Do You Actually Own Your Website?

Most owners think they own their website. What they actually own is a login to someone else's account. The difference does not matter at all until the day it matters completely.

Search any business forum for long enough and the same thread keeps resurfacing in slightly different clothes. A web admin who stopped answering and will not hand over the passwords. A site still unfinished after eleven months, with the owner unable to move it anywhere else because the domain sits in a registrar account they have never seen. Nobody posts those threads while things are going well. They post them in the week they decided to leave.

Access is not ownership

Ownership means your name, or your company's name, is on the account. You can log in without asking anyone. You can revoke another person's access without their cooperation. You can move the asset to a new provider tomorrow and nobody has to sign off.

Access means someone else owns the account and lets you in. That is a courtesy. Courtesies end when a relationship ends, an invoice gets disputed, a developer takes a full-time job, or a one-person shop simply stops replying to email.

The uncomfortable part is that these two states look identical while everything is fine. You log in, you see your site, you update a page. The test is not whether you can log in. The test is whether you can lock them out.

Ask yourself one question. If the person who built your site disappeared tonight and never replied again, how long until you have a working website, your domain, your email, and your historical data back under your control? If the honest answer is "I'd have to ask them," you do not own it.

The eight assets, and who should hold each one

Ownership is not one thing. It is a stack, and each layer can be held hostage independently. Go down this list and write a real name next to each one. Not an agency's name. Yours.

1. The domain registrar account. This is the top of the pyramid. Whoever controls the registrar controls where your website and your email point. The registrar account should be in your company's name, with your billing card, and your email as the recovery address. Not the agency's. Not the developer's personal Gmail.

2. DNS. Sometimes DNS lives at the registrar, sometimes at a separate provider. Either way, know where your records live and have the login. DNS is how a departing vendor can take your email offline in ninety seconds.

3. Hosting. Your own account, your own card, with the agency added as a collaborator. Reseller hosting bundled into a monthly fee is the most common trap in this entire list, because the hosting is genuinely invisible to you until you try to leave.

4. The codebase or site files. If it is custom, you should have the repository, or at minimum a full export, in your possession today. If it is a CMS, you should know how to export the database and the media library. Ask for a backup you can actually open, not a promise that backups exist.

5. The CMS admin account. Administrator level, not editor. If your access cannot create and delete other users, it is not administrator level.

6. Analytics, tag manager, and pixels. These are properties inside an account. If the property was created inside the agency's account, your three years of traffic history belong to the agency, and losing it means losing every before-and-after comparison you will ever want to make.

7. Ad accounts and the business manager. Your business manager, your ad account, your payment method, agency granted partner access. This one costs the most to get wrong, because ad accounts carry learning history and audience data that does not transfer.

8. Brand source files. Not the exported PNG. The layered working file, the vector logo, the font licenses in your name. An exported logo is a picture of your brand. The source file is the brand.

A vendor who resists handing over any of these eight is telling you something useful about how the relationship ends.

Why this happens, and why it usually is not malice

It is tempting to read every hostage story as theft. Most of them are not. They are convenience that hardened into dependency.

A developer sets up hosting under their own account because it is faster than walking a client through a signup form. An agency creates the ad account inside their own business manager because that is where their team already works. Nobody writes it down. Three years pass. The assets accumulate inside someone else's walls, and the handover that was never designed becomes a handover that is genuinely difficult to perform even when both sides want it.

Then add the cases where it is deliberate. Bundling the domain into a monthly retainer is a retention strategy. It works, because the cost of leaving is not the new website, it is the migration, the downtime, and the fear of breaking your own email.

Either way, the outcome is the same for you. The fix is also the same, and it costs nothing to apply at the start of a relationship and a great deal to apply at the end.

What a locked asset actually costs

The real cost is almost never the rebuild. The real cost is the window you miss while you are rebuilding.

Look at the shape of this. A long-running arts festival with a fixed date on the calendar ran a two-month campaign and tracked $15,876 in ticket revenue through it, alongside 1M+ impressions, 600K+ reach, 97K+ video views, and a 2.65% top-performing ad CTR. The outcome was the festival's first sellout in fifteen years. That entire result sat inside a two-month window that could not be moved, because the event date could not be moved.

Now imagine the ad account in that scenario belonged to a departed vendor. Not permanently. Just for five weeks while lawyers and support tickets sorted it out. The campaign does not run late. It does not run at all, because the thing it was selling has already happened.

The same logic applies to a launch. An education product launch ran about five months on LinkedIn and Meta ads, from a founder with no existing audience, and produced $39,378 and 1.4K+ new followers. Launch momentum is a window too. Three weeks of frozen access does not delay that number. It removes the compounding that produced it.

Every meaningful marketing result in the files above is tied to a dated moment. An event. A launch. A rename. That is the pattern. And a dated moment is exactly the thing a locked account cannot wait for.

The clauses to demand before you sign

Put these in writing before work starts, when you have maximum leverage and zero urgency.

• Client-owned accounts clause. All domain, DNS, hosting, analytics, ad, and business manager accounts are registered in the client's name, with the client as owner. The vendor is granted access, not ownership.
• Work-for-hire and IP assignment. On final payment, all design files, source files, and custom code transfer to the client, including editable originals.
• Thirty-day offboarding clause. On termination for any reason, the vendor provides a full export of site files, database, and media within thirty days, and transfers or removes its own access on request.
• No bundled registrar. Your domain is never paid for by, or renewed inside, a vendor's account.
• Credential inventory. A single shared document listing every account, its owner, and its recovery email, updated whenever a new tool is added.

None of this is adversarial. A good vendor will agree in about four seconds, because a good vendor's retention strategy is results, not locked doors.

"Can't I just get a cheap site and own it outright?"

You can, and plenty of operators do. A marketplace vendor will sell you a site and hand over the files without any fuss, and you will genuinely own every pixel of it.

Then the question becomes what you now own. A website is a delivery mechanism. What it delivers is a position: who you are for, what you are worth, and what you are being compared against. A cheap vendor sells you a page. They do not sell you the argument the page is supposed to make. Own a beautifully built site that is aimed at the wrong buyer and you have bought a faster way to lose the same deals.

Which is the broader version of this whole topic. Ownership of the asset and control of the message are two separate problems, and most businesses have both. Getting the passwords back fixes the first one. It does not touch the second.

Start with the checklist anyway. Own the stack, then decide what you want it to say.

If you are about to sign with someone new, or about to leave someone old, the ownership terms are the cheapest thing you will ever negotiate. If what you actually need is a position worth building that site around, book a strategy call.