Do you actually own your website? How to check

You own your website only if you control five separate things: the domain name, the hosting account, an administrator login to the content system, the source code and design files, and your content plus your analytics history. Most small organizations control two or three of them and assume they have all five. You can check every one in about twenty minutes without calling anybody.

I am writing this because it is the most common emergency call our studio gets, and it almost never arrives calmly. It arrives as a nonprofit director in Saint Paul who cannot reach the volunteer who set up the site in 2019, or a clinic owner whose developer stopped answering email three months before the domain expired. By then the cheap fix has expired too.

What does it actually mean to own your website?

Ownership is not one thing. It is five assets that usually live in five different accounts, and a website only belongs to you when every one of them is under your control.

What you need to own	Where it lives	The failure it prevents
Domain name	A registrar account (GoDaddy, Namecheap, Cloudflare, Squarespace Domains)	Losing your address, your email, and every link pointing at you
Hosting account	A host or platform, with a payment method attached	The site going dark when a card expires on someone else’s account
CMS administrator login	The website itself	Paying someone to change a phone number
Source code and design files	A repository, a server, or a designer’s laptop	Being unable to move, rebuild, or hire anyone else
Content, photos, analytics history	Your files, plus Google accounts	Losing your search baseline and your right to reuse your own photos

The domain matters most by a wide margin. Hosting can be replaced in an afternoon and a design can be rebuilt. Your domain is the only asset that cannot be substituted, because your email, your printed materials, your Google Business Profile, and every link anyone has ever made to you all point at it.

How do I check who owns my domain name?

Start at lookup.icann.org and search your domain. You will see the registrar, the creation date, and the expiration date. What you will probably not see is a name, because most registrant contact details have been redacted since privacy rules tightened, and a public record that says “REDACTED FOR PRIVACY” tells you nothing about who holds the keys.

So run the real test instead: go to that registrar’s site, click forgot password, and enter the email addresses your organization uses. If the reset link arrives in an inbox you control, you own the domain. If it does not, you do not, no matter what anyone told you.

Three specific things to write down while you are in there:

1. The expiration date. Turn on auto-renew and put the date in a shared calendar, not one person’s.
2. The account email. It should be a role address like info@ or admin@ at your own domain, never a founder’s personal Gmail and never your developer’s address. Board members and office managers leave. The address has to outlive them.
3. Whether the domain is locked. Registrar lock should be on. A domain is also normally locked for 60 days after it is first registered or after it moves between registrars, so plan around that if you are mid-transfer.

This is where small Minnesota organizations get hurt most. A charter school or a community nonprofit gets its first site built by a board member’s cousin, the domain goes into his personal account, and four years later nobody remembers his last name. The site still works, which is exactly why nobody checks.

Do you have access to your own hosting account?

Log in. Not through a link your developer sends you, and not by asking them to make a change on your behalf. Open the host’s website directly and sign in.

Then check whose credit card is on the account. If your developer is paying for hosting and billing you, that is a lease dressed as a service. It is not automatically wrong, and plenty of good studios bundle it, but you should know it is true. Hosting itself is cheap: $10 to $50 a month covers almost every small business, school, or nonprofit site, which is why we quote it separately on our pricing page rather than folding it into a mystery retainer.

You also want a copy of your DNS records. That single screen controls where your website and your email point. Losing access to DNS while your email is still routed through it is how a bad breakup with a vendor turns into a week with no email.

Can you edit your own site without asking permission?

Log into the CMS and try to change a paragraph and add a page. Two things can go wrong here.

The first is permissions. You may have an account but not an administrator role, which means you can edit text but cannot add users, install anything, or export the site. Ask for administrator. If a vendor refuses to give the owner of the business an admin account on their own website, that answer is your answer.

The second is the platform itself. Some platforms let you leave and some do not.

Platform	Can you export and move it?
WordPress (self-hosted) or WooCommerce	Yes. Full database and file export, movable to any host
Custom-built site	Yes, if you have the code repository
Squarespace	Content only. A partial WordPress-format XML with no design or store pages
Shopify	Products, customers, and orders as CSV. The theme only runs on Shopify
Wix	No full-site export
A proprietary “agency platform”	Usually no export at all

None of this makes Wix or Squarespace a bad choice. For a solo therapist or a one-truck contractor, a $25 a month Squarespace site you can update yourself beats a custom build you cannot afford to maintain, and we say so in our Squarespace vs WordPress comparison. The point is to choose it knowing that the design does not travel with you.

Do you own the source code and the design files?

Ask for two things: the code, and the editable artwork. The code means a repository or a zip of the site files, including any custom theme or plugin someone wrote for you. The artwork means your logo in vector format, the layered design files, and a list of every font and stock photo used, with license details.

Fonts and photography are the quiet trap. A designer who used a font licensed to their own studio, or a stock photo under a license that ends when their subscription does, has handed you a legal problem that only surfaces years later. Ask for the license list in writing while everyone is still friendly.

Also read your contract for one clause. In the United States, the person who creates a work generally owns the copyright in it unless the contract assigns those rights to the client. If your agreement is silent about who owns the design and custom code, assume the answer is not you. This is one of the questions to ask before you hire a web designer, and it costs nothing to fix at the start.

Who owns your content and your analytics history?

Your text and photos are yours if you wrote and shot them, but the copies matter. Keep a folder with the current text of every page, the original full-size images, and any documents linked from the site. If your site vanished tonight, that folder is what makes a rebuild a three-week project instead of a three-month one.

Analytics is different, because history cannot be recreated. Google Analytics 4 and Google Search Console properties belong to whoever created and verified them. If your developer set them up under their own Google account, your entire measurement history is theirs to switch off. Search Console keeps sixteen months of performance data, and free GA4 properties cap detailed event retention at fourteen months, so a gap of a year erases most of what you would use to judge a redesign.

Fix it now, while relationships are good. Both properties should be owned by an account at your organization, with your developer added as a user. That is also the baseline you need before any platform move, which is why it is the first item on our guide to moving a website without losing rankings.

What is the catch with a free website and a monthly fee?

The catch is that it is a lease, and the total is usually higher than buying. These offers are common in home services, legal, and senior care, and the pitch sounds generous: no money up front, a site next week, cancel any time.

Read the paragraph about cancellation. In most of these deals, the vendor holds the domain, the hosting, and the platform. When you stop paying, the site goes off, and often the domain does not come with you.

Deal	36-month total	What you own at the end
“Free” site at $199/month	$7,164	Nothing
“Free” site at $299/month	$10,764	Nothing
Owned build at $6,000 plus $150/month care and hosting	$11,400	Domain, code, content, everything

The lease is not always the wrong call. If cash flow genuinely will not support a project fee, paying monthly to have a working site now can be the right business decision. Just insist on two amendments before you sign: the domain gets registered in your organization’s name, and the contract states what you receive if you cancel. A vendor who will not agree to those two lines is telling you what the deal really is.

What do I do if the answers come back bad?

Escalate in this order. Each step costs more than the one before it, so do not skip ahead.

1. Ask nicely, by email, with a specific list. Registrar login, hosting login, admin account, a full backup, and the design files. Most of the time this works, because most of the time nobody is holding anything hostage. They are just busy, or they never thought about it.
2. Ask in writing, with a deadline. Seven to ten business days, referencing your contract and your last invoice. Copy your board chair or business partner. Keep it unemotional. A surprising number of standoffs end right here.
3. Move the domain yourself. If your organization is the registrar account holder, unlock the domain, get the authorization code, and start a transfer to a registrar account you control. It normally completes in about five days. If the account is in the vendor’s name, contact the registrar’s support directly with your business filings and invoices and ask about the account recovery process. Registrars deal with this constantly.
4. Rebuild. Last resort, and the one people jump to first. It costs real money, and it is only the right answer when the site is old anyway or the relationship is genuinely dead.

Here is the part that is against my own interest. If your site works and you simply cannot reach your developer, do not hire anyone to rebuild it. Recovering a domain and moving hosting is a few hours of work. Paying our $95 to $150 hourly rate to sort out access, or paying a competent freelancer less, beats spending $3,500 on a new site you did not need. We have talked more than one Twin Cities nonprofit out of a rebuild that started as a login problem. Ask any studio you are considering what they would do in that situation, and listen for whether the answer is always “rebuild.” Our article on how to choose a web design company covers what else to listen for.

What should a good handover package contain?

Whether the site cost $1,800 or $60,000, ask for this at launch, not two years later:

• Registrar login, with the domain registered in your organization’s name
• Hosting login, with billing in your name
• An administrator account in the CMS
• A full backup: database export plus files, or the platform’s export file
• Source code, plus a list of paid plugins, themes, fonts, and stock licenses and who they are registered to
• Editable logo and design files, including vector formats
• A copy of the DNS records
• Google Analytics and Search Console properties owned by your organization
• Any API keys or third-party accounts (forms, email, payments) in your name
• One page in plain language saying where everything lives and who to call

We register client domains in the client’s name and hand over all of it, including the code, because a client who is free to leave is a better client. That is not generosity, it is just how our web design work is set up. But the checklist above works with any vendor, including one you found on your own, and you should hold everyone to it. If you want a second pair of eyes on what you currently control, send us the domain and we will tell you what we can see from the outside. There is no charge for that, and no obligation attached.