A business pays the monthly bill and can edit the text on its own homepage, so it assumes it owns the website. Then it tries to change providers and finds that the agency holds the registrar account, the only owner-level analytics login, and the mailbox that every password reset goes to. Nothing was stolen. Nobody lied. The question of who controlled what simply never came up, and being able to log in turned out not to be the same as being able to leave.
"Who owns the website?" is too broad to answer yes or no. This page separates it into nine things a business can hold or fail to hold, and gives you a way to check each one.
Four different things people mean by "ownership"
These overlap, and a business can have one without the others. Each of the nine checks below tests one or more of them.
- Legal ownership
- Who holds the rights in something, such as the copyright in custom copy or photographs. A photographer can own the images on your site unless the rights were transferred in writing.
- Account control
- Who can sign in with owner or administrator rights, pay the bill, and recover the account if a password is lost. You may be able to edit every page and still not be able to add or remove a user.
- Licence to use
- Permission to use something you do not own, usually with conditions attached. A premium theme, a font or a stock photograph is typically licensed, and the licence can end.
- Technical portability
- Whether the site or its records can actually be moved somewhere else. Pages may export as text while the design, the integrations and the booking history do not come with them.
Copyright, licences and work made for hire
Four of the nine checks are about accounts, which are a matter of fact: either your name is on them or it is not. This one is about rights, and it is the part most often assumed rather than agreed.
Holding a copy is not holding the copyright. Ownership of a copyright is distinct from ownership of the material object the work is embodied in, and transferring the object does not by itself convey any rights in the work. Having the files, or having the pages live on your site, says nothing on its own about who holds the rights in them.
Copyright ordinarily begins with the author or authors of the work. A work made for hire is an important exception: when the legal requirements are met, the employer or commissioning party is treated as the author and copyright owner. For work created by an independent designer, writer or photographer outside that exception, the creator ordinarily begins as the author and owner of the copyright in the material they created. Whether someone is legally an employee turns on the facts of the working relationship, not on the label either party puts on it.
Paying for work does not by itself transfer copyright ownership. A transfer of copyright ownership generally must be documented in a writing signed by the owner of the rights being conveyed or that owner's authorized agent. A paid invoice is not that document.
"Work made for hire" is a narrow rule, not a phrase that can simply be added to a contract. It applies in two situations. The first is a work prepared by an employee within the scope of their employment. The second is a work specially ordered or commissioned, which qualifies only if all four of these are true: the work falls within one of nine categories listed in the statute, there is a written agreement between the commissioning party and the people who actually created the work, that agreement expressly says the work is to be considered a work made for hire, and every party has signed it. The Copyright Office is explicit that a work failing any one of those requirements is not a work made for hire.
The nine categories are: a contribution to a collective work, a part of a motion picture or other audiovisual work, a translation, a supplementary work, a compilation, an instructional text, a test, answer material for a test, and an atlas. The statutory list does not name "a website" as a category. But a website project can contain different deliverables, and whether a particular deliverable qualifies as a compilation, an audiovisual work, a contribution to a collective work, a supplementary work or another listed category requires a fact-specific legal analysis. The Copyright Office states that it cannot advise on whether a given work qualifies.
Licences and ownership are not the same. An exclusive licence can itself qualify as a transfer of copyright ownership; a nonexclusive licence does not. So a business may hold permission to use material without owning the copyright in it -- and the scope, duration, exclusivity, transferability and termination of that permission all depend on the licence's own terms and on applicable law. The difference matters when you want to redesign, resell or take the work with you, which is why the agreement should say which of these you are getting.
Some project materials may be governed by third-party licences rather than transferred to the business. Themes, fonts, plugins, stock media, open-source components and other pre-existing materials can have different licensees, permitted uses, transfer rules and continuing conditions. Check the actual licence and identify whose account holds it. An agreement that says "you own everything" without listing what everything includes has not addressed this.
What a well-drafted agreement does instead is identify which materials pre-existed the project, which are third-party or licensed, which were made for it, and whether the rights in that custom work are being assigned or licensed, on what conditions, and with what restrictions afterwards.
Legal information, not legal advice: Not legal advice: This describes general U.S. copyright rules so you know which questions to ask. It is not legal advice, and it is not a substitute for having a lawyer look at an agreement that matters to your business.
The nine-part check
Work through each area with your accounts open in another window. Record what you actually find rather than what you expect to find, and print the page if you want to keep a record. Nothing you select here is sent anywhere.
Website Ownership Check
Work through the nine areas and record where your business stands. Nothing you select is sent anywhere, and the summary updates as you go.
-
Area 01. Domain registration
What to verify
- Which registrar holds the domain.
- Whether the business name, rather than an individual's or a provider's, is the registered organisation.
- Whether the business controls the account login and its recovery method.
- Whether the business can see renewal dates and billing.
- Whether the business could unlock the domain and obtain the authorisation code when eligible.
- Whether a provider has delegated access rather than the account password.
Why it matters
The domain is the one asset every other part of the website and the business email depends on.
What counts as proof
A login the business controls, with recovery going to an address the business controls, and the business named as the registered organisation.
Warning sign
Warning sign: Nobody at the business can say which company the domain is registered with.
Next step
Record the registrar, confirm recovery, and ask in writing for owner-level access.
Evidence: Official source
-
Area 02. DNS control
What to verify
- Who can change nameservers and individual records.
- Whether a change requires the current provider to act.
- Whether recovery and multi-factor authentication are under business control.
- An inventory of the records serving the website, email, verification and third-party services.
- Whether any written agreement says who may change nameserver records.
Why it matters
Domain registration and DNS hosting can sit with different companies, so controlling one does not imply controlling the other.
What counts as proof
The business can view the current records and knows who is able to change them.
Warning sign
Warning sign: Record changes can only be requested, never made or reviewed.
Next step
Inventory the records before changing anything, because email usually depends on them.
Evidence: Editorial assessment
-
Area 03. Website platform or hosting account
What to verify
- Who holds the owner or primary-owner role, as that platform defines it.
- Whether the business has administrator access in its own name.
- Who controls billing.
- Whether the provider works through a collaborator or limited account.
- Recovery address and multi-factor authentication.
- For a self-hosted site: host, control panel, application, database, storage and backup access.
Why it matters
Being able to log in and edit text is not the same as holding the role that can grant, revoke or transfer access, and an administrator role inside the website software is not access to the host, the registrar or the database.
What counts as proof
The business appears as the account owner in the platform's own account screen.
Warning sign
Warning sign: One shared login is used by the business and the provider.
Next step
Ask which role each party holds, and request owner-level access in the business's name.
Evidence: Official source
-
Area 04. Website files and portability
What to verify
- Which of three outcomes applies: a full deployable copy, a partial content export, or a transfer that only works within the same platform.
- What an export actually contains, and in what format.
- What would have to be rebuilt elsewhere.
Why it matters
Exporting content is not necessarily the same as exporting the design, integrations, account history, or a ready-to-run website.
What counts as proof
An export performed and opened, not an export button observed.
Warning sign
Warning sign: "You can export everything" with no description of the format.
Next step
Run the export and look at what came out before relying on it.
Evidence: Official source
-
Area 05. Business email
What to verify
- Whether the business controls the email administrator account.
- Whether the DNS records email depends on are accessible.
- An inventory of users and aliases.
- Whether recovery depends on the departing provider.
- What happens to stored mail if the service is cancelled.
Why it matters
Email continuity usually depends on DNS records that a website change can disturb.
What counts as proof
Administrator access in the business's name, with recovery under its control.
Warning sign
Warning sign: Business email exists only inside a provider-owned account.
Next step
Confirm administrator access before any DNS or hosting change is scheduled.
Evidence: Editorial assessment
-
Area 06. Analytics and Search Console
What to verify
- Whether the business holds an administrator role in its analytics account.
- Whether the business is a verified owner of the Search Console property.
- Whether the provider uses its own named account rather than a shared password.
- Whether tag-management, advertising and business-listing accounts are inventoried where they are used.
Why it matters
Measurement history is difficult to reconstruct, and owner and user roles are not equivalent: a Search Console property with no verified owner leaves nobody with access at all.
What counts as proof
The business appears in the account's own user list at the appropriate role.
Warning sign
Warning sign: Reports arrive as screenshots and nobody at the business can open the account.
Next step
Request the appropriate role, and add the provider as an individual user.
Evidence: Official source
-
Area 07. Copy, photography, graphics and design
What to verify
- Which materials were created for this project and which pre-existed it.
- Which materials are third-party, stock, open-source or licensed rather than owned.
- Whether the written agreement assigns rights or grants a licence, and on what payment conditions.
- Whether the agreement is signed by the party giving up the rights.
- Whether source and design files are included.
- Whether any continuing restriction applies.
Why it matters
Paying for a project, possessing its files, and owning or licensing the rights in its different materials are separate questions. Custom work and pre-existing or third-party materials may be governed by different terms.
What counts as proof
A written agreement that identifies the relevant materials and states whether the business receives ownership, an exclusive licence, a nonexclusive licence, or another defined permission, including any payment conditions or continuing restrictions.
Warning sign
Warning sign: "You own everything" with no list of what "everything" includes.
Next step
Identify the materials, then put the ownership and licensing questions to a lawyer where the project warrants it.
Evidence: Official source
This describes general U.S. copyright rules and is educational information, not legal advice. Whether any of it applies to a particular website, contract or working relationship is a question for a lawyer.
-
Area 08. Customer and operational data
What to verify
- Leads and form submissions.
- Appointment and booking records.
- Customer profiles, orders and products.
- Mailing lists and the consent records behind them.
- Where payment-related data lives and what may not be exported.
Why it matters
Operational records are the part of a website a business cannot rebuild from memory, and export coverage differs by record type even inside one platform.
What counts as proof
An export of each record type, opened and checked for completeness.
Warning sign
Warning sign: Enquiries arrive only as forwarded email and exist nowhere else.
Next step
Export each record type now, before any provider change is discussed.
Evidence: Official source
-
Area 09. Cancellation, export and handoff
What to verify
- What the notice period and renewal terms say.
- What stops working on the day service ends.
- Whether the agreement says how domains and accounts transfer, and on what conditions.
- Whether an export is offered at all, in what format, and by when.
- Whether credential handoff and removal of the provider's own access are addressed.
- Whether post-termination assistance is available, and what it costs.
Why it matters
The terms that matter most may become important only when the relationship is ending. What is available then depends on the agreement, the platform's terms, and applicable law -- not simply on what either party considers reasonable.
What counts as proof
A written agreement that clearly addresses each applicable point, together with the relevant platform terms and account records.
Warning sign
Warning sign: There is no written agreement, or it is silent on what happens at the end.
Next step
Ask for the exit terms in writing before signing, not after.
Evidence: Editorial assessment
This is a list of terms to identify and discuss before you sign, not a statement of what your business is entitled to. Nothing here is an opinion on whether any particular agreement is fair, reasonable or enforceable. Whether a provider must offer an export, transfer, continued access, or post-termination assistance depends on the agreement, the platform's terms, and applicable law. Where the answer matters, ask a lawyer.
No areas recorded yet. Your summary will appear here as you answer.
What to do if access is missing
Finding a gap is not an emergency, and it is usually not evidence of bad faith. Work through it in this order.
- Take stock of the facts without confrontation. You are establishing what is true, not building a case.
- Save what you already have: current bills, the agreement, any credentials you are entitled to, screenshots of account screens, and the messages where arrangements were made.
- Ask, in writing, for the owner or administrator access that is appropriate for your business, and for written clarification of anything the agreement leaves open.
- Do not make disruptive changes until you understand what depends on them. Email, account verification and payment integrations often depend on the same records a website change would touch.
- Get technical or legal help where control is genuinely disputed, or where your operations are at risk while it is unresolved.
Caution: Caution: Do not change nameservers or DNS records until you know what depends on them. Business email usually does, and mail that stops arriving is harder to notice than a website that stops loading.
One thing this page will not tell you to do: do not try to access an account by guessing, resetting, or using credentials or recovery methods you are not authorized to use. Doing so can create security, operational, and legal problems and make a resolvable disagreement harder to resolve.