Do you actually own your website? How to check in 10 minutes

Nobody checks this while things are going well. It comes up when a renewal invoice arrives from a name you do not recognise, when the developer stops replying, or when you want to move and find you cannot log in to anything.

All of it takes ten minutes and needs only a browser.

The seven things you need to own, and why each one matters

A website is not one asset. It is seven, usually held in different places, and each can be lost independently.

The eighth item is not an account. It is the copyright in the design and the code, and it is the one people get most wrong.

How to check who your domain is registered to

For a .uk domain use the Nominet WHOIS lookup at nominet.uk. Nominet is the official registry for every .uk address. For .com and the rest, use lookup.icann.org.

Read two fields. The registrant is the legal owner. The registrar is the company the domain is managed through, such as GoDaddy, 123-reg or Cloudflare. Confusing the two is where trouble starts.

Since 2018 personal details are usually redacted, though company registrants often still show. Even fully masked you can see the registrar and the expiry date. Put that date in your own calendar, whoever is meant to be renewing.

Who controls your DNS, and why this is the one that traps people

The same lookup shows your nameservers. If they read ns1.somedesignagency.co.uk, that agency controls your DNS, and DNS decides where your email goes as well as your website. You can own the domain outright and still be exposed here. It is rarely malicious. More often the agency stops paying for something and everything attached goes dark.

The tidy end state is DNS in an account in your name with your own card on it. That is the practical meaning of you hold the keys, and why that matters.

Hosting, CMS and business email logins: what to ask for

One test cuts through hosting: who invoices you. An annual invoice from a hosting company addressed to your business means the account is yours. If you only ever pay your web designer, your site is a slot in their reseller account, with no route to it without them.

Ask for two things. A login, and a full backup: the site files and the database, as files you keep. A login you can be locked out of is no safety net.

Check your CMS role, not just your password

In WordPress, open Users, then All Users. If your role reads Editor rather than Administrator, you can change words but not add users. Look for accounts you do not recognise, which is common with older trade websites.

Business email is the one nobody thinks about

If your developer set up your Microsoft 365 or Google Workspace, they are the global administrator and you are a user inside it. Ask to be made an admin on your own domain.

Analytics and Google Business Profile: the two everyone forgets

In Google Analytics go to Admin, then Property Access Management, and confirm you are an Administrator. Then look one level up, because a property sits inside an account, and if that account is your agency's you can be removed from it. Analytics history cannot be rebuilt.

In Search Console, verify the site yourself using the DNS TXT record method. That survives a rebuild. A file upload does not.

The Google Business Profile is usually the biggest source of enquiries for a plumber, a dentist or a garage. Check whether you are Owner or only Manager: a manager can be removed at any moment. If your developer is the primary owner, ask them to transfer it. If they have vanished, Google's request access process gives them up to seven days to respond, after which you may be able to claim it.

The code, and what UK copyright law actually says

Under the Copyright, Designs and Patents Act 1988, the author of a work owns the copyright unless they made it as an employee. A contractor is not an employee. Paying the invoice buys the work but does not by itself transfer copyright, and section 90(3) requires a written, signed assignment.

You usually have an implied licence to use the site. What you may not have is the right to modify it, move it, or hand it to another developer. Ask for a short written assignment to your company, which a reasonable supplier sends the same day. Check licences too, because fonts and stock photography bought in the agency's name often do not transfer. These are the ownership questions to ask up front.

What to send your current web designer, word for word

Tone matters. An accusatory email gets a defensive, slow reply. A calm administrative request usually gets everything back inside a week, because most suppliers are not hiding anything, they just never got round to it.

What to do if they will not hand things over

Work through this in order. The cheap options usually work.

1. Check whether you owe them money. Most refusals are an unpaid invoice, and the standoff dissolves the moment it is cleared.
2. Put a date on it. Ten working days, in writing, politely. A specific deadline moves what a vague chase does not.
3. Go to the registry. On a .uk domain, if your company is the named registrant you can deal with Nominet directly to change the managing agent, without your developer's cooperation, for a small fee.
4. Ask for your data back. If they hold enquiry submissions or a customer list, you are the data controller. Under UK GDPR a processor must return or delete it on your instruction.
5. Know when to stop. Keep the domain, rebuild on the same page addresses so rankings survive, and recover the old text from the Wayback Machine. Two weeks of arguing costs more than a small site does.

Most domains outside .uk carry a sixty day lock after registration or a change of registrant, so start early rather than the week before a renewal.

What a proper handover looks like at launch

None of this should be necessary. Done properly at launch it takes half an hour: domain in your company name in an account you control, DNS alongside it, hosting billed to you, an administrator login, a downloaded backup of files and database, analytics and Search Console in your own Google account, primary ownership of the Business Profile, and one page listing every login. Ask before you commit, and treat reluctance as the answer.

One thing worth saying plainly, because it works against us. If your business is simple, your budget is nothing and you enjoy doing the work yourself, a Wix or Squarespace site is a reasonable choice. What you get back if you leave varies: Squarespace exports your text as XML but not your design, and Wix has no site export at all. Even so, a site you control beats a custom site you do not. Register the domain in your own name and point it at the builder. That alone removes most of the risk. More on what you own on a builder subscription.

A custom build earns its money when the site has a job to do: rank for something competitive, take bookings, or stand for a business where a scruffy template costs work. Our position is one line under who owns the website and the domain.