Topics: Website design & costs
Want this done for your business? Get a fixed quote or book a free 30-minute call.
Quick answer: You truly own your website when the domain, DNS, hosting, CMS, business email and tracking accounts are registered to your business, and you hold a full backup, the theme or source files, licence details and brand assets. Collect all of it at launch and make the final payment conditional on a completed handover.
Ownership problems rarely show up on launch day. They surface a year or two later, when the domain is about to expire, the developer has changed numbers, and nobody can say which email address the hosting account was opened under. By then, fixing it takes weeks. Doing it properly at launch takes about an hour, and this checklist is how.
What does it actually mean to own your website?
Owning a website has three layers: control of the accounts, possession of the files, and the legal right to use and change what was built. Miss any one and you're dependent on someone else.
- Accounts decide who can log in, renew, change or switch off the site.
- Files decide whether you could move the site to another host or developer tomorrow.
- Rights decide whether you're legally free to modify and reuse the design and code.
This article covers the first two. The legal side, including what your contract should say about intellectual property, is covered in our explainer on who owns the code.
Which accounts should be registered in your business name?
Every account the website depends on should be opened with a business email address you control, with your agency added as a user rather than as the owner.
| Account | Why it matters | Owner | Agency access after launch |
|---|---|---|---|
| Domain registrar | Whoever holds it controls your web address and email | Your business | None, or view only |
| DNS (often Cloudflare or the registrar) | Points the domain to your site and email | Your business | Edit, only while they support you |
| Hosting | Where the site files and database live | Your business | Technical user |
| CMS admin (WordPress, Shopify and so on) | Content and settings | Your business, as main admin | Separate admin or editor account |
| Business email (Google Workspace, Microsoft 365) | Your inbox and login recovery | Your business | None |
| Google Analytics | Visitor and conversion history | Your business | Editor or analyst |
| Google Search Console | Search performance and indexing | Your business | Full user, not owner |
| Google Business Profile | Your Maps listing and reviews | Your business | Manager |
| Meta Business portfolio, pixel and dataset | Ad tracking and audiences | Your business | Partner access |
| Google Tag Manager | Every tracking tag on the site | Your business | Publish rights while supporting you |
| CDN or security service | Speed and protection | Your business | Technical user |
Run a quick test on each account: if your agency vanished tomorrow, could you log in, reset the password and see who is billed? If the recovery email or phone number belongs to someone outside your business, such as a former employee or the developer's personal mobile, change it today. Recovery details are the quiet back door that most ownership disputes go through.
Tracking deserves extra care because its history can't be rebuilt. Our guide to the tracking setup you should own explains what each tag does. For ad accounts specifically, see how to give your agency access while keeping control.
Which logins and files should you receive at launch?
Ask for a handover pack and check it item by item before you sign off. It should contain:
- [ ] A full backup of the site: files and database, not just a theme
- [ ] The theme, child theme or source code, plus repository access for custom builds
- [ ] Design files, such as the Figma project, with you as owner or editor
- [ ] Brand assets: logo in SVG and PNG, colour codes and font files or font names
- [ ] Photos and videos used on the site, with notes on licence or usage rights
- [ ] Licence keys for paid themes, plugins and apps, with renewal dates
- [ ] A list of every account above, with the login email used for each
- [ ] Short documentation: how to edit pages, add posts, update forms and where enquiries are sent
- [ ] Any server, SSH or FTP credentials, for sites on your own hosting
Store all of it in a shared password manager and a business cloud folder, not in someone's personal email.
What about licences for themes, plugins and fonts?
Separate the licences you own outright from the ones your agency holds and lends you. Both are normal, but you need to know which is which.
Agencies often use their own developer licences for page builders, premium plugins and some fonts. That keeps your costs down while they support you. If you part ways, those licences usually stay with the agency, and the site may need replacement licences to keep receiving updates.
Ask for a register like this at launch:
| Item | Licence holder | Transferable? | Renewal date | Annual cost |
|---|---|---|---|---|
| Theme | ||||
| Page builder | ||||
| Forms plugin | ||||
| Backup or security plugin | ||||
| Web fonts | ||||
| Stock images |
Web fonts are the item most often overlooked. Some are free to use; others are licensed by domain or traffic.
How do you get access back from an unresponsive developer?
Start with the domain, because every other account can usually be recovered once you control it. Work through these steps in order:
- Look up the registrant. Search the domain's registration details or check old invoices to find the registrar and the name on the record.
- Contact the registrar. If the domain is in your business name, the registrar can help you regain access with proof of identity and ownership, such as registration documents and invoices.
- Request the transfer code. Once you have access, get the authorisation code (sometimes called the EPP or auth code) and move the domain to an account you control.
- Approach the host. Hosting companies will usually work with the account holder or the business named on the paying card. Bring invoices.
- Recover the platforms. Google Search Console can be re-verified through a DNS record once you control DNS, and Google Business Profile and Meta both have processes for requesting access.
- Rebuild only as a last resort. If the domain was registered in the developer's own name and they won't cooperate, you may need legal advice or, ultimately, a new domain and site.
Where should the handover sit in the payment schedule?
Tie your final payment to a completed handover, and write that into the contract before work starts. A simple schedule is a deposit on signing, a payment on design approval, and the final payment on launch with the handover pack received and checked.
"Checked" should mean something specific: you've logged in to every account yourself, the backup has been confirmed to restore, and every paid licence appears on the register with its renewal date. Ten minutes of checking now saves a long recovery later.
At the same time, agree what happens to the agency's access afterwards. If they're on a care plan, they keep the access they need. If not, downgrade or remove their accounts once the post-launch support period ends. Asking about this before you hire is part of choosing a web design company properly.
Frequently asked questions
Who should own my domain name?
Your business, registered with your business details and a business email address you control. Your agency can manage the DNS on your behalf, but the registrant should always be you.
My web designer won't give me access. What can I do?
Start with the domain registrar and hosting company, which will usually help the legal account holder with proof of identity and payment. Once you control the domain, most other services can be re-verified. Check your contract too; if it says the site transfers to you on payment, a polite written reminder often resolves it.
Do I own the theme my website uses?
Usually you own a licence to use it, not the theme itself. Premium themes are licensed per site, and the licence may sit with your developer. Ask whose name it's in and whether it can be transferred to you.
Should my developer keep admin access after launch?
Only while they're actively supporting the site, and through their own named account, never yours. When the support arrangement ends, remove or downgrade their access and change any shared passwords.
What's the safest way to share passwords with an agency?
Use a password manager with shared vaults, and give the agency its own user accounts wherever the platform allows it. Avoid sending passwords by email or WhatsApp, and turn on two-factor authentication using a business device or account.
Want a site that's yours from day one?
We build websites handed over in your name: domain, hosting, CMS and tracking accounts set up under your business, with a handover pack at launch. Planning a new build? Ask us about your project; after a short call we'll confirm the scope, list the accounts we'll create for you and fix the price.