets that the contract transfers to you. Give developers role-based access instead of asking them to register core business assets under their own company.

Website Ownership Checklist

Asset	Recommended control	Check now
Domain name	Business-owned registrar account	Can you sign in and renew it?
DNS	Business-owned account with documented records	Can you change where the domain points?
Hosting	Business-owned or contractually transferable	Can you access backups and billing?
CMS	Business holds an administrator account	Can you add or remove users?
Files and database	Exportable copies available	Can another developer restore the site?
Analytics and Search Console	Business is the primary owner	Can you add a new agency without permission?
Forms and leads	Business controls the destination	Do submissions reach an account you own?
Paid plugins and software	Ownership and renewal terms documented	What stops working if the agency leaves?
Content and design assets	Rights stated in the agreement	Can you reuse the copy, photos, and design?

Start With the Domain

The domain is the address customers use and search engines index. Register it in an account owned by the business. Keep the billing email, recovery method, and two-factor authentication current.

A developer may manage DNS for you, but management does not require ownership. Add them as a user when the registrar supports roles. Otherwise, document every change and retain recovery access.

Hosting, Files, and the Database

Some agencies host client websites in a shared account. That arrangement can work when the agreement explains backups, access, cancellation, migration, and what happens during a billing dispute.

Ask whether you can receive a current copy of the site files and database. For a WordPress site, another qualified developer should be able to restore that copy on compatible hosting. A screenshot or PDF is not a usable backup.

CMS Administrator Access

Your business needs at least one administrator account tied to a company-controlled email address. Staff members and contractors should use separate accounts so access can be removed without changing a shared password.

Administrator access also lets you audit plugins, users, integrations, and content. Use a password manager and two-factor authentication where supported.

Analytics, Search Console, and Lead Data

Google Analytics, Google Search Console, Tag Manager, Microsoft Clarity, advertising accounts, and call-tracking platforms contain business history. Create them under a business-owned Google or Microsoft identity, then invite the agency.

Check where contact forms send data. Your website may look operational while submissions go to an old agency inbox, an employee who left, or a spreadsheet nobody checks.

Content, Design, and Licensed Software

Your agreement should state who owns custom copy, original design work, custom code, photos, and video after payment. Stock assets, fonts, themes, plugins, and software subscriptions may carry separate licenses that cannot transfer.

Ask which features depend on the agency’s license. Decide whether the business will buy its own license at handoff or pay for a maintenance plan that includes renewals.

Questions to Ask Before Signing

1. Which accounts will you create, and whose name will they use?
2. Will we receive administrator access before launch?
3. Can another developer move the site without your approval?
4. Which licenses stop working if we cancel support?
5. How often do you create backups, and where are they stored?
6. Who owns custom code, copy, and design after final payment?
7. How will you transfer access at the end of the relationship?

Add the answers to the contract or scope. Email assurances become hard to interpret years later.

If You Do Not Control the Current Site

Collect the domain registrar, DNS host, hosting provider, CMS login, analytics properties, form destination, billing records, and latest backup. Request access in writing. Avoid changing DNS or deleting agency access until a replacement developer verifies the backup and migration plan.

Web Dev NC can audit an existing WordPress setup, document the accounts, and plan a controlled migration. See our WordPress development service, WordPress maintenance guide, and case studies. If you need help recovering control, book a call.