Owning your own website

A website is four separate possessions, held in four separate places, and each can be in a different name.

The domain. The address itself, registered through a registrar with a registry behind it. The name recorded as the registrant is the holder, whatever the invoice says. If the agency registered it in its own name, the agency holds it.

The hosting. The account at whichever company serves the pages, and the settings inside it. For a static site this also means the account at the service that builds and publishes the site, and the settings it needs to do so. When we tested rebuilding one shop from its code alone, it failed, because 19 settings held in the hosting account were missing from the handover. The code was not enough. The settings were part of the site.

The code and the content. The files that make the site, and the words and pictures in it. On a WordPress site these are in a database and a folder on the server, and are only yours if you can export them. On a site built from a repository they are plain files in version control, with their whole history, readable by any engineer.

The sign-ins. The editor, the domain account, the hosting account, the repository, and the services behind forms and payments. Each has an owner, each should have a second factor, and the list of who holds what is the thing most businesses have never seen.

• The domain. Look the address up in a public registry record. For most endings, ICANN’s lookup tool shows the registrar and the registrant organisation. For a .uk address the registry is Nominet, and its lookup page is the place to check. If the registrant is your company, good. If it is the agency, a person who has left, or hidden behind a privacy service nobody can account for, that is the first finding. Note the expiry date while you are there.
• The hosting. Find the last hosting invoice. Who is it addressed to, and from whom? If there is none, because hosting is bundled in the agency’s fee, the account is almost certainly in the agency’s name.
• The code and content. Ask for a copy. For WordPress, an export of the database and the files; for a repository site, access to the repository. A supplier who hesitates has told you something. A supplier who cannot has told you more.
• The sign-ins. Write down every account that can change the site and who holds it. Try to sign in to each. Check that two-factor authentication is on; the main code hosting service has required it of everyone who can change code since 2023, which is a reasonable standard for the rest.

If all four are in your name, or in a supplier’s name under a written agreement that says they are held for you and lists them, you own the site. If not, you own the right to argue about it.

A domain can be moved between registrars, and the rules are clearer than most owners think. Under the policy that binds registrars for the common endings, the registered holder “must be able to transfer their domain name registrations between Registrars”, is “the only party that has the authority to approve or deny a transfer request”, and must be given the authorisation code that proves it. A registrar may refuse a transfer for a short list of reasons: suspected fraud, a real dispute over who the holder is, fees already owed, or a transfer requested within 60 days of registration or of the last move. It may not refuse because a future period is unpaid or because the holder did not reply to a message.

The catch is in the first sentence. Those rights belong to the registered holder. If the agency is the registered holder, the agency has them and you do not, and your remedy is a conversation, a contract or a court. That is why the registrant field is the first thing to check and the first thing to put right.

This is the commonest version of the problem and it has a sequence.

First, establish what you hold, using the checks above, before contacting anyone. Second, write to the agency, at every address you have, asking for the four things and a date. Keep the correspondence. Third, if the domain is in your name, change the registrar’s account password and the contact details to someone who will be there next year, and set the domain to renew automatically on a card the business controls. Fourth, if the domain is in the agency’s name, ask for a transfer in writing, citing the policy; if there is no reply, the route depends on the ending. For a .uk address, Nominet runs a dispute service. For a .com, the registry will not decide who should hold it: the routes are ICANN’s dispute policy, which covers registrations made in bad faith, or a court. Take legal advice before either. Fifth, take a copy of the live site as it stands, so that whatever happens next, the content is not lost.

A new supplier can do all of this with you, and should offer to before quoting for anything else.

The UK’s National Cyber Security Centre tells organisations to know who their suppliers are and to build security into contracts. For a website that means three questions in writing before the project starts: in whose name will the domain, hosting and code be held; what document will list every account and setting the site needs; and what happens on the day we part. Of ten competitor firms we reviewed when planning this site, one stated ownership and handover as a promise on its own pages. The other nine may well do it. They do not say so, and a buyer should not have to ask twice.

Our own answer is on the About page: the code, the domain and the hosting are in accounts in your name, or transferable to your own accounts on request, and every site ships with a written handover listing where everything is and the settings it needs, prompted by the restore test that found 19 missing. If you would like to know what you hold today, ask an engineer and we will walk through the four checks with you. It takes ten minutes and costs nothing.