Most small-business owners do not think about who owns the website until something needs to change.

Then the questions start. Who registered the domain? Which company bills for the hosting? Is the Google Business Profile tied to a former employee’s personal Gmail? Can anyone besides the last web designer sign in?

A website can carry your business name and still depend on accounts the business does not control. That rarely means anyone acted dishonestly. Sites begin with practical shortcuts: a friend buys the domain, an employee creates the Google account, a designer opens the hosting plan to get the project moving. The trouble comes later, when that person leaves or changes email addresses.

This checklist covers five groups of accounts. Each ends with a check you can do in a few minutes. The aim is continuity: the business keeps running when any one person or vendor is unavailable.

Ownership is really control

Website ownership is a set of accounts, permissions, contracts and renewal dates. The business controls an account when it can:

  • Sign in with an account the business expects to keep
  • See who else has access, and add or remove them
  • Receive the billing, security and renewal notices
  • Recover access if a phone, a password or an employee is lost
  • Export or move what the account holds

The arrangement that works: the business owns the account, and the specialist is invited into it.

There are fair exceptions. A managed provider, and we are one, may run your site on hosting it operates for many clients. In that case the agreement should say what belongs to you, what you can take with you, and what happens when the relationship ends.

1. The domain name

Your domain is the address people type to reach you, such as yourbusiness.com. Your business email usually depends on it too.

Two terms matter. The registrar is the company where the name is registered, often a different company from the one that hosts the website or runs the email. The registrant is the person or organization the name is registered to. ICANN, which coordinates the rules for names like .com, .net and .org, holds the registrant responsible for the registration.

Find the registrar, then sign in

Enter your domain in ICANN’s lookup tool and note the registrar, the expiration date and the status. Registration records are now served through a system called RDAP, which replaced WHOIS in January 2025, so older “WHOIS lookup” instructions may be out of date.

The registrant’s contact details are often withheld from public view, and a status of clientTransferProhibited is a protective lock against unwanted transfers. Both are normal.

The public record will not tell you whose account the domain sits in. Only signing in at the registrar will. Once you are in, confirm:

  • The registrant is the business or its owner, not a vendor or a former employee
  • The registrant email is an address the business reads
  • Automatic renewal is on and the card on file is current
  • Two-step verification is on, and a second trusted person knows how recovery works
  • Recovery does not depend on the domain itself

The last one is easy to miss. If the only address on the account is owner@yourbusiness.com and the domain stops working, the password-reset emails stop too. Add a backup address or phone number that does not rely on the domain.

Why the registrant email matters

ICANN requires registrars to send at least two renewal reminders, about a month and about a week before a name expires. They go to the registrant’s contact details on file. If that is a former designer’s address, you never see them.

After expiration, the registrar interrupts the domain’s DNS before it deletes the name, so the website and any email on the domain stop working. Registrars may allow a late renewal for a while, and the length of that window is theirs to set. Once a name is deleted, there is a 30-day redemption period in which it can be restored, and the registrar may charge a restore fee, which it has to publish. After that the name is released and anyone can register it.

These rules cover generic endings such as .com, .net and .org. Country endings such as .us follow their own registry’s rules.

If the domain is in someone else’s account

Ask them, in writing and while the relationship is good, to move the domain into an account you control and to make the business the registrant. Ask the registrar how it handles that. Some can move a name between two of their own customer accounts. Others treat it as a transfer.

Two things to know before anyone changes anything:

  • Moving to a different registrar needs an authorization code from the current one. ICANN requires the registrar to provide it within five calendar days of the registrant asking.
  • Under ICANN’s current Transfer Policy, a registrar may refuse a transfer during the first 60 days after a name is registered or transferred. Changing the registrant’s name, organization or email also starts a 60-day transfer lock unless the registrar offers a way to opt out. ICANN’s Board approved revised transfer rules in June 2026, and no effective date had been published when this was written. Ask the registrar which locks apply to you.

If the person holding the domain will not cooperate, ICANN does not settle disputes over who is entitled to a name. That is a question for a lawyer, and nothing in this article is legal advice.

Check: Sign in to the registrar yourself. The right answer is that the business is the registrant, the registrant email is one you read, auto-renew is on with a current card, and you got in without asking anyone for a password. If you could not sign in at all, fix that before anything else on this list.

2. The website platform and hosting

The website may involve two separate relationships: the platform, where pages are created and edited, and the host, where the site runs. An all-in-one website builder combines those jobs. A WordPress or custom site often separates them.

Being able to edit a page does not mean you control the account. A vendor can give you an editor login and keep the only account that manages billing, adds administrators, changes the domain connection or exports the site.

Two questions are worth asking now. Can the business export its content, customer data and images? And what happens to the site files and backups after a cancellation or a missed payment? Hosts set their own rules on both, and the answers are in their terms.

Check: Sign in to the hosting or website-builder account and open the billing page and the user list. The right answer is that you can see the latest invoice and you could add an administrator today. If you only have an editor login, ask whoever holds the account to make the business the account owner, or to put in writing what you can export and how.

A site with poor access is not automatically a site that needs replacing. Our guide to rebuilding or fixing your website covers how to tell the difference.

3. Google Business Profile, Analytics and Search Console

Three Google products commonly become tied to a website. Business Profile controls how a local business appears on Google Search and Maps. Analytics records activity on the website. Search Console shows how Google finds and reads the site. Each has its own list of people and its own idea of an owner, and none should live only inside one agency employee’s Google account.

Google Business Profile

A profile has owners and managers. Both can edit the profile and reply to reviews. Only owners can add or remove people or remove the profile. One owner is the primary owner, and only the primary owner can hand that role to someone else.

Check: Open your profile, select the three-dot menu, then Business Profile settings > People and access. The right answer is that the primary owner is a Google account the business keeps, outside helpers are managers, and nobody on the list has left. If an agency is the primary owner, ask them to add you as an owner and then transfer primary ownership to you. Google limits what a newly added owner or manager can do for the first 7 days, including removing other people, so allow a week for a handover.

If nobody can reach the current owner, Google has a request-access process. The owner is notified by email and, according to Google’s help page, has 3 days to respond. The same process works in reverse. If a request arrives for your profile and you do not recognize it, deny it instead of ignoring it, because an unanswered request can give the requester the option to claim the profile. The primary owner’s inbox has to be one somebody reads.

Google Analytics

Check: In Analytics, open Admin > Account access management. The right answer is that someone at the business holds the Administrator role, the only role that can add and remove people. Editor can change settings without managing users, which is enough for most outside help.

If no administrator can be found, Google has a recovery process. It asks you to prove you control the website by publishing a small text file on it, which is one more reason to settle website access first.

Our guide to giving Superhero access to Google Analytics follows this model: you stay the administrator, we get the Editor role, and you can remove us later. If the reports themselves are new to you, start with Google Analytics 101.

Google Search Console

Search Console separates owners from users. Owners can add and remove people. A Full user can see the data and use the tools without managing anyone, which is what a specialist needs.

Check: In Search Console, open Settings > Users and permissions. The right answer is that the business is listed as a verified owner. When you remove a former owner, also remove the verification token they used, such as a file on the site, a tag or a DNS record. Google notes that a removed owner can verify again while the token is still in place. Our Search Console access guide explains the permission we ask for and why.

Never solve any of these by emailing someone a Google password. Each person gets their own invitation.

4. Business email and account recovery

Business email is the recovery channel for nearly everything above. Password resets for the registrar, the host and most other accounts usually land in it.

If you use Google Workspace: in the Admin console, go to Account > Admin roles, open the Super Admin role and select Admins. Only a super administrator can see this list. Google recommends more than one super administrator, each a separate person with recovery options set up. If a lone administrator is locked out with no recovery phone or email, Google’s recovery process asks for a DNS record to be added at the domain. Control of the domain is the fallback for control of the email.

If you use Microsoft 365: the person who bought the subscription is a Global Administrator by default. In the Microsoft 365 admin center, go to Roles > Role assignments and open Global Administrator to see who holds it. Microsoft’s guidance is to keep that group small, require multifactor authentication, and make sure a second trusted administrator can reset the first one’s password. If an IT provider set the account up, it may hold administrator rights as a Microsoft partner. That is normal. Confirm that someone at the business holds Global Administrator as well.

If email came bundled with your hosting or domain: the hosting or registrar account is the email administrator. Sections 1 and 2 cover it.

Whichever you use, also review mailboxes and forwarding rules that belong to people who have left, whose phone receives sign-in codes for the administrator accounts, and where backup codes are stored. Keep credentials in a password manager that supports shared access, not in a document that gets emailed around. When someone leaves, remove their access. Changing one shared password is not the same thing.

Check: Sign in to the email admin console without help. The right answer is that at least two people at the business can administer email, each with their own account and a current recovery phone. If the only administrator is a former employee or a provider you no longer use, ask them to assign the role to you while they can still sign in.

5. The services connected to the site

The visible pages are only part of the system. Other services receive information from the site or make it useful: contact forms and the email delivery behind them, scheduling, payments, newsletters, call tracking, chat, advertising accounts, social profiles, review platforms, and licensed fonts, photos or plugins. Pay closest attention to anything that holds customer information or collects money.

Check: Do two things. Send a test message through your contact form and see where it lands. Then search the last twelve months of business card statements for recurring web charges. The right answer is that the message reaches an inbox someone reads, and every charge matches a service you can name and sign in to. A charge nobody recognizes usually points to an account nobody at the business can administer. Our guide to traffic without inquiries walks through the form test in more detail.

Build a one-page account record

You do not need a technical manual. One page, kept somewhere secure, with a row for each service:

  1. Service: what is it, and what does it do for the business?
  2. Sign-in: which web address and which account?
  3. Owner: which business account has the highest level of access?
  4. Others: which staff and vendors are invited, and at what level?
  5. Billing: who pays, with which card, and when does it renew?
  6. Recovery: which email, phone or stored codes restore access?
  7. Exit: what would need to be exported or transferred?

Record where the credentials are stored, not the passwords themselves. Date the page. Review it twice a year, and whenever a staff member, vendor, phone number or payment card changes.

What to fix first

If the checks turned up problems, work in this order:

  1. The domain. It is the fallback for email and for most account recovery.
  2. Email administration. Most other password resets run through it.
  3. Renewals with an expired card. These fail on a fixed date.
  4. Everything else, starting with whatever holds customer data or money.

Do not respond by transferring everything at once. Domain, DNS and email changes can interrupt the website or the mail when they are made in the wrong order. Document the current setup, get business-controlled access to each account, and only then plan any move.

Asking a vendor for any of this is not an accusation. A good provider can tell you which accounts are yours, which systems they run on your behalf, and what happens at the end of the relationship. The best time to ask is while everything works.

Need a second set of eyes?

If you are not sure where your site lives or what it runs on, Site Rescue starts with a free look from the outside. Type in your address and it reports what the site runs on, where it is hosted, and whether your email rides on the domain. We do not log in to anything to do that.

If you would rather walk through the checklist with a person, tell us what you found and we will help you sort the ordinary access cleanups from the things that need to move.

Sources and further reading