Do you actually own your website? Domain, hosting and logins explained

There’s no single switch that makes you the owner of a website. Your business can control its domain, hosting, website login, content rights and Google accounts to different degrees, and each one is checked in a different place.

This guide walks through those checks in order, so you can see where you stand today, what evidence to keep, and what to ask for if something is missing.

Checked against the sources linked below on 29 September 2026. This is general information, not legal advice.

Why “I paid for the website” doesn’t settle it

Three things people often assume turn out to answer only part of the question.

“I paid for the website.” Payment and copyright are separate. In UK law, whoever creates a work is usually the first owner of the copyright, not the person who commissioned it, unless you agree otherwise in writing (GOV.UK). A transfer of copyright only takes effect if it’s in writing and signed by, or on behalf of, the person transferring it (Copyright, Designs and Patents Act 1988, s.90(3)). Your contract is what matters.

“I can edit the pages.” Being able to change text in WordPress doesn’t mean you control the hosting account, the domain or the site’s files. Those are separate accounts with separate logins.

“The designer pays for the hosting.” That tells you who is billed. It doesn’t tell you whose name the account is in, who can download a full copy of the site, or what happens if payments stop.

How to use this check

Work through the seven areas below in order. For each one, note down four things: where you checked, what you found, the evidence you’ve kept, and what’s still missing.

Keep your notes somewhere private. Don’t write passwords into the checklist, email them, or post them anywhere. If someone needs access, add them as a named user with their own login instead of sharing yours, and turn on two-step verification wherever an account offers it.

1. Your domain name

The domain (for example, yourbusiness.co.uk) is registered through a company called a registrar. For .uk domains, the registry behind it is Nominet. The person or organisation named on the registration is the registrant.

Where to check. Log in to the registrar account where the domain renews. If you don’t know which registrar that is, look for renewal invoices or emails. A public WHOIS lookup may help, but for .uk domains it usually won’t show the registrant’s name or address unless they’ve agreed to publish it (Nominet). Other domain endings, such as .com, follow their own rules, and lookups for those may also hide the owner. Your own registrar account is the reliable place to check.

What to record.

• The registrar’s name.
• Whose name the registration is in (the registrant).
• The expiry date and whether auto-renew is on.
• Which email address receives renewal and security messages.

Keep a screenshot of the domain’s details page in the registrar account.

What it means.

• If the registrant is your business and you have your own login to the registrar account, you control the domain.
• If the registrant is your designer, or you can’t log in, someone else controls renewals and settings, whatever was intended.

If it’s missing. Ask in writing for:

• the registrant to be your business, with your contact details;
• your own login to the registrar account, or a transfer to an account you hold.

Check the expiry date first. A domain that lapses during a disagreement is the harder problem.

If the domain is registered to your business but you’ve simply lost the login, contact the registrar directly. Registrars deal with the account holder, which is why knowing whose name is on the account matters.

2. Your hosting account

Hosting is where the website’s files and database are stored. The domain’s DNS settings point visitors to it, and those settings may be managed at the registrar or the host.

Where to check. Log in to the hosting control panel. Look at the billing page, the account holder details, where DNS is managed, and the backup settings.

What to record.

• The hosting company.
• The name on the account.
• Who pays.
• Whether you have your own login and what level it gives you.
• Where DNS is managed.
• How often backups run, and whether you can download one.

What it means. Control of the hosting account is what lets you:

• take a full backup of the files and database;
• move the site to another host;
• restore it if something breaks.

WordPress’s own Export tool isn’t a substitute. It exports content such as posts, pages, menus and users, not the whole working site (WordPress).

If it’s missing. Ask for either:

• your own login to the hosting account, or
• a complete, recent backup of the files and database, and confirmation of where DNS is managed.

3. Your website login (WordPress Administrator)

In WordPress, the Administrator role has access to all the admin features of a single site. That includes managing users, plugins and themes. An Editor can publish and manage posts, including other people’s. An Author can only publish and manage their own (WordPress).

Where to check. In WordPress, go to Users and find your own account. Its role is shown next to your name.

What to record.

• Your username.
• Your role.
• Every other Administrator account, and who each one belongs to.

What it means. A WordPress Administrator account controls the website software. It does not give you the hosting account or the domain. You can be the Administrator of a site whose hosting and domain are held by someone else.

If it’s missing. Ask for your own named Administrator account. Don’t accept a shared login. Other platforms use different names for these roles, so ask for the level that can manage users and settings.

4. The copy, design, code and images

This is the part that payment alone doesn’t settle.

Where to check. Your contract, proposal or terms. Look for a clause about intellectual property, copyright, “assignment” or a “licence”.

What to record.

• Whether the contract assigns copyright to you, or gives you a licence to use the work.
• Any conditions attached, for example “once paid in full”.
• Which parts the clause covers: copy, design, custom code, images, logo.

Keep a signed or accepted copy of the contract.

What it means.

• An assignment makes the work yours.
• A licence lets you use it on the terms stated, while someone else keeps the copyright.
• No written agreement at all: the creator is usually the first owner. A court may find you have an implied licence to use it, but that’s typically a limited, non-exclusive licence rather than ownership (GOV.UK).

Work you created yourself is yours to begin with. Work your employees created as part of their job normally belongs to your business, unless agreed otherwise (GOV.UK).

If it’s missing. Ask for written confirmation of what you own and what you’re licensed to use. If ownership matters to you, ask for a signed assignment. For anything valuable or disputed, take legal advice.

5. Theme, plugin, builder, font and stock licences

Most websites include things nobody on the project created: a premium theme, a page builder, paid plugins, fonts, stock photos. These are normally licensed, not owned, and the supplier’s terms control them.

Where to check.

• In WordPress, look at Appearance → Themes and Plugins for anything marked as licensed or needing a key.
• Check your invoices, and the handover notes if you had any.

What to record.

• Each paid item.
• Whose account the licence is in.
• Its renewal date.
• Whether updates depend on it.

What it means. A licence held in your designer’s account may stop being renewed, or stop receiving updates, when your working relationship ends. Stock images are normally only covered by the licence under which they were bought.

If it’s missing. Ask for:

• a list of every paid licence and whose account it’s in;
• licences to be moved into your name, or replaced, where the supplier allows it.

6. Google Analytics, Search Console and Business Profile

These three accounts hold your measurement history and your Google Maps listing. Each one has its own permission levels.

Where to check. In each product, open the users or access settings and find your own Google account in the list.

What to record. Your role in each product, and every other owner or administrator.

What it means.

• With a lower role (a Search Console Full or Restricted user, a GA4 Viewer or a Business Profile Manager), you can use the account but can’t remove someone who shouldn’t be there.
• In Search Console, when a verified owner is removed, their verification tokens also need removing, or they can verify again and regain access (Google).

If it’s missing.

• Search Console: ask an existing owner to add you as an owner. If you control the domain’s DNS, you can verify a Domain property yourself with a DNS record (Google).
• GA4: ask for Administrator access at account level.
• Business Profile: ask to be made an owner. If nobody responds, Google has a request-ownership process. The current owner is emailed and has three days to reply, and Google says the option to claim afterwards isn’t always available (Google).

7. The contract and handover terms

The earlier checks tell you what’s true now. The contract tells you what’s supposed to be true.

Where to check. Your accepted proposal, terms and conditions, and any handover email or document.

What to record. What the contract says about:

• copyright in the work;
• third-party licences;
• the domain and hosting;
• administrator access;
• when these take effect (for example, on launch or on full payment).

Note any gaps between the contract and what you found in steps 1–6.

What it means. If the contract and the accounts agree, you’re in a strong position. If they don’t, the contract is the basis for asking for the accounts to be put right.

If it’s missing. Ask for a written handover note that lists every account, whose name it’s in, and the access level you’ve been given.

Access levels, side by side

A private checklist you can copy

Keep this with your business records. Don’t add passwords.

WEBSITE OWNERSHIP CHECK
Date checked: ____

1. DOMAIN
Registrar: ____
Registrant (name on it): ____
Expiry date: ____
Auto-renew on: Y/N
My own login: Y/N
Evidence kept: ____

2. HOSTING
Hosting company: ____
Account holder: ____
Who pays: ____
My own login: Y/N
DNS managed at: ____
Can download a full backup: Y/N

3. WEBSITE LOGIN
Platform: ____
My role: ____
Other Administrators: ____

4. COPYRIGHT
Contract clause: assignment / licence / none
Conditions: ____
Signed copy kept: Y/N

5. LICENCES
Paid theme, builder, plugins, fonts, stock: ____
Held in whose account: ____
Renewal dates: ____

6. GOOGLE ACCOUNTS
Search Console role: ____
GA4 role: ____
Business Profile role: ____
Other owners or admins: ____

7. CONTRACT
Handover note received: Y/N
Gaps compared with steps 1–6: ____

Still missing, and date requested: ____

What to ask for when something is missing

A short, specific written request usually works better than a general “please hand everything over”. Here is an example you can adapt; replace the parts in square brackets with your own details:

Please could you confirm the following in writing by [your deadline]: the registrant of [your domain name] and the registrar account it’s held in; the hosting account holder and how I can download a full backup; that I have my own WordPress Administrator account; which paid licences the site uses and whose accounts they’re in; and our owner or administrator access to Search Console, Google Analytics and our Business Profile. Please don’t send any passwords by email. Adding me as a named user is fine.

Keep a copy of what you sent and when.

What this check can’t settle

These checks show the current position. They don’t decide who is legally entitled to what.

If you and a supplier disagree:

• Nominet’s Dispute Resolution Service requires the complainant to show rights in a name and that the registration is abusive. It offers mediation first, and it doesn’t promise a transfer (Nominet).
• Google’s Business Profile ownership request has no guaranteed outcome.
• For copyright or contract disagreements, take legal advice.

How our website projects handle this

At SEO Agency in Nottingham, once a website project has been paid in full, you own the bespoke website files and content created specifically for you, subject to any third-party rights and licences. Your domain and hosting remain yours where they’re registered in your name, and Administrator access is handed over at launch.

Themes, plugins, fonts, stock assets and software stay under their suppliers’ licences. Premium licences are registered to you or itemised so you can take them over. For Google accounts, we work with manager or user access, never your main Google password.

These terms are written into the project agreement before work starts. The details are on our website design page and in our terms.

We also work on websites we didn’t build, where suitable access can be provided. We assess the site first and agree responsibilities and scope in writing. If your check turns up gaps and you’d like help putting them right, get in touch.

By David, founder of SEO Agency in Nottingham. Published 2 October 2026.