Quick answer: Website ownership is not one thing. Your business should control the domain registrar login, DNS, hosting (or a clear transferable host account), CMS administrator access, and the rights to custom code and content. Theme and plugin licences may be tied to a developer account. Before you hire or fire an agency, document who holds each piece. If any critical login sits only in a freelancer’s personal email, you do not fully own your site in practice.
The pieces people confuse
When owners say “we paid for a website,” they may mean a design PDF, a WordPress install, a Framer project or a custom app. Ownership questions differ for each. For typical business CMS sites the stack looks like this:
- Domain name
- DNS
- Hosting and SSL
- CMS application and database
- Theme and plugins
- Custom code and design assets
- Third party services (email, CDN, analytics, SaaS forms)
You can “have a website” while still being locked out of half of these.
Domain name ownership
The domain is the foundation. It should be registered under your organisation at a registrar account you control. Check:
- Account login and recovery email use your company domain or a monitored role inbox
- Auto-renew is on and the payment card will not vanish with an ex-employee
- Registrar lock and two-factor authentication are enabled
- WHOIS contact details are appropriate for your privacy needs
If the agency registered the domain under their account “for convenience,” move it or get written transfer procedures. Losing a domain hurts more than losing a theme. Related reading: domain security.
Hosting and DNS
Hosting holds files and databases. DNS points the domain at that host (and at email). Ideal state:
- Hosting account in your name or your company’s
- Billing you can see
- Ability to create staging, backups and new FTP/SFTP or SSH users
- DNS either at the registrar or a DNS host you control
Some “website builders” blur hosting into the product. Leaving means export limits. Ask before you buy. For SSL basics on hosts you control, Let’s Encrypt style certificates are common in 2020.
CMS admin and roles
On WordPress and similar CMS platforms, you need an administrator user that is yours. Agencies can keep editor accounts. If the only admin is agencydev, you are renting access.
Also store:
- Hosting panel login
- Database credentials in a password manager shared to the right people
- Backup location and restore instructions
Cost planning for builds belongs in website development cost and WordPress website cost conversations; ownership clauses belong in the contract.
Themes, plugins and licences
Buying a theme from ThemeForest under a developer’s personal account can leave you without update access later. Prefer licences purchased with a company account, or ensure licence transfer is written down. The same applies to premium plugins.
You own your content (posts, pages, media you created). You usually do not “own” third party plugin source in the sense of unlimited redistribution; you own a licence to use it.
Custom code and design files
Contracts should state that paid custom theme work, plugins and design source (Figma, PSD, whatever you use) transfer to you on payment, excluding third party libraries under their own licences. Ask for:
- Repository access or a clean ZIP of custom code
- Deployment notes
- Which parts are third party
Without that, a redesign years later costs extra archaeology.
Email and deliverability ties
Websites often share domains with email. If DNS is moved carelessly, mail breaks. Ownership of Microsoft 365 / Google Workspace is separate from hosting but coupled through DNS records (MX, SPF, DKIM). Document those records when you document the site.
Marketplace and franchise traps
Some vendors sell “your website” that can only run on their platform, with monthly fees and weak export. That can still be fine if you accept the trade-off. It is not full ownership of a portable stack. Read exit terms before signing.
A simple ownership checklist
| Asset | Who should control it | Red flag |
|---|---|---|
| Domain registrar | Your company | Agency personal account only |
| DNS | Your company | No access after invoice dispute |
| Hosting | Your company | Billing you cannot see |
| CMS admin | Your company | Only vendor has admin |
| Backups | Your company or contracted host with restore rights | No tested restore |
| Theme/plugin licences | Company purchase emails | Personal freelancer emails |
| Analytics / Search Console | Company property | Tied to ex-employee Google account |
| Custom code | Assigned in contract | No repo, only a black-box server |
Search Console and Analytics ownership disputes are common; keep organisation-level properties where possible. See also WordPress development handoff habits.
Changing agencies without downtime
A clean handoff needs DNS access, hosting access, CMS admin, licence emails and a content backup before anyone’s accounts are closed. Do not cancel the old host until the new one serves the site correctly and DNS TTL has been lowered and updated.
Test forms, payment, cron jobs and SSL after move. Keep the old environment read-only briefly as rollback insurance when feasible.
Contracts and exit clauses
Ask new vendors for a one-page ownership schedule:
- Domain registrar and account holder
- DNS host
- Hosting provider and account holder
- Repository URL and access method
- Design source location
- Third party SaaS used by the site
- Handoff SLA at end of contract
Include a clause that credentials and assets transfer within a set number of days after final payment, independent of disputes about minor polish items. Escrow rarely needed for small sites; clarity usually is.
Founders and co-founder risk
Early startups sometimes register domains to a personal Gmail. Before fundraising or hiring a marketing lead, move critical assets to company accounts. The same applies to Facebook pages, Google Business Profiles and app store listings tied to the website brand.
Nonprofit and volunteer sites
Volunteer-built sites often live under personal hosting. Boards should require annual access reviews so a departed volunteer does not take the only passwords. Use role accounts and a password manager with shared vaults.
Inventories for multi-site organisations
Groups with many locations or microsites should maintain a spreadsheet of domains, hosts and CMS versions. Orphan microsites are a security and brand risk. Ownership audits twice a year catch renewals before they fail.
FAQ
If I paid for the site, do I automatically own everything?
Not always. Contracts and licence terms decide. Payment helps, paperwork finishes the job.
Can a developer refuse to hand over the domain?
If it is registered to them, you may face a dispute. Prevent this by registering domains yourself from day one.
What about website builders included with hosting?
You often own content export rights but not a fully portable application. Check the host’s export docs.
Should ownership be in the proposal?
Yes. A short schedule listing logins and licence homes saves pain later.
Own the keys, then improve the site
Website ownership is really about keys: domain, DNS, host, CMS and licences. Get those in your company’s hands, then invest in design and performance with confidence. If you want a site built with a clean handoff, see our Turn visitors into customers service.
