Who owns your website? The checks to run today

Many small-business owners only find out who controls their website on the day they need something changed. The designer has moved on, or the renewal notice went to an inbox nobody reads. Paying the invoices does not settle the question. The names on the accounts do.

This is practical guidance for a US small business, not legal advice.

“Owner” means four different things

For the domain alone, four people can look like the owner: the registrant listed in the registration data, whoever’s registrar account the domain sits in, whoever’s card pays the renewal, and whoever knows the password. Ideally all four are your business.

The first two count most. ICANN’s FAQ for registrants warns that a developer you paid may have registered the domain with their own contact details, making them the registrant of record. GoDaddy’s account recovery process is built for people listed as the domain registrant. It asks for a government-issued photo ID and does not accept Articles of Incorporation.

The rest of the website splits the same way:

• Hosting: whose account and card.
• Code and design: who holds the copyright.
• Content: text, photos, and licenses for stock images, fonts and themes.
• Accounts: Google Business Profile, Analytics, Tag Manager, Search Console and email admin.

The checks to run today

1. Look up your domain. Since January 28, 2025, RDAP has replaced WHOIS as the definitive source of registration data for generic domains like .com, and ICANN points people to its free tool at lookup.icann.org, according to ICANN (January 2025). The owner details may read “REDACTED”: under ICANN’s Registration Data Policy (effective August 2025), the registrar may hide the organization name unless the registrant agreed to publish it, so the lookup may not show whether you or your designer is the registrant. The same policy requires the registrar, expiry date and status codes to be shown. ICANN’s status code guide explains that clientTransferProhibited is a normal registrar lock, while redemptionPeriod means the registrar has asked the registry to delete the domain, which then stays in that status for 30 days. If you see that one, call the registrar today.

2. Log in to the registrar yourself. Check that the registrant name and email are your business’s, the card on file is yours, and auto-renew is on. Under ICANN’s Expired Registration Recovery Policy, renewal reminders go out about a month and about a week before expiration, plus a notice within five days after, and they go to the registrant. If the registrant is your designer, the warnings land in their inbox, not yours.

3. Find out who controls DNS. That login controls where your site and email point.

4. Check the hosting account. Your business’s name, your card, the designer added as a user.

5. Get your own CMS admin login, not a shared password. On Squarespace, only the current site owner can transfer ownership, and the new owner must first be invited as a contributor and accept, according to its help center (updated July 2026).

6. Check your Google Business Profile. A profile can have several owners but only one primary owner, and managers can’t add or remove users, per Google’s help page on owners and managers. Your business’s own Google account should be primary owner.

7. Check Analytics, Tag Manager, Search Console and email. You want admin in each under a Google account your business controls, and on Google Workspace, a super admin with recovery options set up.

Why the domain and DNS come first

Secure the registrar and DNS first, because they unlock the rest. If a Workspace super admin is locked out with no recovery options, recovery means adding a CNAME record to the domain’s DNS, and it fails if Google doesn’t find the record within 48 hours, according to Google Workspace Admin Help. If nobody has admin on an Analytics account, Google restores access only if you prove ownership of every site or app sending it data, for example with an analytics.txt file or meta tag (Google Analytics Help). Whoever controls the domain, DNS and site can do that.

The order of steps matters

ICANN’s Transfer Policy (updated February 2024, required of registrars since August 2025) can trip you up mid-recovery.

• Changing the registrant can lock the domain. A material change to the registrant’s name, organization or email triggers a 60-day block on moving to another registrar. The registrar may let you opt out, but only before the change, and ICANN advises requesting any registrar transfer first. So start the transfer (or opt out), then update the name.
• A new or recently moved domain can be held. A registrar may refuse a transfer to another registrar within 60 days of the domain’s creation, or within 60 days of a previous registrar transfer.
• The registrant is entitled to the transfer code. If the registrant can’t get it and remove the lock through self-service, the registrar must do both within five calendar days of the request. If your designer is the registrant, that right is theirs, not yours.

These rules are changing, but not yet. On June 7, 2026, the ICANN Board adopted all 47 Transfer Policy Review recommendations, with implementation “subject to prioritization”. No effective date had been announced when we checked in October 2026. Under the final report (February 2025), the change-of-registrant lock goes away, both 60-day windows become a mandatory 30-day restriction, and the transfer code is renamed a Transfer Authorization Code that expires after 14 days.

At some registrars you can skip the transfer: the designer moves the domain into your own account there. On GoDaddy you have 10 days to accept, and connected products such as a website or email do not move with the domain, according to GoDaddy’s help page. Before anything moves, write down the DNS records, including the MX records that keep your email running.

Don’t cut the agency off on day one

A new Business Profile owner or manager must wait 7 days before transferring primary ownership or removing other users, and a primary owner can’t leave until they hand primary ownership to another existing owner or manager, according to Google Business Profile Help.

In Search Console, deleting the agency’s owner access isn’t enough: while their verification token (a meta tag, HTML file or DNS record) stays in place, they can re-verify, per Search Console Help. Remove the token too.

An agency can move a GA4 property, with its reporting data, into your own Analytics account, which needs Administrator and Editor roles on both accounts (Google Analytics Help). Google’s no-admin recovery doesn’t cover Tag Manager, so get admin on that container while the relationship is friendly.

What a web contract should say

Under US law, copyright belongs first to the author, meaning the designer or developer unless the work is a valid work made for hire, and a transfer needs a written instrument signed by the owner (17 U.S.C. §§ 201(a) and 204(a)). Paying for a website does not by itself make the code, design or copy yours.

A “work made for hire” clause may not fix that alone. The U.S. Copyright Office’s Circular 30 (revised August 2024) says commissioned work from a non-employee qualifies only if it falls into one of nine listed categories, such as a compilation, and a written agreement signed by both sides expressly calls it a work made for hire. In our reading, website code and design don’t clearly fit those categories. Our practical advice: also include an explicit, signed copyright assignment that takes effect on payment, and have a lawyer check the wording.

The contract should also:

• Put every account in your name. Domain, hosting, DNS and Google accounts registered to your business, with the designer added as a user. ICANN advises against listing designers or hosts as the registrant or sharing your registrar login with them (ICANN blog, March 2018). Its good-practice advice (June 2017) is that the business stays registrant even when someone else manages the domain, with that party’s authority in a separate contract.
• List the handover deliverables. Source files, a database export, admin credentials, and licenses for third-party themes, plugins, fonts and stock photos. Those licenses can sit in the designer’s name, so ask how each one moves to you.
• Say when access ends, and how quickly.

If a former designer or agency holds them

Holding the accounts may just have been convenient for the designer, and a clear request may be enough. If not, work in this order:

1. Ask in writing, with a list. Push the domain to your registrar account or send the transfer code, make you primary owner on the Business Profile, move the Analytics property, add you as admin on Tag Manager and Search Console, and send the files.
2. Gather proof. Invoices, payment records, business documents and your ID. ICANN’s FAQ says the registrar may need proof that you paid the developer.
3. Use the platforms’ own routes. You can request ownership of a Business Profile. The current owner has 3 days to respond; if they don’t, you may be able to claim it, though Google says that option isn’t always available. You can appeal a denial. For Analytics, use the no-admin recovery above.
4. Then a lawyer’s letter that cites your contract.

Don’t expect ICANN to referee. The UDRP is built for trademark and cybersquatting cases, and ICANN says other disputes must be resolved “by agreement, court action, or arbitration” before a registrar will cancel, suspend or transfer a domain.

Planning a new site? Put the account list in your website brief. What goes wrong with offshore web teams covers the same ownership trap from the hiring side. On a site builder, this comparison explains why the design may not be portable even when the account is yours.

How Maxverse Lab handles this

We are a remote studio with no US office. On every website we build, you own the domain, the hosting and the code, and we hand over every login. If you are not sure who owns yours, ask us. We reply within 24 hours, and sometimes the answer is a fix you can make yourself.