Who Owns Your Business Website? Domain, Hosting & Access Checklist

Payment is not the same as control

Many small-business owners say they own their website because they paid for it. Payment is important, but practical control depends on something more specific: who controls the accounts, recovery methods, billing, data, licenses, and files that keep the website online.

A website can look completely normal while the domain is registered to a former employee, the hosting is billed to an agency, the contact form sends leads through a vendor account, and the business has no independent backup. Those issues often remain invisible until a renewal fails, a relationship ends, an administrator leaves, or an urgent change is required.

Website ownership should be documented before there is a problem. Use this checklist to understand what the business controls and what still depends on someone else.

Start with the domain name

The domain is the public address customers use to reach the website and often the foundation for business email. The business should know:

• Which registrar manages the domain
• Who is listed as the account owner or registrant
• Which email address receives renewal and security notices
• When the registration expires
• Whether automatic renewal is enabled
• Which payment method is used
• Whether multifactor authentication is enabled
• Who can unlock or transfer the domain

Confirm the registrant of record

ICANN explains that a domain registrant has responsibilities related to accurate contact information, renewal, and the registration agreement. When a designer, employee, or reseller creates the registration, the business should still understand who is the registrant of record and how the domain can be recovered or transferred.

Do not rely on a vendor’s verbal assurance that the business owns the domain. Log in to the registrar account, confirm the business-controlled recovery details, and record the account in an ownership inventory.

Confirm control of DNS

Domain Name System settings connect the domain to the website, business email, verification services, and other systems. A person with DNS access may be able to redirect the website or interrupt email.

Record where DNS is managed and who can change it. Before removing a vendor or migrating a site, export or document the current DNS records. Changing nameservers without understanding the existing records can disconnect email, subdomains, verification records, or other services even when the new website itself is working.

Identify the hosting or website-builder owner

The hosting or website-builder account controls where the site runs. Confirm:

• The account owner and primary administrator
• The business email used for recovery
• The subscription level and renewal date
• What happens if a payment fails
• Whether the site can be exported or transferred
• Which features stop working if the subscription changes
• Whether backups are included
• How a backup would be restored

Review content management access

The content management system is where pages, posts, menus, users, and often plugins are managed. The business should have at least one administrator account that is not dependent on a vendor’s personal email.

Use named accounts for each person rather than sharing one administrator password. Give people only the access needed for their role. Remove inactive users promptly, especially former employees, contractors, and test accounts.

The NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide recommends identifying the assets and services a business relies on, documenting who administers them, requiring multifactor authentication where available, limiting privileges, and removing access when it is no longer needed.

Trace the accounts connected to customer leads

A website form may depend on several systems:

• 1. The form tool collects the submission
• 1. An email service sends a notification
• 1. A mailbox receives the message
• 1. An integration sends the record to a CRM
• 1. An automation assigns follow-up work

Follow a test lead through every step

The website owner should know who owns each account and what happens if one subscription expires. Submit a test lead and follow it through every step. Our website form testing guide provides a repeatable process.

Also review booking, chat, newsletter, payment, financing, job application, and download tools. A tool may be embedded on the website while its data and billing are controlled somewhere else.

Confirm analytics and search ownership

The business should control its Google Analytics property, Google Search Console property, tag-management account, advertising pixels, and other measurement systems.

Vendors can be invited with the access they need. They should not be the only account owners. If the relationship ends, the business should retain historical data, verification, and the ability to remove access.

Review which domains, properties, data streams, conversion events, and users are connected. Old agency accounts and test properties can make reporting confusing and create unnecessary access.

Clarify ownership of creative and technical assets

Ask who owns or licenses:

• Website copy
• Original photography and video
• Stock images and fonts
• Logo and design files
• Themes, templates, and plugins
• Custom code
• AI-generated images and text
• Data exports and reports

Payment does not answer every licensing question

Payment does not automatically answer every licensing or ownership question. The written agreement should explain what the business receives, which licenses remain with the vendor, and whether recurring subscriptions are required to keep using an asset.

If AI-generated assets are used, retain the final approved versions and record which platform created them. Review the platform terms and avoid assuming that every generated asset has the same usage rights or exclusivity.

Understand backups and recovery

Ask where backups are stored, what they contain, how often they run, how long they are retained, and who can restore them. A backup stored only inside the same account as the live website may not address every account-loss or platform problem.

The business should have a written recovery path that includes:

• The person authorized to request a restore
• The location of backups
• The last successful backup
• The last restore test
• The acceptable recovery time
• Contact information for technical help

Create a one-page website ownership inventory

Your inventory does not need to contain passwords. Store passwords in an approved password manager. The inventory should identify:

• System or service name
• Business purpose
• Website address or login location
• Business owner
• Technical administrator
• Recovery email and phone
• Renewal date and payment owner
• Multifactor authentication status
• Data handled by the system
• Exit, export, or recovery procedure

Require a complete vendor handoff

At the end of a project or relationship, request:

• Administrator access
• Domain and DNS confirmation
• Hosting and billing details
• List of plugins, apps, themes, and licenses
• Source files and approved content
• Form and integration map
• Analytics and search access
• Backup and restore instructions
• Maintenance schedule
• Known issues and open work

Include ownership terms in the original agreement

Do not wait until the final day of a relationship to discover that the business lacks access. Include ownership, handoff, and transfer requirements in the original proposal and agreement. Use our website proposal evaluation guide before signing.

A website should remain operable when people change

The practical test of ownership is continuity. If a provider, employee, or platform changes, can the business still keep the domain renewed, email working, website online, leads flowing, and records available?

AI website builders can speed up production, but they do not remove the need for account governance. The business still needs documented control and a person responsible for reviewing it.

Use the AI-built website launch checklist to review the rest of the site. For help organizing website ownership, handoff, and operating responsibilities, explore our services, review pricing, or contact David.

Download the Website Risk & Readiness Guide

A practical 48-point audit and 30-day action plan for small business website owners. Use it to review ownership, access, forms, accessibility, search foundations, security, and maintenance in one place.

Download: Website Risk & Readiness Guide

A practical 48-point audit and 30-day action plan for small business website owners.
Link: https://horizons-cdn.hostinger.com/15896364-5217-4716-a57a-279a9b330285/3398e087583706ab5c44f2192d840e0e.pdf