Who Should Own Your Website Domain and Hosting Accounts? A Plain Guide for Small Businesses

Your business should be the registered owner of its domain. It should also hold top-level access to the hosting, DNS, website admin, Google Business Profile, Search Console and Analytics. A web designer or developer can run all of those for you, but as an added user with a defined role, not as the only account holder. Day-to-day management can be handed off. Ownership should not be.

The difficulty is that, while everything works, a business that owns its accounts and one that doesn't look exactly the same. The difference only shows when a designer retires, a working relationship ends, or a renewal notice goes to an inbox nobody reads.

The accounts that make up control of your website

Control of a website is spread across several accounts, often held with different companies. This is the inventory to check, along with what goes wrong if you lose access to each one.

• Domain registrar. This is where the domain (yourbusiness.co.uk) is registered and renewed. The registrant is the name and contact email on the registration, and it determines who legally controls the domain. Lose this and you can lose the address that your customers, Google listing, emails and printed vans all point to.
• DNS. These records tell the internet where your website and your email live. They are often managed at the registrar, and sometimes at Cloudflare or the host. Without access, you cannot move hosts or fix email delivery. In careless hands, one wrong change takes the site or email offline.
• Hosting. This is the server or platform the website runs on. Without access, you cannot retrieve the site files or backups if you want to move.
• Website admin (CMS). This is the WordPress dashboard or equivalent. Without it, you cannot edit content or add another developer.
• Email. This could be Microsoft 365, Google Workspace or your host's mailboxes. Losing it means losing more than mail, because this inbox is usually the recovery address for every other account on this list.
• Google Business Profile. This is your Maps listing and reviews. If someone else holds ownership, they control how you appear in local search.
• Google Search Console. This shows how Google indexes your site and what searches it appears for. You need it to diagnose problems and handle any site move.
• Google Analytics. This holds your visitor history. Years of data are hard to get back if the property sits in someone else's account.

The domain matters most because everything else hangs off it. A website can be rebuilt and hosting can be replaced. Your email addresses, the link on your Google Business Profile and every printed reference to your web address all depend on keeping the same domain.

Owning versus delegating: two setups that look identical

As an example, take two hypothetical plumbers whose websites were both set up by the same freelance designer.

In the first setup, the domain is registered to the plumbing business, with the owner's business email as the registrant contact. The designer manages DNS and renewals through access the business has granted. In Google Business Profile, Search Console and Analytics, the plumber is the owner and the designer is an added user.

In the second setup, the designer registered the domain in their own name, using their personal email. They pay for it as part of a hosting bundle. The Google Business Profile was created from the designer's Google account.

Day to day, both plumbers see a working website and pay the same monthly invoice. The difference appears if the designer stops replying, closes down or falls out with the client. The first plumber adds a new developer and carries on. The second has to persuade the designer, or the registrar, that the domain should be theirs. Meanwhile, renewal reminders and transfer authorisations go to an inbox they cannot read. Even a well-meaning designer becomes a single point of failure.

So it is not a problem that your designer handles everything. It is a problem if they are the only one who can.

Paying the invoice does not settle the question either. If the registrant contact email is an address the business doesn't receive, control is weaker than the paperwork suggests. The same applies if the business inbox used for account recovery is shared loosely with former staff.

How to check who owns yours

Most of this takes about fifteen minutes and needs no technical help.

1. Look up the domain. For a .uk domain, the Nominet WHOIS lookup shows the registrar and renewal date. It usually hides the registrant's name and email for privacy, so it tells you which company to contact rather than who the owner is. Most .com lookups are redacted in a similar way.
2. Look for the registrar account or invoices. If you have never had a renewal invoice or reminder from that registrar, someone else holds the account. If you can log in, check the registrant name and contact email. The registrant should be the business, or you if you are a sole trader. The email should be one you actually receive.
3. Ask the registrar if you can't log in. The registrar can usually confirm whether you are the registrant once you have proved who you are. For .uk domains, Nominet can also help a registrant confirm their details.
4. Check Google Business Profile. Open the profile's settings and go to People and access. Your own Google account should be listed as Primary owner or Owner, not just Manager.
5. Check Search Console and Analytics. In Search Console, go to Settings, then Users and permissions, and you should be listed as an Owner. In Google Analytics, open Admin and then Access management, and you should be an Administrator at account level.
6. Check hosting and the website admin. Try logging in, and check whether the hosting account is in the business name. In WordPress, the Users screen should show at least one Administrator account that belongs to you, not a shared login.

Write down what you find, including which email address each account uses. That list becomes your plan for fixing anything that is wrong.

How to take back control without breaking email

Order matters here. Most problems come from moving things before anyone has recorded how they are set up.

1. Sort out the recovery email first. Choose an address the business controls and will keep, such as admin@ or accounts@, on a mailbox more than one person can reach. Avoid one employee's personal inbox. If that address is on the same domain, keep auto-renewal switched on. If the domain lapses, the email you would use to recover it stops working too. Some businesses add a second recovery address elsewhere for this reason.
2. Ask to become the registrant. Changing the registrant is not the same as moving registrar. The domain can stay exactly where it is, with the same DNS, while the registered owner changes to your business. Nothing technical changes, so the website and email keep working. Some registrars charge a small fee or ask both parties to confirm.
3. Ask for owner-level access everywhere else. Request that you be made owner or administrator on the hosting account, Google Business Profile, Search Console, Analytics and the website admin. The designer can keep their own user. All of these platforms support multiple users with roles, so nobody needs to share passwords.
4. Record DNS before anything moves. Before any change of registrar, nameservers or hosting, export or screenshot every DNS record. That includes the A or CNAME records for the website, the MX records for email, and TXT records such as SPF, DKIM and verification entries. If DNS moves to a new provider and the MX or TXT records are not recreated, email stops arriving or starts landing in spam.
5. Only then move registrar or hosting, if you want to. Moving a .com usually needs an authorisation (EPP) code. The registrar gives this to the account holder or sends it to the registrant contact email, which is another reason that email must be yours. A .uk domain moves when the current registrar changes its IPS tag to the new registrar. If the move involves new hosting as well, the risks to rankings and enquiries are covered in how to migrate a WordPress website without losing SEO or enquiries.

The request to your current provider can be short and friendly. For example: “We're tidying up our business records. Could the domain be registered in the company name, and could we be added as owner on Google Business Profile, Search Console and Analytics? Please keep your own access so you can carry on managing things as you do now.” Framed as housekeeping rather than distrust, this is a normal request that most providers will handle without fuss. If a provider refuses, or the domain becomes disputed, that is a matter for proper legal advice rather than a technical fix.

If you'd rather not deal with any of it

Not every business wants to manage logins, and handing everything to a developer or agency is reasonable. A minimum should still stay with you:

• the business is the domain registrant, with a contact email you receive;
• you are an owner on Google Business Profile, Search Console and Analytics, even if you never log in;
• credentials, and the email address each account uses, are written down and stored somewhere you control;
• the site files and backups can be handed over on request.

Hosting is the one area where not owning the account can be fine. Many agencies host clients on a reseller or agency account, and you cannot own a server account shared with other clients. That is acceptable as long as the domain is yours and the files and backups are retrievable. Some platforms allow a cleaner split. For example, an Astro site on Cloudflare can sit in a Cloudflare account owned by the business, with the developer added as a member. Ownership and management are then separate from day one.

Solid Digital's ongoing website management works on that basis, from £999 per month. The accounts are run properly, and ownership stays with the client throughout.

A quick test

If your developer disappeared tomorrow, could you log in to the domain registrar and your Google Business Profile? And does the domain renewal reminder come to an inbox you read? If the answer to any of these is no, fix that first, starting with the registrant and its contact email.