Who actually owns your website

The developer stops answering.

That is usually how it starts. Not a dispute, not an invoice, nothing dramatic. An email goes unanswered, then a second one, and a few weeks later you need something changed on your own website, and there is nobody to ask. You find the login, and that is when you realize how much of your website you don't actually have.

Most owners think of a website as one thing they either own or do not. It is not one thing. It is five: they are held in five different places, and five different people can hold them. I have never once seen a small business hold all five on the first check.

None of that is a scandal. The five get handed out on day one, usually by someone being helpful, and almost nobody writes down who got what.

There is a version of this that is not neglect at all. It is a business model.

An arrangement where somebody else holds your domain, hosting, profile, ad account, and analytics isn't a filing decision. It is leverage, and it works because it never feels like leverage. It feels like being looked after. You do not have to remember a password, the invoices arrive as one line, and somebody else worries about the renewals. That is the golden handcuff, and the gold is the whole trick: it is comfortable right up until the day you want to leave.

Call him the keyholder. Not a company, not anyone you could point at, but an archetype. Every owner who has been through this can describe him, because he is always the same shape.

He is not a villain you would recognize as one. That is the whole trick. He is the best-dressed person in the room, he answers his phone, he is genuinely good at the part of the job you can see. He shakes your hand with one hand. The ring of five keys is in the other, behind his back, and the handshake and the cuff are the same gesture. Nobody signs a contract with a man twirling a mustache. Everybody signs one with him.

And he has a second face, which is worse because it is not even deliberate. Sometimes nobody is holding your accounts on purpose. The tracking has been broken since spring; the form goes to an inbox that forwards to nobody, and the monthly report still arrives looking fine. Lock-in and neglect end in the same place. You cannot leave, and you cannot see.

Industry-wide numbers don't measure this directly, and I can't claim they do.  But surveys do count the conditions that produce the problem.

Small Business Majority, a national nonprofit, ran six surveys of small business owners between October 2022 and April 2024, each with 700 to 1,400 respondents, and published the results in August 2024. About one third of owners have no business website at all, and 41 percent rely on a social media presence instead. A website can't exist without a domain, so it's a basic requirement. However, you can have a website hosted on a domain you don’t own, opening up even more options. This article dives into that broader scenario. The key takeaway? The most essential aspect of ownership often ends up being someone else's responsibility.

Domains are valuable properties often subject to large-scale competition. WIPO handled 6,282 domain name disputes in 2025, a record, up from 6,168 the year before. Those cases are mostly trademark fights rather than client-versus-agency arguments, so don't take them as a measure of what your web developer is doing. Read them as proof that when a domain is worth something, ownership stops being a formality.

The direct evidence I do have is my own, and it is at the end of this piece: two clients who emailed me their credentials, one who did not know he held three accounts, and one whose spare domain has been renewing on somebody's card for six years.

Here they are, in the order they hurt when you lose them.

• The domain. The address itself. A registrar rents it annually using the card on file. Losing this is the worst of the five, because it takes your email with it.
• The hosting. The machine your site sits on. Separate from the domain, almost always a different company, and often bought by whoever built the site rather than by you.
• The Google Business Profile. The listing with your hours, your photos, and your reviews. It's what customers actually see when they search your name, and it is owned by a Google account, not your website.
• The ad account. Where the spending happens. If somebody else's account paid for your ads, your conversion history and your audiences live in their account, not yours.
• The analytics property. The record of everything that has happened on your site. This one has no obvious owner, which is exactly why it is the one most often lost.

Five things. Five owners possible. One website.

Before you look anything up, try to fill this in from memory.

Ownership is not a state you reach and keep. It rots quietly.

A client I have worked with since 2019 called about an outage. We got the site back, and the follow-up conversation was the useful one: to do the work properly I needed the Google Analytics, the Google My Business and the Search Console access, and the owner did not know he had those things, let alone who held them. He had been running a real business on top of three accounts he had never seen.

Six years later, the same business, a different problem. An old .net domain from a previous era was still live, still in use online, still renewing, pointing to something nobody had looked at in years. Nobody had decided to keep it. Nobody had decided to drop it. It simply carried on, on somebody's card.

That is the shape of the failure. Not theft. Not malice. Drift.

In 2018, a client and I got into a long, tense exchange about a bill. He was certain he was being charged twice for the same thing. The sentence that ended it was his: "you're confusing my SEO reporting services with my hosting services."

He was right, and he was also making my point for me. They are different services, bought separately, held separately, cancellable separately. He had been treating them as one line because they arrived on one invoice from one person.

If two services feel like one thing to you, you cannot tell which one you are about to lose.

Do this now, in a browser, alone. It has five questions, and each one has a yes-or-no answer.

• 1. The domain. Go to your registrar and log in with your own credentials, not somebody else's. Can you see the domain listed under an account you control, with a renewal card you own? If you cannot name the registrar, that is a no.
• 2. The hosting. Same test, different company. Can you log in to the host, see your site, and find the billing under your name?
• 3. The Google Business Profile. Search your business name in Google. If the listing shows an "Own this business?" link, you do not own it. If it opens for you when signed in as yourself, you do.
• 4. The ad account. Open the ad platform. Is the account in your business name, with your billing, and can you see spend history from before your current arrangement?
• 5. The analytics property. Open Analytics. Are you an administrator, not just a viewer? Viewer access is not ownership. It is permission somebody else can withdraw.

Count your yeses. If you got five, you are in a small minority and you should write down where each one lives before you forget again.

Now go back to the ledger above and fill in the two columns you left blank. The ones you still cannot fill are your answer.

In this order, because the order matters.

Domain first, always. It carries your email, so it can't take the whole business down. Ask for the transfer in writing, and expect it to take several days by design.

Then the Google Business Profile, because that's what your customers see. A documented ownership request path exists if the current holder doesn't respond.

Then hosting, which is usually the easiest, because most hosts will move an account to a new billing owner without moving the files at all.

Then the ad account and analytics. These are the slowest emotionally because the person who built them often holds them, and handing them over feels like being fired. Ask anyway, and ask for administrator access rather than a copy of the data.

The right tone isn't legal. It is administrative. You are not accusing anyone of anything. You are asking to be listed as the owner of things that describe your business.

And the test for anyone you hire next, including me, is one question asked before you sign anything: when this ends, what do I walk away holding? A consultant who cannot answer that in one sentence is selling you the cuff along with the work.

Here is my answer, so that you can hold me to it. I don't put clients in golden handcuffs. Every account I open in your name, on your card, with you as the administrator and me added as a user, you can remove me in about four clicks without asking me first. If you leave, nothing of yours leaves with me, and there is no handover to negotiate because there was never anything to hand over. That is not generosity. It is the only arrangement I would accept if I were sitting on your side of the table. The whole point of knowing the sequence back to front is that you can hand it over without breaking anything.

The best version of getting this wrong is not a fight. It is a handover that technically happened.

An engagement I ran a few years ago ended with the owner emailing me the site's administrator username and password in plain text, twice. He was being helpful. He wanted me to have what I needed. He created a permanent copy of his credentials in a mailbox neither of us controls, and it still sits there today.

A later client did the same thing with API keys and a server address, sent as bare one-line messages with no context at all.

Neither of those people was careless in any way that matters to their business. They were doing what felt like cooperation. But a credential that travels by email isn't handed over; it is duplicated, and the sender can no longer say who holds it.

Ownership is not a copy of the password. Ownership is being the account that the platform recognizes, with the ability to remove everyone else. If a handover ends with two people holding the same login, nothing has been handed over.

None of those five accounts is the business. The domain is an address, the hosting is a shelf, the profile is a listing, the ad account is a tap, the analytics is a record. All five can be moved, renewed, or taken.

The work cannot. Neither can the customers who ask for you by name. Nobody has ever held that hostage, so taking the keys back is paperwork, not a fight. You are not winning your business back. You are putting it in your own name.

Answer out loud.

Can you log in to your domain registrar right now, by yourself, without asking anyone?

If the answer is no, you do not own your website. You have access to it, which is a different arrangement, and it lasts only as long as the relationship.

That is not a reason to distrust the person who built your site. Most of them are holding these things because nobody ever said out loud who should. It is a reason to write down five names next to five accounts today.

Can my web developer hold my domain? They can, and many do, usually because they bought it for you on day one and nobody has revisited it. It is not sinister. It is only dangerous when the relationship ends, because the domain carries your email as well as your site.

What is the difference between owning the domain and owning the site? The domain is the address. The site is the building. You can own one without the other, and most small businesses do.

Is viewer access to Analytics good enough? No. Viewer access is permission somebody else granted and can withdraw. Ownership is being the administrator who can add and remove everyone, including themselves.

What if the person holding these things will not respond? Each of the five has a documented recovery path that doesn't require their cooperation, and each is slower than simply asking. Ask first, in writing, and start the formal path only when asking stops working.

Do I need a lawyer for this? Almost never. The right tone is administrative, not legal. You are asking to be listed as the owner of accounts that describe your business.

What does this cost? Nothing but the renewals you are already paying. If somebody quotes you a fee to hand over accounts that carry your business name, that is a separate conversation and worth having in writing.

If your ownership is fine and the leads still stopped, something likely changed, because change is inevitable. Working out what, without a change log and without anyone to ask, is the next piece in this series: Nothing changed and the leads stopped (coming soon). If the risk is the platform rather than the person, the next is When a page builder closes down (coming soon): what actually leaves with a vendor when the vendor leaves, and which half of your site you can carry out of the building. If you would prefer someone else run these five checks with you, request a free site analysis, and we will do it on a call.

This is the ownership hub. Two spokes hang off it, and each takes one slice: When a page builder closes down, it's a platform failure, and the skill floor is what you have to learn if nobody is maintaining it. Both are coming. This piece refuses both and keeps the five accounts. It also refuses the question of whether the site should be rebuilt at all; that is, do you really need a new website? It only makes sense to ask once you hold the five accounts. Before any of them, most funnels are a form and a hope, because an owned account nobody watches is the same failure one floor up.

Field notes in this piece are drawn from real client engagements. No client is named, no credential is reproduced, and the two threads containing live secrets are cited internally but never quoted.