You paid for your website. You have the invoices. You probably even have a folder somewhere with the original mockups in it.

None of that means you own it.

Paying for something and owning it are different, and almost nobody explains the difference to a small business owner because the conversation never comes up. Your web guy isn't lying to you. They're just answering the questions you asked, and "is this in my name?" usually isn't one of them.

Here's the honest version. Four things have to be in your name for you to actually own your website. There's a fifth almost nobody counts, and I'll get to it. Most owners I meet have one or two. You can check every one of them this afternoon.

Thing one: the domain

Your domain name is the single most important asset in this whole list. Lose it and you lose your email, your Google rankings, every business card you've ever handed out, and the address every past customer has saved.

Go to lookup.icann.org and type in your domain. You're looking for the registrar (GoDaddy, Namecheap, Cloudflare, Squarespace, whoever) and the registrant. Registrant details are almost always redacted now on the common domain endings, whether or not anyone paid for privacy protection, so a blank name there tells you nothing either way. The real test is whether you can log into the registrar account yourself.

Can you? Right now, without texting anyone? If yes, check the account email on file. If it's your web designer's address, the domain is functionally theirs, no matter whose name is on the paperwork. Password resets go where the email goes.

While you're in the account, confirm auto-renew is on and the card on file hasn't expired. And know that most of the domain renewal notices that arrive by mail are not from your registrar at all.

Thing two: the hosting

Hosting is the server your site lives on. Someone is paying for it every month. Somewhere between five and a hundred dollars, depending on what kind: shared hosting sits at the low end, managed WordPress at the high end. If that spread seems wide, here's what you're actually paying for.

Look at your credit card statement. If you don't see a hosting charge, it's on someone else's card, which means it's in someone else's account. That's not automatically a crisis. A care plan with hosting rolled into one monthly fee is a normal way to sell this. But you should know that's the arrangement, and you should know what happens to your files the month you stop paying.

Ask for the hosting login. If the answer involves a pause, you've learned something.

Thing three: the content and the code

Pull up your original agreement. You're looking for a sentence that transfers copyright of the design and content to you on final payment. Most small business web agreements don't have one.

Without it, the default under copyright law depends on who built the thing. An outside contractor, which is the usual case, owns what they made unless the contract says otherwise. An employee building it as part of their job is a different story: that's a work made for hire and it belongs to you from the start. If it was a freelancer or an agency, assume the first one. What you usually have instead is an implied license to use it. How far that license stretches, including whether a new developer can reuse your page copy, is exactly the thing nobody has written down. That distinction stays invisible for years and then matters enormously the week you want to move. I'm not a lawyer and none of this is legal advice, so if real money is riding on the answer, have someone who is read your agreement.

If your site runs on WordPress, Squarespace, or Shopify, the platform isn't the issue, though what you can take with you when you leave varies a lot by builder. Your text and your photos are the thing to worry about, along with any custom design work.

Thing four: the connected accounts

This is the one that's almost always wrong, and it's the one that actually holds you hostage.

Google Analytics. Google Search Console. Your Google Business Profile. Google Ads or Meta Ads if you run them. Every one of those is a separate account with a separate owner, and every one of them is routinely created under the vendor's personal Google login because it takes eleven seconds instead of a forty-minute back-and-forth with a client who doesn't know their own password.

Check them the same way. Log in as yourself. These click-paths are current as of August 2026, and Google renames things about once a year, so hunt around a little if a label has moved.

In Analytics, go to Admin and look at Account Access Management, where your email should be listed with the Administrator role. Then check Property Access Management in the same menu, because account access and access to the property your site actually reports into are two different things and you can pass the first check and still be locked out of your own numbers.

Search Console works differently. Under Settings, then Users and permissions, you want to be listed as an Owner, but that alone isn't the finish line. Owners come in two kinds: whoever verified the property, and whoever that person handed ownership to. The second kind can be removed by the first. So also open Settings, then Ownership verification, and confirm at least one verification method belongs to you. A DNS TXT record on a domain you control is the durable one, because nobody can take it away without your registrar login.

In your Google Business Profile, check Business Profile settings, then People and Access. There are three levels here, not two: Primary Owner, Owner, and Manager. Only the Primary Owner can hand primary ownership to somebody else, and a plain Owner can't remove them. Seeing "Owner" next to your name is not the win it looks like. If that's what you find, ask for primary ownership to be transferred to you.

Manager sounds fine. It isn't. And Owner isn't always enough either: in Google Business Profile there's a Primary Owner sitting above you, and in Search Console whoever verified the property outranks whoever was handed ownership.

Nobody had to act badly for this to go wrong

Here's what actually happens. A vendor is building your site on a Tuesday afternoon. He needs Analytics running before launch. Asking you to create an account, verify it, and add him as a user takes three days of email. Creating it under his own login takes a minute.

So he does. He means to hand it over later. Later doesn't come, because nothing breaks. And then it's four years later and he's moved to Denver and changed his phone number.

Almost every ownership problem I untangle looks like that. Convenience compounding quietly. It's rarely malice, and framing it that way is why so many owners never ask the question in the first place. They think asking implies an accusation. It doesn't. It's the same as asking your accountant where the tax returns are stored.

What it costs you when it's wrong

People assume the worst case is paying to rebuild the site. The rebuild isn't the expensive part. The standstill is.

Picture changing your phone number. New number goes live Monday. Your website still lists the old one, and so does your Google Business Profile, which is what actually shows up when someone searches your business name from their car. You can't edit either. You email the vendor. No response. You email again.

Two months of every new customer calling a dead line. Nobody can invoice their way out of that. And if the vendor is genuinely gone, you're into recovery work, which is slower and stranger than most people expect.

The fifth thing, which should be on the list

Where do your form submissions land?

If your contact form delivers into an inbox your developer set up, or sits in a form plugin's database only they can log into, that's the same problem wearing different clothes. Except this version costs you customer records instead of a login. Names, phone numbers, and what people said they needed. That's your pipeline, and it's the one thing you can't rebuild from scratch.

The fix is that every submission delivers in real time to an inbox you own. That's how we set it up, and on most sites it's a small change. Worth pairing with a look at what a contact form should actually do for you, since both failures hide in the same blind spot.

How to fix it without picking a fight

You don't need a lawyer or a confrontation. You need a boring email that gives your vendor an easy path to saying yes. Copy this:

Hi [Name],

Doing some housekeeping on our business accounts and getting everything centralized under our own logins. Can you help me with the following?

1. Transfer the domain registration to an account under [your email], or add me as an account admin at the current registrar.
2. Send me the hosting login, or confirm which account it's under.
3. Add [your email] as an Administrator on Google Analytics (both account and property), as an Owner on Search Console, and as Primary Owner on our Google Business Profile.
4. Confirm where our contact form submissions are delivered.

No rush on any of this and nothing's wrong. I just want our records straight. Thanks for everything.

Send it, give it a week, follow up once. A good vendor handles it in an afternoon and thinks nothing of it. A vendor who stalls or gets defensive has told you something useful, and you found out on a calm Tuesday instead of during an emergency.

You should be able to fire me on a Tuesday

Here's where I put my own skin on the table, because I'd rather you hold me to it.

Every Marshland client's domain is registered to them, not to me. Their accounts are in their name. If someone wants to leave, they send a written request and within 5 business days I unlock the domain, hand over the transfer authorization code, and give them full access to their accounts. A complete copy of the live site follows within 10 business days. That holds regardless of what's left on the term or what's still owed on other work. The one honest wrinkle: a domain that was registered or moved between registrars in the last 60 days is locked from being transferred again, which is a registry-level rule neither of us can waive. It never delays your access, and where the registrar allows it, I'll offer an internal account transfer instead so you're not stuck waiting. We publish the whole policy, in writing, before anyone signs anything.

I don't sell a proprietary platform. There's no builder you'd be locked into and no license that expires when the relationship does. That means I get paid to tell people no fairly often, including telling people their current setup is fine and they don't need me. That's the trade. It's also the only version of this business I'd want to run.

Do this today: open a browser you're not already logged into, go to analytics.google.com, and try to sign in with your own business email. Sixty seconds, and it tells you where you stand on the one that's wrong most often. If you'd rather not work through the rest of the checks yourself, send us your domain and we'll run them and send back a plain-English answer on what's in your name and what isn't. No pitch attached.