Who Should Own Your Domain, Hosting and Code?

Short answer: the domain should always be registered in the business's name, in an account opened with the business's own email address. There can be flexibility on hosting and code. Not on the domain.

People usually learn about this when something goes wrong. Some of the businesses that come to us discover during a redesign that the domain they've used for years never actually belonged to them.

Why is a domain registered to the agency a risk?

A domain isn't just your website address. Your company email, business cards, signage, Google Business Profile and every link built up over the years point to it.

Picture this hypothetical case: an accounting firm had its site built by an agency five years ago, and the agency bought the domain in its own account. They part ways and the firm wants to work with someone new. Moving the domain requires a transfer code, and that code sits in the agency's panel. If the agency cooperates, it's done quickly. If not, or if the agency has closed down, the process can be long and tiring.

There's a quieter risk too: renewal. If the domain expires in the agency's account and nobody notices, the site and email can stop on the same day. After a while, the released domain can be registered by someone else.

Two separate things shouldn't be confused here. The first is the registrant, meaning who the domain is officially registered to. The second is the account at the registrar where it's managed. Both should belong to the business. If the agency needs access for technical work, adding them as an authorized user or letting them change DNS through access you grant is enough. Turkish extensions like .com.tr are registered through TRABİS, and there too the holder should be the business.

Hosting and server access

You can be more flexible on hosting. Living on the agency's server is a perfectly reasonable setup, especially bundled with a maintenance plan. Managing updates, backups and security in one place makes life easier.

But put two things in writing. First, have access to backups, or get it in writing that an up-to-date backup will be handed over on request. Second, the contract should state that if you leave, you'll receive a full copy of the site, meaning files and database, within a reasonable time. We cover these clauses in more detail in our post on website contracts.

Source code and licenses

The code side depends on how the site was built and on your contract.

On a site written from scratch for you, you can ask for the rights to use and modify the code to be transferred to you; this needs to be stated clearly in the contract. On projects where an existing platform is adapted to your brand, it can be different: the platform itself may remain with the agency or theme developer, and you get the right to use your site. In Kodyva's ready-made model too, what is handed over to you and the scope of usage rights are set out in the quote and contract. What matters is that the contract leaves no doubt about what's yours.

Some licenses get overlooked. Paid plugins, fonts and stock photos are often used under licenses tied to the agency's account. When you move the site, ask whether those licenses move too. If the photo licenses stayed with the agency, you may not be able to use those images on a new site.

The access vault: what you need to hold

Keep the following in a password manager (Bitwarden, 1Password and the like), or at least somewhere secure, in the business's name:

• Domain registrar account and the domain's expiry date
• DNS management panel (if it's not at the registrar, for example Cloudflare)
• Hosting panel or server access
• An administrator account for the site's admin panel
• Company email management (Google Workspace, Microsoft 365 or hosting email)
• Owner permissions in Google Search Console and Google Analytics
• Primary owner permissions on your Google Business Profile
• Meta Business account and ad accounts

Add the domain's expiry date to your phone calendar with a reminder one month ahead. Turn on auto-renewal, but also check the expiry date of the saved card. An expired card quietly breaks auto-renewal.

If you don't know how many of these accesses you currently hold, one of the quickest jobs this week is asking your agency for them. A good agency won't find the request strange.

This article is for general information only and is not a substitute for legal, financial or tax advice. For your own situation, consult a lawyer or a certified accountant.