Who Really Owns Your Website? A Digital Asset Ownership Guide

There's a conversation that repeats itself in early calls with new clients. We ask for domain access to plan a migration, and there's silence on the other end. Then comes the line: “the person who built our site doesn't respond anymore.”

It's not a rare case. It's probably the most expensive and least discussed problem in the relationship between a business and its digital vendors, and at its core it comes down to one simple question: who owns your website? A company can have ten years of traffic, rankings, email, and customers built on infrastructure that, on paper, doesn't belong to them.

This guide is the inventory we use internally at Contra to verify website ownership before touching any project. It works whether you're about to hire someone, you've already lost touch with your previous vendor, or you've simply never checked.

Why does it matter who controls your domain?

A domain does much more than point to your site. Your DNS records hang off it, and those records control where your corporate email goes. Whoever controls the domain controls the email. If that access sits with a third party you're no longer in touch with, your company is one decision away from losing all its communication.

There's an administrative detail that surprises a lot of people: registrars grant a short grace period when a domain expires, generally between 30 and 45 days. After that, the domain is released and anyone can grab it. If renewal notices land in the inbox of a developer who no longer works with you, nobody's going to read them.

The 8 digital keys that should be in your company's name

Go through this list and be honest about which ones you actually control today.

1. The domain registrar. The account where the domain is purchased should be in your company's name, with your email, and your card. If the registrant is listed as your agency or developer, the domain legally belongs to them. This is the master key, and the one most often overlooked.
2. DNS. It can live with the same registrar or a separate service like Cloudflare. You need to know where it is and be able to log in. This is where your site, email, and service verification records live.
3. Hosting or the platform. Whether it's Webflow, WordPress, Vercel, or a traditional server, the plan should be billed to your company. A site hosted inside a vendor's agency account disappears the moment that vendor stops paying.
4. The CMS and its users. Someone on your team needs admin-level access, not editor. If your only access is a limited-permission user, you don't have real control over the content.
5. The code repository. If the project involves custom code, it should live in your company's organization on GitHub, GitLab, or similar, with the vendor invited as a collaborator. The reverse only works as long as the relationship does.
6. Analytics and Search Console. Google Analytics, Search Console, Tag Manager, and any pixels should sit under your organization's properties. Losing this means losing the historical data, which doesn't come back.
7. Design source files. The Figma file with the library, brand assets, high-res photography, and their licenses. A future redesign costs twice as much when it has to be rebuilt from screenshots.
8. Corporate email. Google Workspace or Microsoft 365 billed to your name, with an internal super-admin.

How to verify your website's ownership in 20 minutes

You don't need anyone technical to do the first pass.

Start by looking up your domain on any public WHOIS service. It'll show you the registrar it's purchased through and the expiration date. A lot of the details will be hidden for privacy, and that's fine, but the registrar and the date are public.

With the registrar identified, try recovering the password using your company's email. If the system doesn't recognize any of your addresses, the account belongs to someone else. That's the signal.

Then repeat the exercise for every item on the list: log in, confirm your role is admin, and check which email shows up as the account owner.

One piece of advice almost every registrar gives, and almost nobody follows: the email you use to manage your domain shouldn't be hosted on that same domain. If you lose the domain, you also lose the one way to recover it.

What to ask before signing with any agency or vendor

Four questions, before you even get to the pricing proposal.

1. Whose name will the domain, hosting, and platform accounts be registered under? The correct answer is always “the client's.”
2. What happens to the code and source files when the contract ends? It should be in writing that they get handed over.
3. What does the handoff process look like when the project closes? If there isn't a concrete answer, there probably isn't a process.
4. Can I edit the content without you? Depending on the vendor to change a paragraph is a fine decision if you make it knowingly, and a problem if you find out later.

What does a proper handoff look like?

When we close out a project at Contra, the handoff includes a document listing every service used, which account it lives in, and which email manages it. Everything is transferred to the client's accounts before the final invoice, with credentials shared through a password manager rather than email. If the client wants us to keep managing something, that's an explicit decision on their part, with parallel access on their side.

That boring document is the difference between a vendor and a partner.

What to do if you've already lost access to your domain

1. Check whether the domain is still active. If it's about to expire, that's the real emergency.
2. Contact the person or company in writing, with a specific request and a deadline. Many cases get resolved simply because nobody had asked formally.
3. If there's no response, write directly to the registrar's support team. Registrars have recovery processes for when you can prove the brand and the business are yours, using incorporation documents, renewal invoices paid by your company, or a trademark registration. It takes time, and it works.
4. Weigh Plan B with a clear head. In some cases, migrating to a new domain and redirecting your efforts costs less than a long dispute. It's a business decision, not a matter of pride.

Frequently Asked Questions

What happens if my agency won't respond and I need access to my domain?

Contact them first in writing, with a specific request and a deadline. If there's no response, write directly to the registrar's support team: they can start a recovery process if you can prove the brand and the business are yours.

How do I know if I actually own my domain?

Look up your domain on a public WHOIS service to see the registrar and expiration date. Then try recovering the password for that account using your company email: if the system doesn't recognize it, the account belongs to someone else.

What happens if my domain expires?

Registrars offer a short grace period, generally between 30 and 45 days. After that, the domain is released and anyone can register it.

What should I get in writing before hiring an agency?

That the domain, hosting, and all platform accounts are registered in your company's name, and that the code and source files are formally handed over when the contract ends.

Can I lose my corporate email if I lose my domain?

Yes. Whoever controls the domain's DNS controls where your email goes, so losing the domain can mean losing your entire business communication as well.

The bottom line: your website is an asset, not a borrowed possession

Your digital presence is a company asset, just like a lease or a registered trademark. The difference is nobody ever taught you to check its title.

Half an hour today. That's all it costs to find out whether you actually own what you think you own.

If you're not sure where to start, at Contra we can help you run that audit on a first call, at no cost.

‍