Who should own a business website?
The business should normally control the domain registration and primary accounts for hosting, CMS or store, analytics, Search Console, payments, and business email. The contract should state who owns or licenses copy, photography, design files, themes, plugins, fonts, and custom code after payment. A provider can receive delegated access without becoming the permanent owner of assets the business needs to operate or change vendors.
The business should control the domain
The domain is the address customers use and may also control business email. Register it in a business-controlled account using an address and recovery method that will survive staff or agency changes. Turn on multifactor authentication, keep contact and payment information current, and document renewal.
ICANN’s domain-security guidance describes the risk of domain registration account compromise and control changes. A web provider can manage DNS with delegated access or documented authorization; it generally does not need to be the permanent registrant.
- Business legal entity or authorized owner is the registrant where applicable.
- Recovery email and phone are controlled by the business.
- At least two authorized people know where the account is documented.
- Multifactor authentication and registrar lock are enabled when available.
- DNS records are documented before changes.
- Renewal and payment alerts reach the business.
“Owning the website” is several separate questions
| Asset | What to document |
|---|---|
| Copy and original media | Who created it, whether rights transfer, releases, stock licenses, and source-file delivery |
| Design files | Whether editable source files are included or only the implemented site |
| Code | Ownership or license of custom code, access to repositories, third-party components, and reuse rights |
| Theme, plugins, apps, fonts | License owner, renewal payer, transferability, and what stops after cancellation |
| Content and customer data | Export format, privacy responsibility, retention, backups, and deletion |
| Accounts | Primary owner, administrators, billing, recovery, and offboarding process |
Open-source software does not automatically make every design asset, premium component, or custom implementation freely transferable. Put the answer in the agreement.
Which accounts should the business control?
- Domain registrar and DNS/CDN
- Hosting, website builder, CMS, ecommerce, and payment processor
- Business email and transactional email
- Google Business Profile, Search Console, Analytics, tag manager, and advertising
- Social profiles, review platforms, booking, CRM, forms, and newsletter tools
- Repositories, backups, asset libraries, stock media, fonts, themes, plugins, and apps
Control does not mean the owner performs technical work. It means the business can authorize access, see billing, recover the account, remove former users, and continue operating during a vendor transition.
Hosting ownership vs managed hosting
A provider-managed account can be practical when the provider supplies maintenance, security, backups, and support. Ask whether the site can be migrated, who owns the account and server configuration, how backups are exported, how quickly DNS can change, what licenses depend on the provider, and what fees apply at exit.
For WordPress, ongoing updates and backups are operational requirements. WordPress documentation advises backing up before updates and keeping core, themes, and plugins current. A hosting label alone does not define who performs that work.
Put ownership and cancellation in the contract
- Transfer of deliverables after final payment
- Third-party and open-source licenses
- Domain and account ownership
- Administrator and repository access
- Backup, export, retention, and deletion
- Renewal fees and price-change terms
- Minimum term, cancellation notice, and early termination
- Transition assistance, hourly rate, and delivery deadline
- Outstanding invoices and the limits of any service suspension
This guide is practical buyer education, not legal advice. Material agreements may justify review by qualified counsel.
What if the agency currently owns the domain?
Do not make abrupt DNS changes without documenting the site and email configuration. Ask the provider to identify the registrar, registrant, expiry date, domain lock, nameservers, DNS records, and transfer procedure. Create the business-controlled registrar account, preserve records, coordinate authorization codes and locks, and verify website and email after transfer.
Website handoff checklist
- Domain, DNS, hosting, CMS/store, email, analytics, Search Console, and payment access tested.
- Current administrator list reviewed and former users removed.
- Code/repository, database, uploads, configuration, and restorable backup delivered where applicable.
- Copy, media, brand, design, and license rights documented.
- Theme, plugin, app, font, and integration renewal owners identified.
- Form destinations, DNS records, scheduled jobs, APIs, and environment settings documented securely.
- Maintenance, support, warranty, and emergency contacts confirmed.
- Transition and cancellation obligations completed in writing.
Use this checklist when comparing a monthly website offer in the Cedar City cost guide.
Sources and evidence
- ICANN — protecting domain registration accountspublic listing
Accessed 2026-08-21. Supports: Registrant account control and domain-hijacking risk. Used for general domain-account control guidance.
- WordPress documentation — updating WordPressofficial website
Accessed 2026-08-21. Supports: Backup-before-update guidance; Core update responsibilities.
- WordPress documentation — plugin and theme auto-updatesofficial website
Accessed 2026-08-21. Supports: Plugin and theme updates; Rollback and backup considerations.
- Shopify Help Center — domainsofficial website
Accessed 2026-08-21. Supports: Domain connection and management documentation. Official documentation; automated access was restricted during the August 22, 2026 link check, so retain pending human verification.