A website is really four separate things, and you can own some while a stranger controls the rest. The domain name, the hosting account, the site files and content, and the logins that tie it all together. People assume that paying the invoice means they own everything. It doesn’t. Ownership comes down to whose name is on each account and who holds the passwords.

Start with the domain, because it’s the one people lose

Your domain name is the most important thing to control, and the one most often registered in someone else’s name. Here’s the part nobody explains: you don’t actually own a domain outright. You rent it from a registrar, year to year, for as long as you keep renewing. That’s normal. The danger isn’t the renting. It’s renting it through someone else’s account, where you have no way to renew it, move it, or prove it’s yours.

If a web designer, a former employee, or a “tech friend” registered the domain under their own login, they control your address, not you. We’ve rebuilt entire websites for clients who parted ways with that person on bad terms and suddenly couldn’t get into their own domain. One business lost access right when a contractor walked off mid-project. Another found out their domain was in a former volunteer’s personal account only after the renewal lapsed and the site went dark. In both cases we got them back online, but it cost time and money that owning the domain from day one would have saved.

The rule is simple: the domain must be registered in your organization’s own registrar account, under an email address your organization controls. Not your designer’s account. Not a personal Gmail that one person owns. Yours.

What “owning it” actually looks like

You own your website when all of these are true:

• The domain is in a registrar account your organization owns, tied to an email you control.
• The hosting account is in your organization’s name, with billing you can see and a login you hold.
• You have administrator access to the site itself, not just an editor login someone can revoke.
• You have a recent backup of the site files and database somewhere you control.
• The DNS settings (the records that point your domain at your site and email) are in an account you can reach.

If a vendor sets any of these up for you, that’s fine. The test is whether you could fire them tomorrow and still walk away with everything intact. If you can’t, you don’t own it yet.

Best practices that keep control in your hands

• Register the domain yourself, or watch it being registered. Use an organization email, not a personal one, as the owner contact.
• Keep the owner email address alive. Domains are recovered through that address. If it’s a former employee’s inbox, you have a problem waiting to happen.
• Turn on auto-renew and a backup payment method. Most lost domains aren’t stolen, they simply expire because one reminder went to the wrong person.
• Hold the top-level logins yourself. Give vendors their own admin accounts you can revoke, rather than handing over the master password.
• Write down where everything lives. One document: registrar, host, DNS, admin logins, and who has access. Store it somewhere your organization controls, like a password manager you own.
• Keep your own backups. Don’t rely solely on a host or a contractor for the only copy of your site.

If you’re not sure who owns yours

Most people only discover the answer at the worst possible moment. You don’t have to wait for that. A quick audit, who holds the domain, the hosting, and the admin logins, tells you exactly where you stand and what to move into your own name. Once it’s yours, it stays yours.