Who owns your website? Five things to check before you pay

Try this before you read on: log in to the account that pays for your domain name. If you can't, or you can't say whose account it is, you don't own your website yet, whatever the invoice says. If the site is still being built and the answer is "we look after that for you", you've learnt what you needed to know.

A website isn't one thing you own. It's five accounts and a stack of licences glued together, and a builder can leave any of them in their own name without anyone noticing until the day you want to leave. The five checks below take an afternoon, and each one says what a bad answer looks like.

What are the five checks?

Five checks cover the pieces a builder can keep: the domain and its email, the hosting, the code and admin, the analytics and ad accounts, and the images, fonts and words.

1. The domain and the email on it

Log in to the registrar account that holds the domain, using your own login, and read three things: the registrant name, the expiry date and the email address that receives renewal and transfer notices. The registrant should be your licensed company, in the name on your trade licence, and the account and email should be yours. A public domain lookup shows the registrar and the expiry date, but owner details are often hidden, so the registrar login is the proof that counts.

A bad answer is "we look after the domain for you", a registrant that's the designer's name, or renewal emails going to a personal inbox. Check the email too: if your business mailboxes sit on the web host's account, leaving the host takes your email with it.

2. The hosting, and who can restore a backup

Find out whose name and card are on the hosting account, whether you can log in to its control panel, and where the backups live. On Shopify and Webflow the equivalent question is whose account created the store or workspace. Push back on a reseller account under the agency's name, or a promise that "backups are handled" when you can't download one. Ask for the account in your company's name with the builder added as a user, or a written promise of a downloadable backup every month.

3. The code, the admin and the licences

Check that you hold an administrator login rather than an editor one, that the site runs on a standard platform such as WordPress, Shopify or Webflow instead of a system only the agency can host, and whose name every theme and plugin licence is in. Some hosted builders let you export content but not the working site, so ask before the build what leaves with you. The WordPress, Shopify and Webflow comparison shows how that differs.

The warning signs are "a proprietary CMS", "licences are included" with no keys listed, and a contract with no clause on who owns custom code. Ask for a written assignment of the custom work on payment of the final invoice, the source code in a repository you own, and a list of licences with their renewal dates. This isn't legal advice, so have a lawyer read the clause.

4. The analytics, search and ad accounts

Check that your company's login is an owner or administrator on the Google Analytics 4 property, the Search Console property, the Tag Manager container, the Meta business account and the Google Business Profile. In Search Console, being a listed user isn't enough: you want to be a verified owner. The red flag is a property under the agency's Google account with you as a viewer. At Magnetic Keys, ad accounts, pages and files stay in the client's name.

Form submissions belong on the same list, because they're personal data and someone has to know which inbox and CRM receive them. The UAE government portal names Federal Decree-Law No. 45 of 2021 as the federal personal data law, covered in the PDPL entry, and Morgan Lewis reported on 15 June 2026 that its implementing regulations still hadn't been issued, so ask a lawyer what applies to you. This isn't legal advice.

The WhatsApp Business number belongs on the list too. Ask whose name the number or SIM is registered in with the operator, because a number registered to a former employee or to the agency can be hard to take back.

5. The images, fonts and words

Ask who took each photograph and under what licence, whose account holds the stock licences, which fonts the site uses and who bought them, and who owns the Arabic and English copy. Stock and font licences are normally granted to whoever bought them, so they may not move with the site unless they were bought in your name.

Be wary of "the designer has the originals" with no promise to hand them over. Ask for the source files, the Arabic and English copy as editable documents, and the licence list.

How do you stop a lockout before it happens?

Tie the final payment to a handover test. On the day of the last invoice, log in to each of the five from a laptop the builder has never touched, and list anything you can't open with a date by which it will be fixed. Pay the final instalment when the list is empty, and write the list into the contract as a schedule. The post on agency contracts covers the other clauses worth arguing over.

What does a lockout look like?

Take a made-up trading company in Sharjah. Its 2021 website was built by a freelancer who registered the domain in their own name and bought hosting on their own card, to keep things simple. When the freelancer moves abroad and stops replying, the renewal notice goes to his inbox, the domain lapses over a weekend, and the website and the company's email go dark together.

The company still has its licence and its customers, and no way to prove the domain was ever theirs. Every piece was set up for convenience and none of it was written down, so nobody did anything dishonest and the company still lost its site.

What if you're already locked out?

1. 01Find the registrar with a public domain lookup, and the host from your paid invoices or the site's records.
2. 02Write to the builder asking for logins or a transfer authorisation, with a date. Keep it in writing.
3. 03Ask the registrar and the host what proof of ownership they accept from a company, such as your trade licence, and send it.
4. 04Save everything you can still see: the page text, the images, the form data and the Arabic copy.
5. 05If the builder won't answer, take legal advice before doing anything else.

Do the first check today and log in to your registrar. If you can't, the other four are academic until you can. When you're choosing a builder, add these five to the questions in how to choose a web design company, and ask every web design agency, us included, to answer them in writing before you sign.