Who Owns Your Website? Check Your Domain, Hosting and Logins

Why This Question Matters More Than It Seems

Most business owners never ask who owns their website. The site is up, the phone rings, and the bill gets paid. Then one day the web designer retires, an employee quits, or a renewal email goes to an inbox nobody reads.

That is when the owner finds out the domain is in someone else's name. Or the hosting account belongs to a company that closed. Or the Google account that holds every login was a former manager's personal Gmail.

We see this every month in our work with Florida businesses. The fix is almost always simple when you do it early. It is slow, stressful and sometimes expensive when you do it late.

This guide walks you through each check, step by step. You do not need to be technical. You need about an hour, a list of your accounts and a little patience.

Your Website Is Really Four Things

When people say "my website," they mean one thing. Behind the scenes it is four separate pieces, and each one can belong to a different person.

1. The domain. Your address on the internet, such as yourbusiness.com. You rent it year by year from a company called a registrar.
2. The hosting. The computer, usually in a data center, that stores your website and sends it to visitors.
3. The website itself. The pages, photos, text and code. On WordPress, Wix or Squarespace, this is the account where you edit the site.
4. The accounts around it. Google Search Console, Google Analytics, your Google Business Profile, your email, your forms and your booking tool.

You can own one piece and not the others. A common case: the owner pays for the domain, but the designer holds the hosting and the only admin login. Another: everything is in the owner's name, but the recovery email is the designer's address.

So we check each piece on its own. Let's start with the domain, because it is the one that hurts most to lose.

Step 1: Look Up Your Domain's Registration

Every domain ending in .com, .net, .org and most other common endings is registered through a company accredited by ICANN. ICANN is the nonprofit that coordinates domain names worldwide.

For years, people checked a domain's owner with a tool called WHOIS. On January 28, 2025, ICANN made a newer system called RDAP the official source for this data on generic domains such as .com. RDAP stands for Registration Data Access Protocol. In plain words, it is the modern version of WHOIS.

You do not need to know how it works. You just need ICANN's free lookup page.

How to run the lookup

1. Go to ICANN's registration data lookup tool.
2. Type your domain without "www" or "https," for example yourbusiness.com.
3. Press Lookup and read the results.

The lookup is free and anyone can run it. Your registrar may also offer its own lookup page that shows the same kind of record.

What you will see

• Registrar. The company your domain is registered with, such as GoDaddy, Namecheap, Squarespace Domains or Cloudflare. This is where the account lives.
• Created date. When the domain was first registered.
• Expiration date. When it runs out if nobody renews it.
• Status. Short codes such as "client transfer prohibited." That one means the domain is locked against transfers, which is normal and good.
• Nameservers. The servers that tell the internet where your website and email live. We use these in Step 2.

Why the owner's name is usually hidden

Here is the part that surprises people. Most public lookups no longer show the registrant's name, address, phone or email. Privacy laws and ICANN's own policies led registrars to hide that information.

So the lookup will often say "REDACTED" or show a privacy service where the owner's name used to be. That does not mean something is wrong. It means the lookup cannot answer the ownership question by itself.

Step 2: Check the Domain From the Inside

Now take the registrar name from the lookup and try to log in. Search your email for that company's name. Look for receipts, renewal notices and "welcome" emails. They tell you which email address opened the account.

If you can log in

Good. Open the domain's settings and check three things:

• Registrant contact. The name and organization should be you or your business, not your designer or an old employee. This contact is the legal holder of the domain.
• Account email. The login email should be one your business controls, ideally at your own domain. A personal Gmail you share with a past partner is a risk.
• Auto-renew and payment. Turn on auto-renew and check that the card on file is current. Expired cards cause more lost domains than hackers do.

If you cannot log in

Try the registrar's password reset first. If the reset email goes to an address you do not recognize, the account is probably someone else's. Write down which address the registrar shows, even if part of it is hidden. That is a strong clue about who holds it.

Do not panic and do not try to guess passwords. You will fix this in Step 7, in writing and in the right order.

The difference between the account holder and the registrant

This trips up a lot of owners. A web designer may manage dozens of client domains inside one registrar account. That is not always bad.

If the registrant contact inside that account is your business, the domain is legally yours, even though your designer holds the login. Still, you depend on that person to renew it and change it. Our advice is simple: move it to an account in your own name. Your designer can still have access as a helper.

Step 3: Find Out Where Your Website Is Hosted

The domain is your address. The hosting is the building. You need to know which company runs it and whose account it is in.

Clue one: the nameservers

Look at the nameservers from your lookup. They often name the company that runs your DNS, and sometimes the host too. For example:

• Nameservers with "cloudflare" in them mean Cloudflare runs your DNS. Your site could be hosted anywhere behind it.
• Nameservers with a hosting company's name, such as "siteground" or "bluehost," usually mean that company hosts the site.
• Nameservers with "wixdns" or "squarespacedns" mean the site lives on that builder.
• Nameservers with your registrar's name may mean the registrar handles DNS, while the site is hosted somewhere else.

Clue two: the bills

Search your bank and card statements for the last two years. Look for a monthly or yearly charge from a hosting company. If you never see one, someone else is paying. That person almost always holds the account.

Clue three: ask the site

Many sites show the platform in the footer or the login page. Try adding "/wp-admin" to the end of your address. If a WordPress login appears, you are on WordPress, and the host is a separate company. If you are on Wix, Squarespace or Shopify, the builder is also the host.

What you want to see

• The hosting account is in your business name.
• You have your own login, not a shared password.
• You know how to download a backup, or you know the host keeps one you can reach.
• The billing contact is someone at your company.

Some agencies host many client sites on one large server they pay for. That can be fine and even faster. If that is your setup, make sure your contract says you get a full copy of your site and database on request, at any time.

Step 4: Check the Admin Login to the Website Itself

The website itself is where your pages, photos and text live. You need a login with full rights, not just an editor account.

On WordPress

Log in at yoursite.com/wp-admin. Go to Users. Look at the role next to your name. WordPress has several roles, and only the Administrator role can install plugins, change themes, add users and change settings.

If your role says Editor or Author, you can write pages but you do not control the site. Ask your developer to make you an Administrator. While you are there, look at the list of users. Remove anyone who no longer works with you.

On Wix, Squarespace and Shopify

These builders have one main owner per site, plus people added as contributors or staff. Check the site's settings for roles or permissions. If your designer is listed as the owner and you are a contributor, ask them to transfer ownership of the site to your account.

Each builder has its own steps for this, and they change from time to time. Search the builder's own help center for "transfer site ownership" to get the current steps.

On a custom-built site

A site built with custom code may not have an admin panel at all. Ownership then means two things. You have the code, and you have access to the place it is stored, such as a GitHub account in your name. Ask for both.

Step 5: Check Your Google Accounts

Google holds some of your most valuable data: your search history with Google, your visitor numbers and your listing on Google Maps. These accounts should belong to your business, not to whoever set them up.

Google Search Console

Search Console shows how your site appears in Google Search. It lists owners and users with different levels of access. A verified owner proved control of the site. A delegated owner was added by a verified owner. Full and restricted users can see data but cannot manage people.

Open Settings, then Users and permissions. You want your own business Google account listed as an owner. Your developer can be a full user. If every verified owner disappears, Google says the other people lose access too, after a grace period. So never leave the developer as the only owner.

Google Analytics

Google Analytics counts your visitors. In Admin, open Access management at the account level. Your business account should have the Administrator role, which can add and remove users. Your agency can have a lower role that lets it do its work.

Google Business Profile

Your profile on Google Maps may be the most valuable account of all for a local business. Each profile has one primary owner. Other people can be owners or managers. Managers can update information, add posts and reply to reviews, but they cannot manage users.

Check the people and access settings in your profile. The primary owner should be your business, using a Google account that does not belong to one employee. If someone else is primary owner, ask them to transfer it to you.

Other accounts to check

• Google Tag Manager, if your site uses it.
• Google Ads and Microsoft Advertising, if you run ads.
• Your email service, such as Google Workspace or Microsoft 365.
• Your form, booking and chat tools.
• Your social media pages and the business manager accounts behind them.

Step 6: Find the Email Address Behind Every Login

Here is a trap almost nobody checks. You may own every account on paper. But if the recovery email for an account is someone else's inbox, that person can reset the password and take it over.

Make a simple list. For each account, write down the login email and the recovery email or phone. Then ask yourself a hard question: if this person stopped answering tomorrow, could I still get in?

The safest setup

• Use an email at your own domain for business accounts, such as an "admin" or "web" address at yourbusiness.com.
• Make that address one you control forever, even when staff change.
• Turn on two-step verification, and keep the backup codes somewhere safe.
• Store every login in a password manager that the owner controls.

A shared mailbox at your domain is better than any one person's Gmail. When a manager leaves, you change who reads the inbox. The accounts never move.

Step 7: What to Ask Your Developer

Most developers are honest and happy to help. Many set things up in their own name because it was faster at the time, not to trap you. Start friendly and in writing.

Here are the questions we suggest. Send them by email so you have a record.

1. Which registrar holds our domain, and whose account is it in?
2. Who is listed as the registrant contact?
3. Which company hosts the website, and whose account is it in?
4. Can you make me an administrator on the website, the hosting and the domain?
5. Can you send a full backup of the site, including the database and media files?
6. Which Google accounts own our Search Console, Analytics, Tag Manager and Business Profile?
7. Are any plugins, themes or tools licensed in your name? What happens to them if we stop working together?
8. Does our contract say the website, its content and the domain belong to us?

A good developer answers these in a day or two. If the answers are vague, slow or defensive, that is a signal to act sooner rather than later.

A sample message

You can copy and adjust this: "Hi, we are updating our business records and want every account in the company's name. Could you send us the list of accounts for our website and add our admin email as an owner on each one? We still want you as our developer, with your own access. Thank you."

Notice the tone. It does not accuse anyone. It just asks for what every business should have.

How to Fix Ownership, Piece by Piece

Once you know who holds what, fix it in this order. The domain comes first, because everything else points to it.

1. The domain

If the domain sits in your designer's account, there are two common fixes. They can move it to an account you open at the same registrar, which most registrars call a push or an account change. Or you can transfer it to a new registrar in your own name.

Either way, check that the registrant contact is your business when you are done. Changing the registrant can trigger a temporary transfer lock at some registrars. That is normal and goes away on its own.

2. The hosting

Ask the host about transferring the account to you. If that is not possible, open your own hosting account and have the site moved there. Moving a site is routine work for a developer. Plan it for a quiet day and keep the old account open until the new one is tested.

3. The website login

Get an Administrator account in your own name. Then remove shared logins. Every person should have their own account, so you can remove one person without changing everyone's password.

4. The Google accounts

Add your business Google account as owner or Administrator on each one. Then decide what access your developer keeps. Most agencies only need full user access in Search Console and a working role in Analytics.

5. The contract

Read your contract or ask for one. It should say the website, its content and the domain belong to your business once paid for. If you are unsure what your contract means, ask a lawyer. We are not lawyers and this is not legal advice.

Red Flags That Mean You Should Act Now

• Nobody at your company can log in to the registrar.
• Renewal emails for the domain go to a person who no longer works with you.
• Your website only has one admin login, and it is not yours.
• You have never seen a backup of your site.
• Your developer says the site "can't be moved" without explaining why.
• Your domain expires within 60 days and auto-renew is off.
• Your Google Business Profile is owned by a marketing company you no longer use.

Any one of these is worth a phone call this week. Two or more is worth a call today.

Common Myths About Website Ownership

"I paid for it, so it's mine"

Paying for the design does not move the domain or the hosting into your name. Those are separate accounts. Payment helps your case in a dispute, but the account holder is the one who can make changes today.

"My name is on the invoice, so the domain is in my name"

An invoice from your designer shows you paid them. It does not show who the registrar lists as the registrant. Only the registrar account can answer that.

"Google Business Profile is free, so nobody owns it"

Free does not mean ownerless. Every profile has a primary owner, and that person decides who else gets in. If it is a former agency, they hold the keys to your listing on Google Maps.

"My site is on Wix, so I don't need to worry"

Builders handle the hosting for you, which is easier. But the site still belongs to one account. If a designer built it under their account, they are the site owner on paper. The same checks apply.

"If something goes wrong, I'll just start over"

You can build a new site. Losing your domain is different. Your address is printed on your trucks, cards and reviews, and Google has years of history tied to it. Starting over on a new domain often means starting over in search too.

What If Someone Will Not Hand It Over?

Most of the time, a polite written request is enough. Once in a while, a former designer stops answering or asks for money you do not think you owe. Here is the order we suggest:

1. Send a short, calm email listing exactly which accounts you need moved.
2. Follow up once after a week, and keep copies of everything.
3. Gather your proof: invoices, contracts, emails and anything with your business name on the domain.
4. Contact the registrar's support team. Ask what they need from you as the registrant.
5. If the domain is truly at risk, talk to a lawyer before you take any other step.

Do not let the domain expire on purpose to "get it back." Expired domains can be grabbed by other buyers, and then the problem gets much bigger.

What It Looks Like for Different Businesses

A family restaurant

Say a restaurant in Hialeah had its site built by a cousin ten years ago. The cousin moved away. The domain renews on his card, under his account. The fix is a friendly call, a new registrar account in the restaurant's name, and a domain move. It is an afternoon of work if the cousin helps.

A medical or dental office

Offices often have a marketing company that set up everything, including the Google Business Profile. When the office changes vendors, the profile stays with the old company. Ask for primary ownership before you end the contract, not after.

A contractor or home service company

Contractors often have a Google account for each new office manager. Over the years, logins end up spread across five inboxes. A shared admin address at your own domain ends this for good.

Keep It Fixed: Your One-Page Ownership Record

Once everything is in your name, write it down. Keep a one-page record in a safe place, and update it once a year.

• Domain: registrar, account email, expiration date, auto-renew on.
• DNS: who runs it and how to log in.
• Hosting: company, account email, plan renewal date.
• Website: platform, admin users, where backups are kept.
• Google: which account owns Search Console, Analytics, Tag Manager and Business Profile.
• Email: provider and the admin account.
• People with access: who, which accounts, and when you last reviewed it.

Put the passwords in a password manager, not in the document. The document says where things are. The password manager holds the keys.

How We Handle Ownership for Our Clients

At The Equation Agency, every site we build is set up in the client's name from day one. The domain, hosting, Google accounts and code all belong to the business. We work with our own access as your developers. If you ever leave, you take everything with you.

If you are not sure where your accounts stand, our free SEO audit looks at your site from the outside and is a good first step. We also cover how a site is put together in our web design and development work, and how domain and hosting choices affect speed in our website speed guide.

Whatever you decide, do the checks in this guide this month. Ownership problems never get easier with time.

Website Ownership FAQ

Sources

• ICANN: Launching RDAP, sunsetting WHOIS (January 2025)
• ICANN Registration Data Lookup tool
• DNSimple: Domain privacy after GDPR
• Google Search Console Help: Managing owners, users, and permissions
• Google Analytics Help: Access and data-restriction management
• Google Business Profile Help: Add and remove owners and managers

More From the Blog

• Google Business Profile Posts: 30 Ideas That Bring Calls
• Website vs. Social Media: Who Owns Your Business Content?