Who should own your website, domain, and hosting?

Your business should control its essential digital assets

The domain, primary hosting account, analytics property, and other critical services should normally be registered to the business using a company-controlled email address. A studio or developer can be granted the access needed to build and manage the site without being the only person able to renew, transfer, or recover it.

This separation protects both parties. The business is not trapped if a supplier becomes unavailable, and the supplier does not have to act as the permanent owner of a client's infrastructure. The exact arrangement can vary, but ownership, billing, access, and support responsibilities should never be left to assumption.

Treat each account as a separate asset

• Domain registrar and DNS: control the web address and where traffic is directed.
• Hosting or deployment: control the live site, billing, environment settings, and release access.
• CMS and ecommerce platform: control content, products, users, orders, and configuration.
• Analytics and Search Console: preserve measurement history and search ownership when suppliers change.
• Email, forms, payments, and integrations: connect the website to business operations and may contain sensitive data.
• Code and design files: determine what can be maintained, moved, or extended later.

Create business-owned accounts where practical, then invite named collaborators with appropriate roles. Avoid shared passwords and personal email addresses that cannot be recovered by the company.

Account access and intellectual property are different questions

Possessing a login does not automatically grant rights to all code, fonts, photography, copy, plugins, or design assets. The contract should say what the business owns after payment, what the supplier licenses, and which third-party items remain subject to their own terms and recurring fees.

Ask whether you receive source files, a code repository, content exports, design files, and documentation. If part of the website depends on a studio's proprietary platform or licence, understand what happens if the relationship ends. These details belong in the proposal alongside the scope; the guide to comparing web design proposals provides a broader review framework.

Give access without giving away control

Use individual user accounts, role-based permissions, and multi-factor authentication where the service supports them. Grant the narrowest access that still lets each person do their work. Keep recovery methods and billing contacts with the business, and record who can publish, deploy, change DNS, view customer data, or invite new administrators.

Access should also have an end. When a project or support agreement finishes, remove accounts that are no longer required, rotate shared credentials that cannot be avoided, and confirm that scheduled payments and renewals go to the correct owner. This is ordinary operational hygiene, not a sign of distrust.

Make handover a deliverable, not a favour

Before final payment, use a written inventory of URLs, providers, account owners, administrators, renewal dates, licence terms, repositories, backups, documentation, and support contacts. Confirm that someone inside the business can access each critical service and recover the account without the supplier.

A responsible studio should be comfortable explaining the arrangement before work begins. Ask for it in writing and keep the inventory updated after launch.