Why companies lose their domains and websites, which accounts should be registered to the business owner, how to store access details, and what to get from your developer after launch.
It is a familiar story. Years ago, a freelancer you knew built your website. He registered the domain in his own name, paid for hosting from his own account, and is the only one with the admin password. Then he stops replying, the domain is not renewed in time, and the website disappears along with your company email. Sometimes the domain can be recovered and sometimes it cannot. A website without its source code and database can only be recovered one way: by building it again.
This can almost always be avoided if everything is registered to the company from the start and the access details stay with you.
What should belong to you
The website owner should own each of the following, not just have access to it:
- the domain: the registrar's records should list your company or you personally as the domain administrator, not a contractor or an employee;
- hosting or the server: the hosting account is registered to the company and paid from its account;
- company email on the domain;
- DNS, if it is managed in a separate service such as Cloudflare rather than at the registrar;
- Google Search Console, Google Analytics, Yandex Webmaster and Yandex Metrica;
- your business listings on Google Maps and Yandex Maps;
- Google Ads and Yandex Direct ad accounts;
- the Telegram bot that receives your leads: the account that creates a bot becomes its owner, and that account should be yours;
- agreements with payment services such as Click, Payme or Uzum, if the site takes payments;
- the source code repository, if there is one.
A contractor can work in all of these services, but as an invited user or administrator, not as the sole owner. When the work ends, you simply remove their access.
If a contractor has already created your Telegram bot, it can be transferred to you without rebuilding it. The owner opens @BotFather, sends /mybots, selects the bot and taps Transfer Ownership. Their account must have had two-step verification turned on for at least seven days, so agree on this in advance.
How to check who owns your domain
It takes a couple of minutes. Open a WHOIS lookup (there is a separate one for the .uz zone, and any general service works for .com and other international zones) and enter your website address. You will see the registrar, the expiry date and, unless the details are hidden, the owner.
If the owner is not you or the details are hidden, contact the registrar or whoever registered the domain and transfer it to your company. While the site is working and you are on good terms with the contractor, this is straightforward. Once there is a dispute or the contractor disappears, it takes much longer and costs much more.
While you are there, check the expiry date and turn on auto-renewal if your registrar offers it.
Where to keep access details
Passwords stored in phone notes, in chats with a contractor or in one employee's head are the ones that get lost most often. A better approach:
- register every service to a shared company address such as admin@yourdomain rather than an employee's personal email. If that person leaves, the company keeps the ability to reset passwords;
- keep passwords in a password manager with a shared team vault. Only the people who need access see it, and it is easy to revoke;
- turn on two-factor authentication at your domain registrar, your hosting provider and in your Google account, and keep the backup codes in the password manager as well;
- maintain one document listing everything related to the site: where the domain is registered, where it is hosted, which services are connected, who is responsible for each and when each one renews.
Also check which phone number your key accounts are linked to. If it is a former employee's personal number, recovering access will be difficult.
What to get from your developer
After launch, and whenever you change contractors, ask them to hand over:
- The full source code of the site, as an archive or as access to a repository that belongs to you.
- An up-to-date copy of the database.
- Admin panel access with full administrator rights.
- Hosting or server access, including FTP or SSH connection details.
- A list of connected services and integrations (CRM, payment systems, Telegram bot, email newsletters, analytics), noting where each one is and who it is registered to.
- Brief technical documentation: what the site is built on, how to deploy it again and how to update it.
Check what you receive straight away rather than a year later: log in to the admin panel, open the hosting account and make sure the code archive opens. Even if the same contractor maintains the site, keep a current copy of the code and database yourself. We covered how backups and support work in "Website Support After Launch".
What to put in the contract
Before development starts, make sure the contract includes:
- transfer of rights to the website, design and source code to the client after payment;
- an obligation for the contractor to register the domain, hosting and services in the client's name;
- handover of all access details and source code when the work is finished or the contract is terminated;
- a procedure for handing the project over to another contractor if you decide to switch.
It is worth having a lawyer look at the wording on rights, because it determines whether you can freely develop and move the site later.
When an employee or contractor leaves
This is when access is lost most often. To prevent it:
- Check in advance that every account is registered to the company, not to that person.
- Get all passwords and documents that only they have.
- Change the passwords for the registrar, hosting, admin panel and email.
- Remove them from Google Search Console, Analytics, ad accounts, Telegram groups and the repository.
- Update the document that lists your access details.
Frequently asked questions
What if the domain is registered to a former contractor?
Ask them to transfer the domain to your company through the registrar. If they do not reply or refuse, contact the registrar directly: registrars have a procedure for these cases, and the rules depend on the domain zone. In a dispute you will need documents showing the site was built for you, so keep the contract and signed acceptance records.
What happens if the domain is not renewed in time?
The website and email stop working. There is usually a period after expiry when the previous owner can still renew, but its length depends on the zone and the registrar. If that is missed too, the domain is released and anyone can register it.
Is admin panel access enough to consider the site mine?
No. The admin panel lets you change text and images, but it does not give you the source code, the database or server access. If the contractor shuts down the hosting, you are left with nothing. You need the full set listed above.
Can I move my site to another contractor?
Yes, as long as you have the source code, the database and the access details. The new contractor will start with an audit to understand how the project is built. If the site is badly outdated, building a new one is sometimes the better deal. Read our article on redesign for how to move without losing search rankings.
Not sure everything for your website is registered to you? Get in touch and we will help you check.
