Website Ownership: Who Owns Your Website, Domain and Logins When You Hire a Developer

TL;DR: When you hire a web designer or developer, website ownership is really four things: the domain registration, the hosting account, the code and content, and the admin and analytics logins. Each has its own owner. Copyright in an outside developer's custom code stays with them until a signed writing transfers it, so put every answer in the contract.

Who owns my website? Owners often ask about website ownership for the first time on the day something needs to change and nobody can log in. The honest answer is that "the website" is several separate things, and paying the invoice settles fewer of them than most people assume.

I see this question arrive late more often than early. A business hires someone it trusts, the site launches, and years later the person who set it up has moved on, with the domain, the analytics and the admin password still attached to their personal email. None of that requires bad intent. It is what happens when website ownership is never written down.

Who owns my website if I hire a web designer?

Website ownership is split, and the contract decides most of it. The photos and text you created are yours. The domain is controlled by whoever is named as the registrant. The custom code and design belong to the developer by default under U.S. copyright law, unless a signed document says otherwise.

What are the four parts of website ownership?

1. The domain registration. The name your customers type and your email runs on, registered in the business's legal name, with a business email address you control as the contact, at a registrar account the business holds.
2. The hosting account, or a written exit from it. If you pay a host directly, the account should be in the business's name. If a studio hosts the site as a managed service, you will not hold the server account, and website ownership does not require it. What you need instead is a written right to a full copy of your content, data and code.
3. The code and the content. The words, images and records are yours. The custom code and design need a written assignment or a written license that says exactly what you may do with them.
4. The admin logins and analytics. The owner-level account in the site's content system, plus your analytics, your search console and your business listing, each tied to an account the business controls.

Our knowledge base explains who owns the website and the login when you hire a studio, and why a host login alone is not website ownership. This guide goes further into website ownership in the contract, the domain and the fix.

Why doesn't paying for the website make you the owner of the code?

Because website ownership of the code follows copyright, and copyright starts with the author, and the author is ordinarily the person who wrote the work. The U.S. Copyright Office says copyright protection "exists automatically from the moment the original work of authorship is fixed." (U.S. Copyright Office, Circular 1, Copyright Basics) The Supreme Court put it plainly in 1989: "As a general rule, the author is the party who actually creates the work." (Community for Creative Non-Violence v. Reid, 490 U.S. 730)

The exception is a "work made for hire," and the Copyright Office describes only two ways to get one. Either an employee creates the work as part of their regular duties, or a commissioned work falls into one of nine listed categories and "the parties expressly agree in a written instrument signed by them." (U.S. Copyright Office, Circular 30, Works Made for Hire) The nine are things like a contribution to a collective work, a translation, a compilation, a test and an atlas. A website or an application usually does not fit any of them.

So when an outside designer, agency or freelancer writes your site, a "work for hire" sentence in the contract may not do what it appears to. What moves website ownership of the code is an assignment, and federal law sets the bar: a transfer of copyright ownership is not valid unless it is in writing and signed by the owner of the rights or their authorized agent. (17 U.S.C. 204(a))

Three related points on website ownership:

• Your name and slogan are not copyright at all. The Copyright Office lists "titles, names, short phrases, and slogans" among the things copyright does not protect. Those fall under trademark, a separate question for your attorney.
• Third-party parts are licensed, not owned. A theme, a plugin, a stock photo or an open source library comes with its own license, and nobody can assign you what they only license. For open source parts, Brian explains when GPL software triggers obligations (opens in a new tab).
• A license can be the right answer. Some developers reuse their own tools across clients. A clear license that lets you use, change and move the site can serve you as well as an assignment, as long as it is written down.

This is general information, not legal advice. Have a lawyer read the website ownership clause before you sign.

What should a contract say about website ownership?

A good contract names each of the four parts of website ownership, says who owns each, and says how you get everything back when the work ends. I would look for:

• A written assignment to your business of the copyright in the custom code, design and content, effective on payment, or a written license that states what you may do with them.
• A list of third-party components (themes, plugins, fonts, stock images) and their licenses.
• The domain registered in the business's legal name, with a business email address as the contact.
• Delivery of the source code into a repository your business can access, with its history.
• An export of your content and data in a standard format, at any time, not only at the end.
• Who can make changes to the live site after launch, and how access is granted and removed.
• A written handover when the engagement ends, with nothing held back.

The Federal Trade Commission's small business guidance suggests asking a web host, "After the website is set up, who will be able to make changes to it?" and "If you can log in to make changes, is multi-factor authentication available?" (FTC, Cybersecurity for Small Business) Ask them of any developer too, because both questions are about website ownership. I wrote about the exit terms that decide what leaving costs (opens in a new tab).

What rights does ICANN give you as the domain registrant?

ICANN's policies protect the registrant, which it calls the Registered Name Holder. That is why, for website ownership, the name on the registration matters more than whose card paid for it.

ICANN's page on registrant rights and responsibilities says you are entitled to accurate information about your registrar and its processes, and that you "will assume sole responsibility for the registration and use of your domain name." It also says you must keep your contact information accurate and "respond to inquiries from your Registrar within fifteen (15) days." (ICANN, Registrants' Benefits and Responsibilities)

Two policies make the contact email especially important to website ownership:

• Renewal reminders go to the registrant. Under ICANN's Expired Registration Recovery Policy, registrars must notify the Registered Name Holder at least twice before a domain expires, approximately one month and one week ahead, and send another notice within five days after it expires. (ICANN, Expired Registration Recovery Policy) If the contact is a developer's old inbox, those reminders go to someone who has stopped reading it.
• The transfer code belongs to the registrant. ICANN's Transfer Policy requires registrars that do not offer self-service tools to give the Registered Name Holder the transfer code, called the AuthInfo code, and remove the transfer lock within five calendar days of the holder's request. (ICANN, Transfer Policy)

How do you check who your domain is registered to today?

This website ownership check takes about ten minutes.

1. Look it up publicly. Since January 28, 2025, ICANN has treated the Registration Data Access Protocol (RDAP), not WHOIS, as the definitive source for registration data, and it points people to its ICANN Lookup tool. (ICANN, January 2025) Note the registrar, the dates, the status and the name servers.
2. Expect the owner's name to be hidden. Under ICANN's Registration Data Policy, in effect since August 21, 2025, registrars must redact personal data such as the registrant's name and street address where the law requires it, and the registrar may hide the registrant organization unless the registrant agrees to publish it. (ICANN, Registration Data Policy) A public lookup often tells you where the domain is held, not who holds it.
3. Log in at the registrar. This is the real check. Sign in to the registrar account and read the registrant contact: the name, the organization and the email. If no one at the business can sign in, that is your website ownership finding, and it is a useful one.
4. See who runs your DNS. The name servers show which company answers for your domain, which is sometimes different from the registrar. A free DNS lookup tool (opens in a new tab) shows the name servers and mail records in one place.
5. Put the expiration date on a calendar. Turn on auto-renew with a payment method the business controls.

How do you check the admin logins and analytics?

The accounts around a website are where website ownership quietly drifts. Each service has a top role, and website ownership means the business holds it.

• Analytics. In Google Analytics, the Administrator role is "Full control of Analytics" and can add and remove users. (Google Analytics Help, access management) Make sure an account your business controls holds it.
• Search console. Google Search Console separates verified owners from delegated owners and users. Removing someone is not only a click: "As long as a user's verification token remains for a property, a deleted owner can re-verify ownership." (Google Search Console Help, owners and permissions) When someone leaves, remove their token from the site as well as their name from the list.
• Business listing. "A Business Profile can have multiple owners but only one primary owner." (Google Business Profile Help, owners and managers) The primary owner should be the business.
• The site itself. The business should hold an owner-level account, or have a written answer about who does.

Then protect those accounts. CISA says "users who enable MFA are significantly less likely to get hacked." (CISA, More than a Password) Keep the credentials in a password manager or vault the business owns, not a spreadsheet or someone's personal browser. I wrote about website ownership on an ongoing engagement in who owns the site, the host and the login on a retainer (opens in a new tab).

How do you fix it calmly if your developer holds the accounts?

Most of the time a website ownership problem is housekeeping, not a dispute. A developer registered the domain under their account because it was faster at launch, and nobody revisited it. Treat it that way.

1. Make the list first. Domain, registrar, DNS, hosting, code repository, site admin, analytics, search console, business listing, email. For each, write who holds it today.
2. Ask in writing, kindly. A short note that you are putting website ownership in the business's name, with the list attached. People respond to a clear list far better than to an accusation.
3. Move the domain in the right order. The simplest path is for the current holder to change the registrant to your business, or to move the domain into a registrar account your business opens. Know one rule before you start: ICANN's registrant FAQ says "You cannot transfer a domain name to a different registrar within 60 days of making changes to the registrant name," and registrars may, but do not have to, offer an opt-out. If you also plan to change registrars, the FAQ suggests you "may want to consider completing the transfer process before changing your contact information." (ICANN, FAQs for Registrants: Transferring Your Domain Name)
4. Add before you remove. For analytics, search console and the business listing, add the business's account at the top role first, confirm it works, then make it the primary owner, then remove the old access.
5. Put the code in writing. An assignment or license does not have to be signed at the start of a project to be useful; one can be prepared now. Have your attorney draft it so it covers website ownership of what was actually built.
6. Change the passwords and turn on MFA once website ownership of every account is in the business's hands.
7. Know the backstop. If you are the registrant and a registrar will not release your transfer code, ICANN's FAQ points to a formal Transfer Complaint with ICANN.

Moving website ownership off a builder platform takes more planning. Our note on what website builders make expensive to leave with covers that case, and so does how vendor lock-in happens one convenience at a time. Brian also listed what happens to your data when you cancel (opens in a new tab) Squarespace, Shopify and other common tools.

What should a Central Massachusetts business check first about website ownership?

My read is that website ownership gets tangled in a small business because one person often set up the website years ago, and the accounts still sit with whoever built it, because there was no IT department to hold them.

A dental office in Shrewsbury might find the domain under the practice's first web designer. A landscaping company in Holden might find its business listing owned by a former employee. Neither is a crisis; both are website ownership fixes from the list above.

For a second set of eyes on the business side, the Massachusetts Small Business Development Center at Clark University in Worcester "provides no-cost, confidential and individualized business advising." (Massachusetts SBDC, Clark University) For the website ownership language in the contract itself, a Massachusetts attorney is the right call. You can also see how we work with Worcester businesses and Shrewsbury businesses.

This article is general information, not legal advice. Kief Studio is not a law firm, and reading it does not create an attorney-client relationship. Laws and regulations change, so check the current text and talk with a licensed Massachusetts attorney about your situation.