Your developer just gave notice. Or your agency relationship is ending. Or maybe you just realized you have no idea who actually owns your website, domain, and all the accounts that make your business run.
Now what?
Quick Take: Most business owners discover too late that they don’t legally own their website, domain, or critical services—because everything was set up in their developer’s or agency’s accounts “for convenience.” Taking back control is possible, but it requires a systematic approach.
Why it matters: 36% of businesses that lose access to their developer or agency experience critical disruption. The average cost of emergency recovery is €25,000-€75,000 in lost productivity, emergency hiring, and ransomware-style demands from former developers.
Before you start: Run the 5-minute vendor dependency assessment to see exactly what you don’t control. Then use this checklist to take it back.
Why This Happens (And Why It’s Not Malicious)
Here’s the typical story:
You hired a developer or agency to build your website. They set everything up in their accounts because it was faster. You were focused on launching, not ownership paperwork. They sent you occasional invoices. Everything worked.
Fast forward 2 years: you’re paying the bills, but you don’t own the accounts.
This isn’t a scam. It’s how most web projects start. Developers think “I’ll transfer it later” and forget. Agencies think “client doesn’t need admin access.” Nobody means harm.
But when relationships end—voluntarily or not—you discover the problem.
The Real-World Case: Designer Disappeared
A web designer stopped responding during a family emergency. The client discovered they had zero access: no hosting login, no FTP credentials, no WordPress access, no email account passwords. The website became frozen in time—no updates possible until they worked with the hosting provider to recover access. (Source: Passion for Business)
This isn’t rare. It’s common enough that AWS has official recovery procedures for when the admin leaves with the only access.
The Complete Transfer Checklist
Transfer these in order. Each step is independent—if something goes wrong, you can pause and fix it before continuing.
Step 1: Domain Name (MOST CRITICAL)
Why first: Without domain control, nothing else matters. Your domain points to your website, email, everything.
What to do:
- Verify current ownership: Run a WHOIS lookup on your domain (use who.is or any WHOIS tool)
- Check the registrant contact: Should be your business name/email, not your developer’s
- If it’s in your name: Get the registrar account login credentials from your developer
- If it’s in their name: Request a domain transfer
Domain transfer steps:
- Unlock the domain at current registrar
- Get the authorization/EPP code
- Initiate transfer at new registrar (or transfer ownership within same registrar)
- Verify transfer via email confirmation
- Wait 5-7 days for transfer to complete (ICANN rule)
Red flags:
- Developer says “it’s complicated” (it’s not)
- Developer demands payment to release domain (this is your domain if you paid for it)
- WHOIS shows “privacy protection” and you can’t verify owner
Schedule this carefully: Domain transfers can cause 1-2 hours of DNS propagation. Do it during low-traffic hours (like Sunday 2am).
Step 2: Hosting Account
Why second: You need somewhere for your website to live. With domain control, you can point it anywhere.
What to do:
- Identify your hosting provider: Check your email for hosting invoices, or use DNS lookup tools
- Determine account ownership: Who gets the bills? Who has admin access?
- If you’re paying but don’t have access: Contact hosting provider with proof of payment
- If developer is paying: Either transfer billing to your account, or migrate to new hosting
Two paths:
Path A: Transfer existing account (easier)
- Request admin access from developer
- Update billing information to your credit card
- Change admin email to your email
- Reset password
- Add your developer as secondary user (if relationship continuing)
Path B: Migrate to new hosting (more control)
- Sign up for new hosting account (in your business name)
- Have old/new developer migrate files and database
- Update DNS to point to new hosting
- Test thoroughly before canceling old hosting
What you need access to:
- Hosting control panel (cPanel, Plesk, custom dashboard)
- FTP/SFTP credentials
- Database access credentials
- Email account management
- SSL certificate management
Step 3: Code Repository (GitHub/GitLab/Bitbucket)
Why third: Your source code is your intellectual property. You need it for future changes, even if relationship with current developer ends.
What to do:
- Find your repository: Ask developer where code is hosted
- Verify ownership: Should be in your organization account, not developer’s personal account
- Request owner/admin access: You should be the organization owner
If code is in developer’s personal account:
Option A: Transfer repository
- Developer transfers repo to organization you create/own
- You become organization owner
- Developer stays as collaborator (if continuing relationship)
Option B: Fork the repository
- Create your own organization account
- Developer forks/transfers code to your account
- You own the copy going forward
Critical: Ensure you have:
- Organization owner role (not just member/admin)
- Access to all private repositories
- Access to deployment keys and secrets (separately managed)
Code ownership reality check: If your contract doesn’t explicitly state you own the code, default copyright belongs to whoever wrote it. Get written confirmation of code ownership transfer.
Step 4: DNS Management
Why fourth: DNS controls where your domain points. Often separate from domain registrar.
What to do:
- Identify DNS provider: Often same as domain registrar, but sometimes Cloudflare, Route53, or other
- Get login credentials: Need admin access to DNS management
- Document current DNS records: Take screenshots of all records before changing anything
- Test changes carefully: Wrong DNS = broken website/email
Common DNS providers:
- Same as domain registrar (GoDaddy, Namecheap, etc.)
- Cloudflare (most common third-party)
- AWS Route53
- Google Cloud DNS
What DNS controls:
- Where website points (A/CNAME records)
- Where email delivers (MX records)
- Email authentication (SPF, DKIM, DMARC)
- Subdomains
- Third-party services
Step 5: Email Accounts
Why fifth: Can’t run business without email. Often tied to domain/hosting.
What to do:
Identify email provider: Domain-based email ([email protected]) lives somewhere
Common setups:
- Hosted with website (cPanel email, Plesk)
- Google Workspace (G Suite)
- Microsoft 365
- Standalone provider (Fastmail, ProtonMail, etc.)
Get admin access: Need to manage users, passwords, forwarding
If in developer’s account: Transfer to your own Google Workspace/Microsoft 365 organization
Don’t forget:
- Email forwarding rules
- Autoresponders
- Aliases
- Mailing list subscriptions
Step 6: Analytics & Tracking (Google Analytics, etc.)
Why sixth: Your traffic data, conversion tracking, and business intelligence.
What to do:
List all tracking tools:
- Google Analytics
- Google Search Console
- Facebook Pixel
- Other tracking platforms
Request owner/admin access: Should be on organization account you own, not developer’s personal account
Verify tracking codes still work: After transfer, check that data still flows
Real-world case: An agency claimed they owned the client’s Google Analytics account—even after the client had paid all bills and fulfilled the contract. The client lost years of traffic data. (Source: IMPACT)
Solution: Create accounts in your business name from day one, add developer as user.
Step 7: Third-Party Services & Integrations
Why seventh: All the services that make your site work—payment processors, email marketing, CDN, etc.
What to identify:
Make a list: What services are integrated with your website?
- Payment processors (Stripe, PayPal, Square)
- Email marketing (Mailchimp, ConvertKit, etc.)
- CDN (Cloudflare, AWS CloudFront)
- Backup services
- Monitoring services
- Chat widgets
- CRM integrations
For each service:
- Who owns the account?
- Who has admin access?
- Who’s paying for it?
Transfer admin access: Get credentials, verify you can log in, reset passwords
Step 8: SSL Certificates
Why eighth: HTTPS encryption, required for modern websites.
What to do:
Determine SSL provider:
- Included with hosting (most common—Let’s Encrypt auto-renewal)
- Purchased separately (Namecheap, DigiCert, etc.)
- Through Cloudflare
Verify auto-renewal: Most SSL certificates renew automatically through hosting
If purchased separately: Transfer certificate management to your account
Usually handled automatically: If you have hosting control and domain control, SSL typically “just works” through Let’s Encrypt. Only worry about this if using custom/purchased certificates.
The Transfer Timeline
Week 1: Information Gathering
- Run WHOIS on domain
- Request access to all accounts
- Document current setup
- Create password manager
- Complete vendor dependency assessment
Week 2: Critical Assets
- Transfer domain ownership/access
- Transfer hosting account access
- Verify website still works
Week 3: Code & Data
- Transfer code repository access
- Transfer DNS management
- Verify backups exist and are accessible
Week 4: Supporting Services
- Transfer email account management
- Transfer analytics/tracking access
- Transfer third-party service access
- Document everything in centralized location
Ongoing: Verification
- Test logging into every account
- Change all passwords (don’t use developer’s old passwords)
- Set up 2FA where available
- Schedule quarterly access audits
How to Have “The Conversation”
If your relationship is ending badly, skip to the “Uncooperative Developer” section below.
If your developer is reasonable, here’s the email template:
Subject: Website Ownership Transfer - Action Needed
Hi [Developer],
As we’re [wrapping up the project / transitioning to new arrangement / preparing for handoff], I need to ensure I have full administrative access to all accounts related to our website and infrastructure.
This isn’t about trust—it’s standard business continuity planning. I need to ensure the business can operate regardless of who’s managing technical aspects.
Could you provide admin access or help me transfer ownership for:
- Domain registrar account
- Hosting control panel
- Code repository (GitHub/GitLab)
- DNS management (if separate from domain)
- Email accounts management
- Google Analytics / Search Console
- Any other services you set up in your accounts
I’ve created a shared password manager for us to document credentials securely. I’d like to complete this transfer by [date, 2 weeks from now].
Let me know what information you need from me to make these transfers happen.
Thanks, [Your Name]
Professional, clear, not accusatory. Most developers will comply immediately.
When Your Developer Won’t Cooperate
Sometimes they won’t respond. Sometimes they’ll demand money. Sometimes they’ll claim they “own” things you paid for.
For domains:
- Contact registrar directly with proof of payment
- Provide business registration documents
- Explain situation (registrars see this constantly)
- Request password reset or ownership transfer
- If domain is in developer’s personal name and they won’t transfer: consider domain dispute resolution (ICANN UDRP process), but this is expensive and slow
For hosting where you’re paying:
- Contact hosting provider with payment proof
- Request password reset based on billing ownership
- Most providers will help—this is common
For code repositories in developer’s personal account:
- If you have a copy of the code (from hosting), create new repository
- If you don’t have code: may need to hire new developer to rebuild or reverse-engineer
- Check your contract—if it specifies code ownership, consult lawyer
For services in developer’s personal accounts:
- Create new accounts in your business name
- Migrate data where possible
- Accept that some historical data may be lost
- This is why ownership setup matters from day one
The nuclear option: Hire a new developer to:
- Migrate website to completely new hosting
- Register new accounts for everything
- Rebuild from whatever you can access
- Yes, this is expensive (€5,000-€15,000+)
- Yes, this is why prevention matters
Prevention: How to Set This Up Correctly From Day One
When hiring a new developer or agency:
All accounts in your business name:
- You create domain account, give dev access
- You create hosting account, give dev access
- You create GitHub organization, add dev as member
- You create Google Analytics, add dev as user
Developer/agency gets admin/collaborator access, not ownership
Contract specifies:
- You own all code
- You own all accounts
- Developer agrees to transfer everything upon request
- No “ransom” clauses
Quarterly access audits:
- Verify you can log into everything
- Update passwords
- Remove access for departed contractors
Use the assessment:
- Run vendor dependency assessment quarterly
- Fix gaps before they become emergencies
What Good Ownership Looks Like
After transfer, you should have:
✅ Password manager with credentials for every account ✅ Admin/owner access (not just “user” access) to all services ✅ Billing in your name (your credit card, your email) ✅ Documentation of what each account controls ✅ Quarterly verification schedule to ensure access still works ✅ Developer has appropriate level access (admin/collaborator, not owner)
You should be able to answer “yes” to:
- Can I log into domain registrar right now?
- Can I access hosting control panel?
- Can I access code repository?
- Could I hire a new developer tomorrow and give them access?
- If my current developer got hit by a bus, would my business survive?
If any answer is “no,” you still have ownership gaps.
The Bottom Line
Taking back control isn’t about distrust. It’s about business continuity.
Developers get sick. Agencies go out of business. Relationships end. People win the lottery, have family emergencies, or yes, get hit by buses.
Your business needs to survive regardless of who’s managing the technical infrastructure.
Start here: Run the 5-minute vendor dependency assessment to identify exactly what you don’t control. You’ll get a prioritized action plan for taking back ownership—before it becomes an emergency.
Because the best time to fix this was when you set everything up. The second-best time is right now.