Who owns my website? How to check and get it back
Your domain, hosting, code and Google accounts can each sit in a different person's name. Here's how to check who holds each part with free tools, and how to get back anything your developer still controls.
We do this for clients every week.
"Who owns my website?" has a legal answer and a practical one. Legally, the domain belongs to whoever is recorded as its registrant, the hosting account to whoever holds it, and the design and code to whoever made them, unless a signed document assigns them to you. Practically, you own your website only if you can log in, renew and move each part without asking anyone.
Most owners find out where they stand on a bad day, when the developer stops replying or a renewal lapses. The checks below use free public tools and your own logins.
What does owning a website actually mean?
A website is six separate things, and each can sit with a different person. Here is who holds each part when nothing is agreed in writing:
| Part | Who holds it by default | What you should have |
|---|---|---|
| Domain name | The registrant on record, whoever paid | Your business as registrant, in an account you log in to |
| DNS settings | Whoever holds that login | Your own login |
| Hosting and files | The hosting account holder | Your own account, or a full backup and a written right to move |
| Design, code and copy | Whoever created them | A signed copyright assignment |
| Photos | The photographer, unless you commissioned and paid for them | The original, full-size files |
| Google, Meta and payment accounts | Whoever opened them | Your business's own accounts, with others added as users |
How do you check who owns your domain?
Start with the domain, because your website and usually your email depend on it. A free lookup needs no login:
- For .in and .co.in addresses, use the .IN Registry's WHOIS. It shows the registrar, expiry date and the registrant's organisation, while hiding personal details. If the organisation line shows your developer's company, the domain is registered to them.
- For .com and most other endings, use ICANN Lookup (lookup.icann.org). It shows the registrar, expiry date and name servers, but often hides the owner's details.
A lookup is a clue, not proof. The real test is whether you can log in to the registrar's account yourself, see your business as registrant with an email you read, and reach the page that gives the transfer code (also called the EPP or auth code). If the developer bought the domain through their own reseller account, your name may be on the record while the login and renewal emails stay with them.
The .IN Registry says KYC is mandatory for .in registrants, and registrars ask for documents that match the registrant details, so a .in domain in your developer's name is verified against their ID, not your business's. For .com, the renewal reminders ICANN requires go to the registrant, so if that is your old developer's inbox, nobody at your business sees them.
Who controls your email and Google accounts?
Whoever controls your domain's DNS settings controls more than the website. DNS records decide where your email is delivered, and Google treats them as proof of ownership: a Search Console Domain property can only be verified with a DNS record. The name servers in your lookup show where DNS is managed: usually the registrar, the host or Cloudflare.
That makes DNS your way back into accounts someone else set up:
- Business email on Google Workspace. Google's recovery help lets a user on your domain ask to be made super administrator by adding a DNS record; Google contacts the existing administrators first and promotes you if they don't respond.
- Search Console. Once you are a verified owner, remove old owners and their verification tokens, because Google warns that a removed owner can re-verify while an old token is still in place.
- Google Business Profile. If someone else owns it, use Request access; if the owner doesn't respond within 3 days, you may get the option to claim it.
To add a designer later without sharing your password, follow the steps in the guide to meeting a web designer.
Do you own the design, code and photos you paid for?
Not automatically. Under Section 17 of the Copyright Act, 1957, the author of a work is its first owner, and the employer exception covers your own staff, not an outside agency or freelancer. Section 19 adds that an assignment counts only in writing, signed by the owner. The guide to choosing a web design company explains what that clause should say.
One exception surprises people: photographs, paintings, portraits, engravings and films made for payment at your request belong to you unless agreed otherwise. So a Masjid Bunder dry-fruit trader owns the product shoot they paid for, but not the logo, layout or code, which aren't on that list.
Some parts are only ever licensed: premium themes, plugins and paid fonts (often bought on the developer's account), stock photos, and open-source software such as WordPress or Laravel, whose own licences let you use and change it. Ask for a list of every licence and the account it sits in. It is fair for an agency to keep the building blocks it reuses across projects, as long as you get a permanent licence to use and change them.
Is it a problem if your web designer hosts the site?
Not by itself. Plenty of studios host the sites they build, including us (we offer website hosting and care), so allow for that bias. What matters is whether you could leave tomorrow: a recent full backup of files and database saved somewhere you control, your own administrator login, and a written promise to hand over access, files and the database if you move.
The database holds your enquiries, orders and customer accounts, and Section 8 of the Digital Personal Data Protection Act, 2023 keeps your business responsible for personal data an agency processes for it, "irrespective of any agreement to the contrary". The main duties apply from May 2027, so ask your CA or lawyer what your hosting agreement should say.
Then check the accounts around the site:
- Meta: your Facebook Page, Instagram, ad account and WhatsApp Business account in a business portfolio you fully control, with the agency as a partner
- Payments: the Razorpay or other gateway account opened on your business's KYC, with you as Owner
- SMS: for OTPs or order updates, the DLT registration, sender header and templates in your business's name, since TRAI's rules make the sender register as the Principal Entity
What if your developer won't hand things over?
Most handover problems aren't malice, and a calm, specific request solves many. Work through these steps in order:
- Send one written list by email: the registrar login or transfer code, hosting access or a full backup, an administrator login, and owner access to your Google and Meta accounts. If a bill is genuinely unpaid, settle or dispute it in writing, and keep GST invoices and UPI or bank receipts together.
- Use the rules that protect registrants. For .com and similar endings, ICANN's Transfer Policy makes the registrant the only party who can approve a transfer, and the registrar must give the registrant the transfer code within five calendar days of asking if there's no self-service option. If you are the registrant but the account is your developer's, contact the registrar with your business documents.
- If the developer is the registrant, they must first agree to change it to your business. Under the current policy, that change can lock the domain against moving registrars for 60 days unless you opt out beforehand, though the website and email keep working. ICANN adopted changes to these locks in June 2026 that aren't in force yet, so ask your registrar.
- If the domain carries your brand and they refuse, the formal routes are ICANN's UDRP for .com and the .IN Registry's INDRP for .in. Both are legal proceedings, so speak to a lawyer first.
Watch the expiry date throughout, because a domain that lapses during a standoff takes the website and email down together. If the code can't be recovered, you can still rebuild at the same address.
Checklist: what your business should hold today
- Your business as domain registrant, in a registrar account you log in to, with auto-renew on
- Where DNS is managed, and who can change it
- A recent full backup saved where you control it, plus a written right to move hosts
- Your own administrator login, plus code repository access for a custom-built site
- A signed copyright assignment and a list of licences
- Owner on Search Console, Administrator on Google Analytics, primary owner of your Business Profile and super administrator of your business email
- Full control of your Meta business portfolio, Owner of your payment gateway and your own DLT registration
FAQs
What happens if my domain renewal is missed?
For .com and other generic endings, ICANN's rules make the registrar take an expired domain offline while it can still be renewed, so the website and email stop. Once deleted, it enters a 30-day redemption period in which only the previous registrant can restore it, for a fee. After that, anyone can register it. For .in, ask your registrar about the .IN Registry's timetable.
Should the domain be in my name or my business's name?
Use whoever legally owns the business. A sole proprietorship isn't a separate legal person, so the registrant is you, with your trade name as the organisation. A company or LLP should be the registrant itself, with a director or partner as contact. Also add a contact email that doesn't depend on the domain, such as a Gmail ID, so renewal notices still reach you if your business email stops.
Who owns the logo a designer made for me?
Unless you have a signed assignment, the designer or their agency does. A logo isn't on the Copyright Act's list of commissioned works that belong to the client by default. Ask for a written assignment plus the original files (AI, SVG or CDR, not just a PNG). Registering it as a trademark is a separate step, best done with a trademark attorney.
Can my developer take my website offline if we fall out?
If they control the hosting or domain, they can technically switch it off; whether they may depends on your agreement and any unpaid bills. With the domain in your name and a recent full backup, a switch-off becomes a problem a new host can fix rather than a lost website. For a genuine dispute, take legal advice before acting.
If you'd like a second pair of eyes, send us your website address. For sites we didn't build, our hosting work starts with a read-only check of the domain, DNS, hosting, admin accounts and backups, and after a short call we'll tell you what sits in whose name. You're welcome to run this checklist on us too.
Written by
