Many business owners assume they own their website because they paid for it. Then a developer stops answering emails, or an agency relationship ends badly. Suddenly the owner discovers that the domain is registered in someone else’s name, the hosting account belongs to the agency, and nobody is sure who holds the rights to the design and code.

Website ownership is not one thing but several: the domain name, the DNS settings that point it somewhere, the hosting account, the content management system and its administrator accounts, the code and design, and the content itself. Each can be controlled by a different person or company.

This guide explains each layer in plain language, what can go wrong, and the practical steps that keep your business in control. It is general information, not legal advice. For contracts and intellectual property questions, speak with a qualified attorney.

The layers of website ownership

Think of your website as a set of connected pieces, each with its own account and its own rules.

The domain name. This is your address on the web, such as yourbusiness.com. You do not buy a domain outright; you register it for a period of time through a registrar and renew it. The listed registrant controls it.

DNS. Domain Name System settings tell the internet where to send visitors and email for your domain. DNS may be managed at your registrar, your host or a separate provider.

Hosting. This is the server space where your website’s files and database live. The hosting account holder controls access, backups and billing.

The CMS and admin accounts. If your site runs on a content management system such as WordPress, someone holds the top-level administrator account.

Code, design and content. These are creative works. Who owns the rights depends on who created them and what your agreements say.

Third-party services. Analytics, email marketing, payment processors, forms and plugins often have their own accounts and licenses.

You need clear control over every layer, or at least documented access, to truly own your website.

The domain: your most important asset

If you lose control of your domain, you lose your website address, and often your email too. A domain someone else controls may be impossible to recover.

In a 2017 post titled Do You Have a Domain Name? Here’s What You Need to Know, ICANN, the organization that coordinates the domain name system, explained why registrants should keep their contact information up to date. It noted that registrars are required to notify registrants when a registration is about to expire, typically by email. If a registrar cannot reach you because your contact details are out of date and the registration expires, the post warned, recovering it may take considerable time and expense, or it may not be recoverable at all.

The same post explained that registrars send notifications when changes are made to a registration so that owners can confirm them or act if a change was unauthorized. It warned that bad actors can gain access to accounts and change registration details to lock owners out and hijack domain names. It also noted that providing wrong information on purpose, or failing to update it promptly, can lead a registrar to suspend or cancel a registration, and that only your registrar, not ICANN, can update your contact information.

Practical steps for your domain:

  • Make sure your business, not an individual employee or vendor, is listed as the registrant.
  • Use a shared business email address for the registrar account, not one person’s personal inbox.
  • Keep contact details current and respond to registrar verification requests.
  • Turn on automatic renewal and keep a valid payment method on file.
  • Record the registrar name, account login location and renewal date somewhere safe.

DNS and account security

Controlling the domain also means protecting the accounts that can change where it points. In January 2019, the Cybersecurity and Infrastructure Security Agency issued Emergency Directive 19-01 on DNS infrastructure tampering to federal agencies. It described attackers who first compromised the credentials of accounts that could change DNS records, then altered records such as Address, Mail Exchanger and Name Server records to redirect and intercept web and mail traffic. Because attackers could set DNS values, the directive explained, they could also obtain valid encryption certificates for the targeted domains, so visitors saw no warnings.

The directive required agencies to audit their DNS records, change passwords for accounts that could alter DNS, add multi-factor authentication to those accounts and monitor certificate transparency logs. In its frequently asked questions, CISA recommended moving domains to a registrar that offers multi-factor authentication when the current one does not.

That directive applied to government agencies, but the lessons suit any business. Use strong, unique passwords stored in a password manager for your registrar, DNS and hosting accounts. Turn on multi-factor authentication everywhere it is available. Remove people who no longer need access.

Hands in green sleeves plug a small security key into a laptop port beside a yellow notebook and a plum pen.

Hosting: who holds the keys

Many small businesses let a developer or agency set up hosting under the agency’s own account. This can be convenient. The risk appears when the relationship ends. If the hosting account is not yours, you may need the agency’s cooperation to move your site, and in the worst case you may lose access to your files.

Options to stay in control:

  • Open the hosting account in your business’s name and give your developer their own user access.
  • If your agency hosts your site on its own infrastructure, make sure your agreement explains how you can get a complete copy of your files and database, and in what time frame.
  • Keep a recent backup that you can access independently.
  • Know where your billing goes and who receives renewal and security notices.

Code and design: understanding copyright

This is the layer that surprises people most. Paying someone to build your website does not automatically make you the copyright owner of the work they create.

The U.S. Copyright Office explains this in Circular 30, Works Made for Hire, revised in August 2024. A work is made for hire in two situations: when it is created by an employee as part of the employee’s regular duties, and when a certain type of work is created as a result of an express written agreement between the creator and a party specially ordering or commissioning it. When a work is made for hire, the hiring or commissioning party is considered the author and copyright owner. Otherwise, the author is ordinarily the person who actually created the work.

The circular lists the specific categories of commissioned work that can qualify, and it describes factors used to decide whether someone is an employee or an independent contractor. Whether a particular website project fits these rules is a legal question that depends on the facts and the paperwork, which is why it is worth asking an attorney.

In practice, businesses often address ownership through their contracts. Common approaches include a written assignment of copyright to the client once the project is paid for, or a license that clearly describes how the client may use, modify and move the work. Either way, the key is that the terms are written down and understood before work begins.

A few points to clarify in any web project agreement:

  • Who owns the custom design, code and written content once the project is paid for.
  • What the developer keeps, such as reusable tools, frameworks and code libraries they use for many clients.
  • How licensed components, such as themes, plugins, fonts and stock photos, may be used, and in whose name those licenses are held.
  • What you receive at the end: files, database, documentation and account credentials.
  • What happens if the relationship ends early.

Content and third-party licenses

Text, photos, videos and logos on your site may come from many sources. Content your staff write as part of their jobs typically belongs to your business, while content from freelancers, photographers or stock libraries depends on the terms of each agreement or license. Keep copies of licenses and receipts, and note which images came from where.

Premium themes and plugins are often licensed to a specific account, so ask whose account holds them.

A smiling bakery owner in a yellow apron serves a customer in a green jacket who checks her phone beside plum pastry boxes.

A fictional example

Consider an invented bakery whose owner hired a freelance developer to build a new website. The developer registered the domain in her own name to save time, set up hosting under her own account and bought a premium theme under her own license. Everything ran smoothly for three years.

Then the developer moved overseas and became hard to reach. When the domain came up for renewal, the reminder went to her old email. The bakery’s site and email went offline for several days before the owner tracked her down, and transferring the domain, hosting and theme license into the bakery’s name took weeks.

Afterward, the owner created a simple ownership record: registrar, DNS provider, host, CMS administrator, theme and plugin licenses, analytics and email services, each with the account holder, login location and renewal date. Every account is now in the bakery’s name, with multi-factor authentication and a shared business email. In this fictional scenario, the next developer received their own access, not the keys to everything.

Your website ownership checklist

Review where you stand today:

  • The domain is registered in your business’s name, with current contact details and automatic renewal.
  • Registrar, DNS and hosting accounts use a shared business email, strong unique passwords and multi-factor authentication.
  • You hold, or can immediately obtain, the top-level CMS administrator account.
  • You have a recent backup of files and database you can reach without anyone else’s help.
  • Your agreements state who owns the custom design, code and content, and what you receive at the end of a project.
  • Theme, plugin, font and image licenses are documented, with account holders noted.
  • A written ownership record lists every service, account holder and renewal date.
  • Access is reviewed at least once a year and whenever staff or vendors change.

Working with a partner you can trust

Good web partners are comfortable with clients owning their accounts and assets. When evaluating a developer or agency, ask how they handle domain registration, hosting, licenses and project handover, and whether they put ownership terms in writing. Our approach to why clients choose Motta Industries centers on transparency, and our full range of web design and development services can be set up so your business keeps control of every layer.

The bottom line

Owning your website means controlling each piece of it: the domain, DNS, hosting, administrator accounts, code, design, content and licenses. Most ownership problems come from convenience shortcuts taken at the start of a project and forgotten later. Put accounts in your business’s name, secure them, document everything and get ownership terms in writing. If you are unsure who controls your site today, contact us to talk through an ownership review.