Who owns your website, and what a handover should include

Say you run a bakery with an online ordering page. Three years ago an agency built your site. For convenience, they registered your domain under their own account, set up hosting under their own account, and verified the site in Search Console using their own tag. Nothing was wrong at the time. The site worked and everyone was friendly.

Now you want to move to a different supplier. You discover that your domain's registrant is the agency, the renewal reminders go to an email address you have never seen, the hosting bill is inside a bundle you cannot view, and your Search Console history is visible only to the agency's login. Each of these can be sorted out, but some of it needs the agency's cooperation, and cooperation is hardest to get at the moment relations are strained.

The time to avoid this is at the start of a project and at its end. The rest of this guide shows how.

The person or business listed as the registrant at the registrar, the company where the name is registered. ICANN, the body that coordinates domain names, explains that its Whois lookup shows the registrar and the registrant details, and that to update the registrant or move the name to another registrant, you contact the registrar the name is registered with.

Ask for three things:

• The registrant of record is your business, with a contact email you control.
• You have a login at the registrar, or a transfer of the name into an account of yours.
• Auto-renewal is on and the renewal reminders go to you.

One rule from ICANN is worth knowing before you change anything. Since 1 December 2016, registrars must impose a lock that prevents transfer to another registrar for 60 days after a change to the registrant's information. To avoid being locked out of a transfer, ask for the transfer before changing the registrant details, or ask the registrar whether it can opt you out of the lock first. If the details shown are unclear, ask your supplier in writing who the registrant of record is.

Whoever holds the account. Hosting and store platforms deal with the account holder, so ask that the account be in your business's name with your payment details, and that the supplier has access as a staff member or collaborator, not as the owner.

Shopify shows how this looks on one platform. It distinguishes staff accounts, for your own team, from collaborator accounts for outside partners, and lets you assign roles with the permissions each person needs. Its store settings include an option to "change or transfer ownership outside of your existing users". A good handover on any platform leaves you as the owner and the supplier with limited, removable access.

Having an account is not the same as owning the platform. On a hosted platform you hold an account on software that belongs to the vendor, and you work within its terms. That is a reasonable trade for a store, but you should know you have made it.

This is the part where the answer comes from the contract, and where the defaults surprise people.

Code and designs are creative work. The open-source licensing guide Choose a License describes the default for software with no license this way: "the work is under exclusive copyright by default", and nobody else has permission to copy, modify or share it. For a website, that is the reason the agreement has to say what you may do with the code and designs. Silence is not a safe default.

The rules for commissioned work differ by country. In the United States, the Copyright Office's Circular 30 explains that a specially commissioned work is a "work made for hire" only when it falls within certain categories and the parties sign a written agreement saying so. UK government guidance says that when you commission someone to create a copyright work, the first legal owner is the person or organisation that created it, "and not you the commissioner, unless you otherwise agree it in writing". The two systems work differently, and the practical lesson is the same: ownership of a commissioned site needs to be written down, as an assignment of the rights to you or a licence that says exactly what you may do, for how long, and with which files.

When you read a proposal, look for four things:

• Whether you receive ownership or a licence, and the wording of each.
• Whether the source files are included, meaning the code, design files and a way to build or rebuild the site, not only the finished pages.
• Which parts are third-party or open-source components that carry their own licences, and whether the supplier keeps any reusable code or tools of its own, and on what licence you receive them.
• What happens on termination.

Your scope lists every file, login and account handed to you. Third-party licences keep their own terms.

We cannot say what your country's law implies for a particular contract; the contract is the document to read, and a lawyer is the person to ask.

You supplied or approved most of it, but "yours" needs checking in practice. Text you wrote, product photographs you took, and your logo are yours to hand over. Stock images are usually licensed to use, not owned, and the licence may be tied to the supplier's account or to a single use. Photos of people raise their own questions about consent. Ask for every original file at full resolution, since the compressed versions on the live site cannot be turned back into the originals, and for a list that says which images are yours, supplied by someone else, or licensed.

These accounts hold your history, and history cannot be rebuilt once you lose it.

In Search Console, a verified owner proves ownership with a token on the site, such as a DNS record, a file or a tag, and "to add or remove a verified owner, you must add or remove a token on the site." A delegated owner has the same permissions but was added by another owner, without a token. Google adds: "A property must have at least one verified owner, or no users will have access to the property." So if the only verified owner is your agency's tag, and the agency removes it, you lose access to your own search history. Ask to be a verified owner in your own right.

In Google Analytics 4, the Administrator role has "full control of Analytics" and can manage users, while the Editor role cannot manage users. Check that an Administrator login belongs to your business, and that the account itself, not only your role in it, is yours.

The same logic applies to anything else attached to the site: a tag manager, an email service, a booking system, a payment account, and a business listing.

A site usually leans on paid pieces: a theme or template, plugins or apps, fonts, a stock photo library, a booking or form service. Each has its own terms, and many are licensed to a named account for a period. At handover you need a list showing each item, who holds the licence, what it costs to renew and when, and whether it can transfer to you. A theme licence that sits in the supplier's account may stop covering your site when the relationship ends.

When pages have moved during a project, the redirect record matters, because it tells whoever works on the site next why each address goes where it does. If you are replacing a site, our guide to redesigning a website without losing search traffic explains why.

Before work starts. A proposal should say who will own what at the end, and the scope should be agreed in writing before building begins, with anything added later given its own scope. If these points are missing from a proposal, that is the moment to ask. Our guide on what to prepare and ask before you hire a web designer lists the other questions to put to a supplier.

When we deliver a site, the last step is Launch and hand over: we run the launch checks and hand over once you approve the launch, with Content Management System (CMS) access and documentation. Your scope lists every file, login and account handed to you. In practice that means the table above, completed.

• Make you responsible for nothing. A site you own still needs hosting, updates and security checks, and somebody has to do them. Our guide to website maintenance covers what that involves.
• Settle a legal question. If you and a former supplier disagree about who owns something, the contract and the law of your country decide it. A checklist cannot.
• Run on its own after handover. Code you own is not code anyone else can necessarily maintain. Ask what skills and tools it needs.

The handover, the standards the site is checked against and the checks before launch are part of how we work, which is described on our approach page. Who owns it? You do: the domain, the hosting and Shopify accounts, the files and the logins. Anything run by another company keeps that company's terms, and we list each one. Your scope is agreed in writing before any work starts. To see what we build, read about custom website design. Tell us about your project, and we reply with next steps. No cost, no obligation. Discuss your project

ICANN, "Domain name registrant ownership and changes" (Whois lookup, contact the registrar, 60-day transfer lock): https://www.icann.org/resources/pages/ownership-2013-05-03-en

Search Console Help, "Add or remove users and owners": https://support.google.com/webmasters/answer/7687615

Search Console Help, "Verify your site ownership": https://support.google.com/webmasters/answer/9008080

Analytics Help, "Access and data-restriction management": https://support.google.com/analytics/answer/9305587

Shopify Help Center, "User management and permissions": https://help.shopify.com/en/manual/your-account/staff-accounts

Shopify Help Center, "Store settings and ownership": https://help.shopify.com/en/manual/your-account/account-types/transfer-ownership

Choose a License, "No license": https://choosealicense.com/no-permission/

U.S. Copyright Office, "Circular 30: Works Made for Hire": https://www.copyright.gov/circs/circ30.pdf

GOV.UK, "Ownership of copyright works" (UK guidance on commissioned work): https://www.gov.uk/ownership-of-copyright-works