Hiring
Who actually owns your website — a checklist you can verify today
You own your website only if the domain is registered to you, the hosting account is in your name, the code is in a repository you control, and the payment and analytics accounts are yours. If any of those sit with a supplier, you are renting, and the rent is negotiable at their discretion.
The ten assets, and how to check each one
| Asset | How to verify | If it is wrong |
|---|---|---|
| Domain | WHOIS lookup — registrant should be your business | Request a transfer with the auth code. This is the most urgent one |
| Hosting | Can you log in to the control panel yourself? | Ask for account transfer, or migrate to your own account |
| DNS | Who controls the nameservers? | Move DNS to a registrar or provider you control |
| Source code | Is there a repository, and are you an owner of it? | Request a full export, including the deploy configuration |
| Database | Can you take a backup right now? | Request a dump and store it somewhere you control |
| Payment provider | Is the account in your business name with your bank details? | This must be yours. There is no acceptable alternative |
| Is the mailbox on your domain, under your control? | Move to your own tenant before changing suppliers | |
| Analytics | Are you the account owner, or a guest on theirs? | Create your own property; historical data usually cannot be moved |
| Search Console | Are you a verified owner? | Verify yourself via DNS, which nobody can remove but you |
| Content and images | Do you have licences for the photography used? | Get licence documentation, or replace the assets |
Why suppliers hold these, and what is legitimate
Sometimes it is deliberate lock-in. More often it is convenience: it was faster to register the domain on the developer’s existing account during a busy launch week, and nobody revisited it.
Managed hosting sold as a service is legitimate — provided the account is in your name and you can leave. The test is simple: could you move to another supplier next month without asking permission? If the answer is no, that is lock-in regardless of intent.
What a real handover contains
- Every credential, transferred in writing through a secure channel
- A written document describing where the site is hosted, how it deploys, and what depends on what
- Repository access, with the deployment process documented rather than folklore
- A database backup and instructions to restore it
- A licence list for fonts, images and any commercial plugins
- A named contact for the thirty days after handover
This should be a line item in the quote, not a favour requested at the end. A supplier who charges for handover documentation is being transparent; one who cannot produce it did not build the site the way they described.
If the relationship has already broken down
- Domain first. It is the asset that everything else depends on, and a transfer takes days rather than minutes
- Take a full backup of the live site immediately, by whatever access you still have
- Verify Search Console ownership by DNS record — that route cannot be revoked by a former supplier
- Change payment provider credentials and remove any user accounts you do not recognise
- Rebuilding is sometimes cheaper than recovering. Get an honest assessment before spending months in a dispute
Questions people ask about this
- My developer registered my domain. Is that a problem?
- It is if the registrant is them rather than you. Check WHOIS. A domain registered to a supplier is the single most common way businesses lose control of their website, and it is recoverable now and painful later.
- Do I own the code my developer wrote?
- Only if your contract says so. Without an assignment clause, copyright in commissioned software often stays with the author by default in many jurisdictions. Get it in writing before work starts — it costs one sentence.
- What if my developer disappears?
- Recover the domain first, then hosting, then take backups. If the code is not in a repository you control, budget for a rebuild — and treat that as the lesson for the next engagement rather than the failure of this one.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan — fifteen live client sites, six of them stores taking real payments. The examples in these guides come from those builds and from the audit that rebuilt this site, not from a content brief. More about how I work, or read the case studies.