.jpg)
Many business owners find out who really controls their website only when something goes wrong: the developer stops answering, the domain expires, the site is hacked or an agency relationship ends badly. At that moment it becomes clear that ownership is not about who paid for the website. It is about whose name is on the accounts and who holds the keys.
Here are seven things you can check this week. You do not need any technical knowledge, only access to your contracts and the willingness to ask your contractors a few direct questions.
1. The domain name
Your domain is your address on the internet and the base of your business email. Whoever controls the account at the domain registrar controls the domain, regardless of who pays the invoice.
- Which registrar is the domain with, and is the account in your company's name and on a company email address?
- When does the domain expire, and is automatic renewal switched on?
- Can you log in to the registrar account yourself today?
2. Hosting and the website platform
Your website runs somewhere: on a platform such as Webflow, Wix or Shopify, or on hosting for WordPress or custom code. If the account belongs to a freelancer or an agency, they can move, freeze or delete your site.
- Who is the owner of the hosting or platform account?
- Whose payment card is the subscription billed to?
- If your contractor disappeared tomorrow, could you keep the site online?
3. Administrator access
You should have your own administrator account on the website, not a shared password sent by email. Make a list of everyone who has access, and remove former employees and past contractors. Each person should have their own login, ideally protected with two-factor authentication.
4. DNS and business email
DNS settings connect your domain to your website and your email. Whoever can change them can redirect your website or stop your email from arriving. Check who can edit DNS records, and make sure your company holds the main administrator account for your email service, such as Google Workspace or Microsoft 365.
5. Backups
Ask three questions: when was the last backup made, where is it stored and who can restore it? A backup that only your developer can access, or that has never been tested, gives you less protection than you think. Ask for a test restore at least once a year.
6. Rights to content, design and code
Paying for a website does not automatically make you the owner of its design, texts, photos or code. Check your contract: does it transfer the rights to your company, or only give you a licence to use them? Also check that photos, fonts and plugins are properly licensed in your company's name. If the contract says nothing, ask for a written transfer or licence now, while the relationship is good.
7. Analytics, Search Console and ad accounts
Your website data is a business asset. Google Analytics, Google Search Console, your Google Business Profile, Meta Business and your advertising accounts should be owned by your company, with agencies added as users or partners. If an agency owns the account, you can lose years of data and campaign history when you change agency.
What to do next: create an access register
Put everything in one simple table. For each asset, write down:
- The service and what it is used for
- The owner account and who else has access
- The renewal date and who pays
- Where the login details are stored, ideally in a company password manager
Review the register every six months and every time an employee or contractor leaves. If you cannot answer one of the seven questions above, that is the first risk to fix.
A Digital Presence Governance website audit checks all seven points for you and gives you a written action plan in plain language.
← Back to the blog