The question nobody asks until it matters
Most business owners would say they own their website. They paid for it, their name is on it, and it describes their business. But a website is not one thing. It is a domain name, a hosting account, a pile of code, a content management system, a DNS zone, an analytics property, a Search Console property and usually a Google Business Profile. Each of those has its own login, and each one is registered to somebody.
Often that somebody is the developer who built the site, the nephew who set up the domain in 2015, or a marketing contractor who left two years ago. Nothing goes wrong while everyone gets along. The problem shows up when you want to change developers, when a contractor stops replying, or when a renewal notice goes to an email address nobody checks and the domain quietly expires.
We see this often enough when we take over existing sites that we now check ownership before we start any other work. It takes an afternoon, and it is far easier to sort out while everyone is still on good terms.
The domain name
Start here, because the domain is the one piece you cannot rebuild. Everything else can be recreated if you have to. Your web address cannot.
For a .com.au domain, two things matter. The first is the registrant, which is the legal entity the domain is licensed to. For .com.au that should be your business, identified by your ABN or ACN. If the registrant is your developer's company, then on paper the domain is theirs, whatever you paid. The second is the registrar account, meaning the account at the company you renew through. You can be the registrant and still not have the login for the account that controls renewals and DNS settings.
You can look up the registrant through a public WHOIS search. For the registrar account, you need to know which company it is with and be able to log in yourself, with an email address your business controls.
Hosting and DNS
The hosting account is where the website actually runs. Ask whose name and credit card it is under. A common arrangement is that the developer hosts your site on their own account and bills you for it. That is not wrong in itself, and it can be convenient, but it means you cannot get to your own site without them. If you go with this arrangement, make sure your contract says you can have a full copy of the site and database whenever you ask, and how quickly.
DNS is the set of records that points your domain at your hosting and your email. It may live at the registrar, at the host, or at a third service like Cloudflare. Whoever controls DNS controls where your website and email go. Find out where yours is managed and get your own access to it.
The code
If your site was custom built, there is source code, and it should live in a repository on a service like GitHub, GitLab or Bitbucket. Ask where it is and ask to be added as an owner or admin, not just a viewer. If the answer is that the code only exists on the developer's laptop and the live server, that is worth fixing now.
Who owns the code is a contract question, not a technical one. In Australia, copyright in code generally sits with whoever wrote it unless an agreement says otherwise. Many web development contracts assign the finished work to the client on final payment. Some only grant a licence to use it. Some say nothing at all. Read yours, or ask the developer to confirm in writing what you own. If they used their own framework or reusable components across many clients, a licence for those parts is normal and reasonable, as long as it is clear you can keep using them if you move on.
This is general guidance from people who build websites, not legal advice. If there is real money or a dispute involved, talk to a lawyer.
The CMS and the logins around it
Whatever you edit your content in, whether that is WordPress, Shopify, Craft, Sanity or something else, someone has the top-level admin account. That should be a named person in your business. Developers and contractors should have their own accounts, which you can remove when they finish.
For hosted platforms like Shopify, the store owner account matters more than any staff account. If the store was set up by an agency under their own email, ownership can be transferred, but it needs their cooperation. Plugin and theme licences are the same. Premium plugins on a WordPress site are often registered to the developer's account, and when that lapses the plugin stops getting security updates.
Analytics, Search Console and Google Business Profile
These are easy to overlook because they are not the website itself, but they hold years of history you cannot get back.
Google Analytics properties have an account owner. If that is a former contractor's Gmail address, they can remove you and you lose the data. Search Console works the same way: there are owners and users, and an owner can remove everyone else. Your Google Business Profile, which drives a lot of local enquiries, also has owners and managers, and it is often claimed by whoever set up the website. Tag Manager, Meta Business Manager and any ad accounts belong on the same list.
In each case, you want at least one owner account that belongs to your business, ideally a shared business address such as admin@ rather than one person's inbox, so access survives staff changes too.
The checklist
Here is the order we work through it. You do not need to be technical for most of it. You just need to ask, write the answers down, and keep asking until each answer is "us".
- Domain registrant. Run a WHOIS lookup. Is the registrant your business, with your ABN or ACN?
- Registrar account. Which company is it with, and can someone in your business log in today? Is auto-renew on, and does the renewal email go to an address you read?
- DNS. Where are the records managed, and do you have your own login there?
- Hosting. Whose name and card is the account under? If it is your developer's, does your agreement guarantee a full copy on request?
- Code repository. Where does the code live, and are you an owner or admin?
- Contract. What does it say about who owns the code, the design and the content once you have paid?
- CMS admin. Does a named person in your business hold the top-level account? Do contractors have their own removable logins?
- Plugins and licences. Which paid plugins, themes or services is the site relying on, and whose account are they registered to?
- Analytics, Search Console, Tag Manager. Is your business an owner on each, not just a user?
- Google Business Profile. Is your business the primary owner?
- Password storage. Are all of these stored in a business password manager rather than in someone's head or a group chat?
When you find a gap, fix it politely. Most developers are happy to transfer ownership when asked, and plenty would prefer you held the keys anyway. It is a much harder conversation if you wait until the relationship has broken down.
When the answers are not good
If you work through the list and a few things come back registered to someone you can no longer reach, you are not alone. Some of it can be recovered. Domain registrars have processes for proving you are the rightful registrant. Google has recovery routes for Business Profiles and Search Console. Code can sometimes be pulled from the live server even when the repository is gone. We wrote more about this in what to do when your developer has ghosted you.
It is slower and more stressful than doing it in advance, so if your developer is still responsive, do it now.
Keeping it that way
Ownership drifts. New tools get added, staff come and go, contractors set up accounts in their own names because it was quicker. A check once a year, or whenever someone leaves, keeps it tidy. It is the kind of thing that belongs in an ongoing support and maintenance arrangement, where someone is already looking after renewals, updates and access.
When we build a site, the domain, hosting, repository and Google accounts sit in the client's name from day one, and we hold our own access as a user that can be removed. If you are about to start a new project, it is worth reading our notes on how to choose a web development partner and asking the ownership question before you sign.
If you would like someone to run through this list with you, or help get access back to something you have lost track of, get in touch. It is usually a short job.
