How to check that you actually own your domain and website

Here's a phone call nobody should have to make: "Our web guy stopped answering, the site's down, and we can't get into anything." Sometimes it's a freelancer who moved on, sometimes a relative who set it all up years ago, sometimes an agency that closed. The business carries on, but its web address, its email and its Google listing are sitting in accounts that belong to someone else.

You can find out where you stand in about half an hour. Here's how.

Step 1: Look up your domain registration

Go to ICANN Lookup, type in your domain and run the search. ICANN is the organization that oversees domain names, and this tool shows the public registration record.

Don't be surprised if the owner's name and email say "REDACTED FOR PRIVACY." Since privacy rules tightened in 2018, most registrars hide those details by default. You can still see three useful things:

• The registrar. The company the domain is registered through, such as GoDaddy, Namecheap, Squarespace, Cloudflare or Hostinger.
• The expiration date. If it's coming up soon and nobody's watching it, that's your first job.
• The name servers. These show which company controls the domain's DNS settings, which is often a different company from the registrar.

Step 2: Try to log in at the registrar

Now go to that registrar's website and try to log in. Use the "forgot password" link with every email address you might have used.

If you get in and the domain is in your account, good. Check two more things while you're there:

• The registrant contact should be you or your business, not your web designer.
• The account email should be an address you control. Renewal notices and transfer approvals go there. If it's your developer's email, they're the one who gets those messages.

If you can't get in, or the domain isn't in any account you can reach, someone else controls it. That usually doesn't mean anyone is acting in bad faith. More often nobody ever thought about it. But it does need fixing.

Step 3: Get the domain into an account in your name

If the person who set it up is cooperative, the simplest fix is to move the domain into your own account at the same registrar. Most registrars have a way to do this between accounts (Namecheap calls it a "push," for example), and it's usually quick.

If you'd rather move to a different registrar, the usual process is:

1. The current account holder unlocks the domain.
2. They request the authorization code (sometimes called an EPP or transfer code) and give it to you.
3. You start a transfer at the new registrar and enter the code.
4. The transfer gets approved, usually by email, and completes within a few days.

One timing note: a domain generally can't be moved to a different registrar within 60 days of being registered or transferred. If the renewal date is close, renew first and sort out the transfer afterwards.

Once the domain is in your account, turn on two-step verification, switch on auto-renew, and check that the card on file won't expire next month. An expired domain can take your website and your email down with it.

Step 4: Check the hosting and the website files

The domain is the address. The hosting account is where the building actually stands. Find out:

• Which company hosts the site, and whose account it's in.
• Whether you can log in to that account, or at least be added as a user.
• Whether you can download a full backup. For a WordPress site that means the files and the database. Many hosts have a backup button in the control panel.
• Whether you have an admin login to the site itself, such as the WordPress dashboard.

If your site runs on a builder like Wix or Squarespace, things work differently. You own your content, but the site only runs on that platform, and you generally can't move the design elsewhere. Make sure the account is in your name and that you're the one paying for it.

Step 5: Check the accounts around the website

A website is tied to several other accounts that matter just as much. Make sure you have your own access to each one:

• Google Business Profile. You want to be the primary owner, not just a manager. Owners can remove managers.
• Google Search Console. This is where Google reports problems with your site. You should be listed as an owner.
• Google Analytics. You should have the Administrator role.
• Business email. If you use Google Workspace or Microsoft 365, someone inside your business should hold the top admin role (Super Admin in Workspace, Global Administrator in Microsoft 365).
• DNS. If your name servers point to a service like Cloudflare, that's one more account to check.
• Facebook, Instagram and other social pages. Make sure you're an admin, not just the person whose photo is on the page.

How to ask for access without starting a fight

Most people will hand things over if you ask plainly and make it easy for them. Something like this usually works:

"Hi Sam, thanks again for setting up our website. We're putting all our business accounts in the company's name for our records. Could you move the domain into our account at the registrar and add me as an admin on the hosting and the website? Happy to hop on a call if that's easier. You're welcome to stay on as a user so you can keep helping us."

That last sentence matters. You're not firing anyone. You're making sure the business owns its own assets.

If they won't or can't hand it over

If the registrant contact on the domain is already your business, contact the registrar's support team with proof that you are the business: formation documents, invoices for the domain, a business bank statement. Registrars have processes for this, though they vary.

If the domain is registered in someone else's name and they won't cooperate, it gets harder. You may need a letter from a lawyer, particularly if you have invoices showing you paid for it. In the worst case some businesses end up picking a new domain and redirecting what they can. That's painful but survivable, and it's a good reason to do this check before there's a problem.

Keep a one-page record

When you're done, write everything down in one place: each account, the company it's with, the login email, who has access and the renewal date. Keep the passwords in a password manager rather than on a sticky note, and look the list over once a year.

If you're dealing with a site that's already broken and a developer who's already gone, our recovery checklist for when your developer disappears picks up from here.