Your website is really four things: the domain name, the hosting it runs on, the code and content, and the logins that control all three. You own your website in practice when each of those is registered to your business, on an email address your business controls, with billing you pay and two-factor authentication you hold. If any one of them sits in a developer’s or agency’s account, they effectively control it, whatever your invoice says.
This usually only comes to light at a bad moment: a developer leaves, an agency relationship ends, a card expires or the site goes down on a Friday. The audit below takes an hour or two and is much easier to do while everyone is still on good terms.
Who is the registrant of your domain?
Two terms matter here. The registrar is the company you register the domain through, such as a domain retailer or your web host. The registrant is the person or business that actually holds the domain licence. You can move a domain between registrars fairly easily. Changing the registrant is a bigger deal, because it changes who legally holds the name.
Look your domain up on a WHOIS service. For .au names, auDA’s own WHOIS shows the registrant name and, for business domains, the registrant’s ID such as an ABN. If the name shown is your web developer, their agency or a former staff member, the domain is not legally yours, even if you have paid the renewal fees for years.
What is different about .au domains?
Australian domains are licensed under rules set by auDA, the policy body for .au. A few points catch people out:
- Eligibility is tied to the registrant. To hold a
.com.au, the registrant needs an Australian presence, such as an ABN or ACN, and the name must relate to that entity. If an agency registered the name using its own ABN, the eligibility belongs to the agency, not you. - Direct
.aunames also exist. Names likeyourbusiness.auhave been available since 2022. If you hold the matching.com.au, check whether you also hold the.auversion and who registered it. - Changing registrant is a formal process. It is not just editing a contact field. The current registrant has to agree, and the new registrant has to meet eligibility in their own right. Your registrar can explain their steps.
- Renewal notices go to the registrant contact. If that is someone else’s email, you will not hear when the licence is about to lapse.
If a past provider will not hand over a domain, auDA publishes complaints and dispute processes on its website. Read their current guidance first, and talk to a lawyer if the domain matters a lot to the business. This article is not legal advice.
Who holds the hosting account?
Hosting is where the site actually runs: a managed WordPress host, a cloud platform such as Vercel or Netlify, Shopify, Squarespace or a plain server. Find out which one, then check whose account it is. A common arrangement is an agency hosting dozens of client sites on one reseller account. That can be fine while the relationship lasts, but you cannot log in, take a backup or move away without them.
What you want is either your own account, with the developer invited as a user, or a written agreement that the agency will hand over a full copy of the site and database on request. The guide to giving a developer access without sharing passwords covers how invited users work on the common hosts.
Do you have the code, and the right to use it?
For a hosted platform like Shopify or Webflow, the code is mostly the theme and settings inside your store. For a custom build, it should live in a repository on GitHub, GitLab or Bitbucket. Ask where the repository is and whose organisation owns it. Ideally the repository sits in an account owned by your business, with the developer as a collaborator.
Having a copy is not quite the same as having the rights to it. Under Australian copyright law, a contractor who writes code may own the copyright unless the contract assigns it or grants you a licence. Many web agreements deal with this clearly. Some say nothing. If yours is silent and the code is valuable, ask a lawyer to look at it. Separately, check whether the site depends on paid themes, plugins or fonts that are licensed to the developer rather than to you.
The ownership checklist
Work through this list and write down the answer to each line, including where you found it.
- Domain: registrar name, registrant name and ID, renewal date, and the email that receives renewal notices.
- DNS: where the DNS is managed (registrar, host or a service like Cloudflare) and who can log in.
- Hosting: provider, account owner, billing card, and how to take a full backup.
- Code: repository location, owning account, and whether you can download it today.
- CMS or store: who holds the top-level owner or administrator account in WordPress, Shopify, Webflow or similar.
- Email: where your business email is hosted, such as Google Workspace or Microsoft 365, and who the super admin is.
- Third-party services: analytics, Search Console, Tag Manager, payment provider, form tools and CRM. Each should be on a business account.
- Paid licences: themes, plugins, fonts and stock images, and whose name they are licensed to.
- Two-factor authentication: turned on for each account above, using a device or app the business controls.
What should you fix first?
Prioritise by what would hurt most if you lost it. The domain comes first, because it carries your email as well as your website. Business email comes second. Then hosting and code, then the analytics and marketing tools.
For each gap, the fix is usually a polite request. Ask the current holder to invite you as owner or transfer the account, then confirm you can log in before anyone is removed. Keep the records in a password manager or a shared document that more than one person in the business can reach. One person knowing everything is its own risk.
Do not ask anyone to email you passwords as part of a handover. Ask to be added as an owner or administrator on each account, then change anything that was ever shared.
If you are about to start a new project
It is far easier to set ownership up correctly from day one. Before work starts, create the accounts yourself on a business email and invite the developer in. Put ownership and handover terms in the agreement. When you brief a developer, include a line saying all accounts and code must sit in the business’s name. If a relationship has already gone quiet, see what to do when your developer disappears.
This matters in every industry. It is especially common in real estate, where agency sites are often built and hosted by a CRM or listings provider.
If you only do three things
Look up your domain’s registrant today. Make sure your business email admin account is yours. And get the hosting or code into an account you own, with the developer invited rather than in charge.
If you would like help working through the audit, or want someone to take over looking after the site once it is in your hands, our support and maintenance visits can start with exactly this check. Scheduled update visits from $250 each. Pre-paid blocks of small jobs usually between $500 and $2,000.
