What You Should Own When Your Website Is Built

The rule: your business owns, others are added

Almost every service a website uses lets an owner add other people with a lesser role. That gives a simple rule for every account below: the top role sits with a login your business controls, and the agency, freelancer or staff member is added as a user who can be removed.

Two details make the rule work in practice:

• Use a business login, not a person's. An address on your own domain survives staff changes better than someone's private Gmail.
• Have two owners. Several of the services below warn about a single owner who becomes unreachable, so give the top role to two people in the business.

What to agree in the contract before work starts is covered in our guide to software development contracts, and running the project and its handover in working with a web agency; this guide is for checking what is actually in place.

Domain name and registrar account

The domain matters most: email and the website both depend on it.

• The registrant record. The registrant is the legal holder of the domain. ICANN's registrants' benefits and responsibilities say you must "provide accurate information for publication in directories such as WHOIS" and "respond to inquiries from your Registrar within fifteen (15) days". The registrant name, organisation and email should be your business's.
• The registrar account. The registrant record and the account the domain sits in are different things. A domain in your name inside an agency's account still needs the agency for every change. Ask for the domain to be moved into a registrar account your business holds, with your payment card and renewal notices going to you.

Under ICANN's Transfer Policy, a "Change of Registrant" is a material change to the registrant's name, organisation or email address, and it can trigger a 60-day lock on moving to another registrar. Our guide to domain names explains looking up the registration, transfers and locks.

DNS, hosting and email

DNS decides where your domain points, for the website and email. Whoever controls it can take the site or your email offline, so the DNS account should be yours too, with the agency added if they need to make changes.

For hosting, the account and the billing should be in the business's name. If an agency hosts the site on its own server as part of a maintenance plan, that can be a sensible arrangement, but agree in writing how you get a full copy of the files and database if you leave. Our guides to web hosting and website backups cover both.

Email on your domain needs the same treatment: the admin login belongs to the business.

Google Analytics and Tag Manager

Google Analytics has five roles. Google's page on access and data-restriction management describes the top one, Administrator, as "full control of Analytics", including the power to add and delete users and "assign any role". The others are Editor, Marketer, Analyst and Viewer, with Viewer able to "see settings and data".

Google's page on adding and deleting users adds the details that matter for ownership:

• users can be added at the account or the property level, and adding someone at the account level gives them every property in it;
• deleting users requires "the Administrator role at the account level";
• "if you are the last user who has the Administrator role, you cannot delete yourself."

So check Admin > Access Management at the account level, not just the property. Your business should hold Administrator there; an agency that only reports on traffic needs no more than Analyst or Viewer.

If the site uses Google Tag Manager, check it too. Google's Tag Manager user permissions page warns that if the sole administrator changes roles "you can get locked out of your account", recommends "at least two active administrator accounts", and says to "make sure your account is managed by someone in your organization, not an external agency". Our GA4 basics guide covers the rest of the setup.

Search Console

Search Console's owners, users and permissions page explains a point that catches people out. There are two kinds of owner with the same rights: a verified owner, who proved ownership "using a token" such as a file on the site or a DNS record, and a delegated owner, added by another owner.

When a verified owner is removed, Google tells you to delete all their verification tokens: "If you do not delete these tokens, the removed owner will be able to re-verify ownership if they choose to." And if every verified owner is removed, other users lose access after a grace period. So:

• make sure someone in your business is a verified owner, ideally through a DNS record on a domain you control;
• when an agency leaves, remove its access and its tokens, using the "Unused ownership tokens" list.

Our Search Console guide covers the reports themselves.

Google Business Profile

Google's page on Business Profile owners and managers says a profile "can have multiple owners but only one primary owner". Owners can add and remove users and even delete the profile; managers can do almost everything else, including editing details, posting and replying to reviews, but "can't add or remove users or remove the profile".

The primary owner should be your business. A primary owner cannot leave "until after you transfer primary ownership to someone else". Google also notes that new owners and managers "have to wait 7 days" before they can transfer primary ownership or remove other owners, so start this well before a deadline. Our Google Business Profile guide covers claiming a profile that someone else controls.

Code, content and licences

If your site or app has custom code, ask for it in a repository your business owns. GitHub's documentation on organisation roles says owners have "complete administrative access" and the role should be limited, "but to no less than two people". Outside collaborators, such as "a consultant or temporary employee", can work on chosen repositories. Its guide to transferring a repository notes that "the original owner of the repository is added as a collaborator", so remove that access afterwards if the work is over.

Keep your own copies of text, photos, logos and design files. For paid themes, plugins, fonts and stock images, ask whose account bought each one and in whose name the licence is. Read the terms, or have licences bought in your business's name.

Keeping the logins safe

The UK National Cyber Security Centre's advice on password managers is that they store passwords safely, so "you can have unique passwords for each service". Keep the business's logins in a password manager the business controls, turn on two-step verification, and keep recovery emails and phone numbers on addresses and devices the business owns, not a departed employee's. See our website security guide for the site itself.

The audit checklist

• Domain: registrant name, organisation and email are your business's, in a registrar account you hold.
• DNS, hosting and domain email: admin logins and billing are in the business's name.
• Google Analytics: your business is Administrator at the account level.
• Tag Manager: at least two administrators from your business.
• Search Console: a verified owner from your business, and no old tokens.
• Business Profile: your business is the primary owner; agencies are managers.
• Code: in a repository your business owns, with two owners.
• Licences: a list of what was bought, by whom and in whose name.
• Logins: in a business password manager, with two-step verification and business recovery details.

Frequently asked questions

Who should own the domain name, the business or the web agency?

The business. The registrant name, organisation and email should be your business's, and the domain should sit in a registrar account you hold. ICANN says the registrant must keep contact details accurate and respond to the registrar within fifteen days, which only works if the details are yours.

What role should we have in Google Analytics?

Administrator at the account level. Google describes it as full control of Analytics, including adding and deleting users. An agency that only needs to read reports can be given the Analyst or Viewer role and removed later.

Our old agency was the verified owner in Search Console. What do we do?

Verify ownership yourself, for example with a DNS record, then remove the agency's access and delete its verification tokens. Google warns that a removed owner whose tokens remain can re-verify ownership.

How do we get primary ownership of our Google Business Profile?

Ask the current primary owner to add you as an owner and then transfer primary ownership to you. Google notes that new owners have to wait seven days before some changes, such as transferring primary ownership, so allow time.

Should the code be in our own GitHub account?

If your site or app has custom code, yes: a repository in an organisation your business owns, with at least two owners, as GitHub recommends. Developers can be added as members or outside collaborators and removed when the work ends.

Planning a new website? Whoever builds it, the domain and your content should always be in your name, and our projects end with a short handover so your team can edit content. See our website development service and all our services, or email [email protected].