Who Owns Your Website?

Short answer first: paying for a website does not, by itself, make you its owner of record. Three separate things have to be in your name — your domain, your hosting, and your login to the site. Most owners hold one or two and have never checked the third.

If one of them turns out to be in your designer’s name, that is common and it is fixable. It usually happens for convenience, not for bad reasons. The point of this article is to hand you a check you can run today, and to tell you what the rules actually say if you have to ask for something back.

What are the three keys?

Think of your website as a shop. There are three separate keys, and they are often held by different people:

• The address — your domain name. The thing people type: yourbusiness.com. It is registered through a registrar such as GoDaddy, Namecheap, Name.com or Cloudflare, and it renews every year or two.
• The building — your hosting. The server your files sit on. Separate from the domain, separate bill, usually a separate company.
• The front desk — your login to the site. The username and password that let you change the words on the page. On WordPress that is the dashboard. On Squarespace or Wix, the same login usually covers both the building and the front desk.

Losing any one of them is a different kind of problem. Lose the front desk and you cannot edit. Lose the building and you cannot move. Lose the address and you cannot do either, because the address is what everyone already knows.

Who actually has the final say over a domain?

The person or business listed as the registrant — not the administrative contact, not whoever pays the invoice. ICANN, the body that sets the rules registrars have to follow, is unambiguous in its Transfer Policy: the Registered Name Holder is “the only party that has the authority to approve or deny a transfer request.”

That same policy puts a clock on it. Where a registrar does not give you a self-service way to generate your own transfer code, it has to hand you the code within five calendar days of your asking. Most registrars now let you generate it yourself in a couple of clicks.

One honest caveat, in ICANN’s own words: “You do not ‘own’ a domain name.” What you hold is closer to a lease from the registry operator, renewed on a schedule. Being the registrant is the strongest position available to you — it is not a deed.

What if your designer registered it in their own name?

ICANN describes this exact situation in its registrant FAQ, and treats it as ordinary rather than sinister. A developer helping you manage a domain may have registered it using their own contact details, even though you paid for it, and so may be listed as the official registrant of record.

The way out is also in that FAQ: you may need to show your registrar proof that you paid the developer, to establish that you are the rightful holder and should be the registrant. Start with a plain, friendly email to whoever built the site. A good designer will be glad to move it across. If that goes nowhere, the registrar is your next call.

Why can’t you just look it up?

Because the public record no longer shows you. Under ICANN’s Registration Data Policy, which took effect on 21 August 2025, registrars must redact personal data in public registration lookups where the law requires it — registrant name, street, phone and email among them — and publish an email address or a web form in their place.

So a public whois search will not answer this question for you. You have to log in. Which is the whole check.

The three-key check — run it today

Ten minutes, no cost, no special access. Start with step zero if you do not know where your domain lives.

• Step zero — find your registrar. Search your email inbox for “domain renewal”. The receipt names the company that holds your domain.
• 1. The address. Log in to that registrar yourself. Open the domain and look at the registrant or owner contact. Is your business name there, or somebody else’s?
• 2. The building. Log in to your hosting account with your own credentials — not a shared password someone sent you once. If the account is in your designer’s name, note it. On Squarespace or Wix this is the same login as the site itself, and that is normal.
• 3. The front desk. Log in to your site. On WordPress, check your user role. Administrator is the one that matters: WordPress defines it as the role with access to all the administration features within a single site. Editor can publish and manage posts, including other people’s — useful, but not the same thing.

What does good look like?

• Your business is the listed registrant on the domain, at a registrar you can log in to.
• The hosting account is in your name, with billing you can see.
• You have your own named login to the site at administrator or owner level — not a shared one, and not a role that stops short.

Two of those are rules with a source behind them. Keeping hosting in your own name and insisting on your own login rather than a shared one is my rule of thumb, not a legal requirement. Plenty of good arrangements break it for a while and come out fine.

What this check does not tell you

Worth saying plainly, because the gap is where people get surprised:

• It is not legal advice. If real money or a dispute is involved, talk to a lawyer, not a web designer.
• It says nothing about the design or the code. Who owns the theme, the photographs and the custom work is a contract question, settled in what you signed, not in these three logins.
• It does not cover email. If your email runs on the same domain, moving the domain badly can interrupt it. Say so before anybody presses a button.

I ran Artifex Web through this

My own domain, my hosting and my code all sit in accounts I own, and I checked rather than assumed. Where a client asks me to hold a domain for convenience — which happens, because it is genuinely easier at the start — it moves into their name whenever they ask, and they do not have to explain why.

Your turn: find one key today. Start with the email search for “domain renewal”, because everything else follows from knowing where the address lives.

Every source below was opened and re-checked on 21 September 2026. ICANN’s pages carry policy effective dates; the WordPress documentation shows a last-modified date. None of this guarantees a particular outcome with any registrar.