Who Controls Your Website, Domain, Hosting, and Analytics?

A business owner should be able to identify the business-controlled account, billing owner, administrators, recovery method, renewal date, and handover process for every critical website system.

That does not mean one person should hold every password or that paying for a service automatically transfers copyright, source files, software licenses, or platform ownership. Ownership, access, administration, and licensing are different questions. The agreement and the applicable platform terms matter.

Build a control register

Create one record for each system:

Store the register securely and review it after staffing or vendor changes.

Domain registration and renewal

The domain is the address customers use to reach the business. Confirm:

• Which registrar account contains it.
• Whether the account uses a business-controlled email address.
• Who receives renewal and security notices.
• Whether renewal and payment details are current.
• Which people have administrative access.
• Where recovery codes or approved recovery procedures are stored.
• Who can change nameservers, DNS, or transfer settings.
• Which other domains redirect to or protect the primary name.

Avoid making an outside vendor the only person who can receive renewal notices or recover the account. Do not share one login when named users or delegated access are available.

DNS and hosting are separate controls

The domain registrar may also host DNS, but it does not have to. DNS tells internet services where to find the website, email, and other systems. A careless DNS change can affect more than the site.

Document:

• DNS provider and administrators.
• Important records and why they exist.
• Who may approve changes.
• Hosting provider, plan, billing, region if relevant, and support path.
• Deployment process and rollback responsibility.
• Certificate and security-management responsibility.
• Dependencies such as email, subdomains, or verification records.

Do not publish sensitive configuration or recovery details in a general project document.

Website platform and administration

Ask:

• Is the site on a hosted platform, a content-management system, or a custom application?
• Which business account owns the subscription?
• Who has owner, administrator, editor, developer, and billing roles?
• Which plugins, themes, integrations, or extensions require separate licenses?
• Who is responsible for updates, security monitoring, and compatibility?
• Can the content and data be exported in a usable format?
• Where are technical documentation and deployment instructions maintained?

Administrator access permits actions within a system. It does not by itself establish ownership of source code, design assets, photographs, fonts, templates, or other work.

Source files, design assets, copyright, and licenses

The contract should identify:

• Deliverables transferred to the client.
• Source or working files included, if any.
• Pre-existing vendor tools or reusable components excluded from transfer.
• Third-party themes, fonts, photographs, software, and other licensed material.
• Whether licenses are transferable and who renews them.
• Portfolio or attribution permissions.
• What the client receives at termination.

Do not assume “we paid for it” answers every rights question. Legal rights depend on the agreement, applicable law, and third-party terms. A qualified attorney should review material ownership or licensing issues.

Analytics and search accounts

The business should know which account controls analytics and search-performance tools, which properties belong to the website, and who can manage users.

Confirm:

• A business-controlled account has the highest appropriate administrative role.
• Named users receive appropriate permissions.
• The website property, data streams, tags, and important events are documented.
• Search-related properties include the correct domain or URL versions.
• Reporting dashboards do not substitute for access to the underlying account.
• The measurement setup and known limitations are documented.
• Departed staff and former vendors are removed through an approved process.

Data retention, consent, privacy, and regulatory requirements vary. Obtain qualified advice for your circumstances rather than treating a standard analytics installation as blanket compliance.

Forms, lead routing, and CRM handoff

Forms are business systems, not decoration. For each form, document:

• Where submissions are stored.
• Who receives notifications.
• Who owns first response and backup response.
• How the record enters the CRM or another system.
• Which fields, consent language, and retention rules apply.
• How routing is tested.
• What happens when an integration fails.
• Whether spam controls or service limits can block legitimate submissions.

Run controlled tests and confirm receipt at every handoff. Avoid entering sensitive real customer information into routine tests.

Backups and recovery

Ask what is backed up, how often, how long copies are retained, who can restore them, and whether restoration has been tested. A backup that no one can locate or restore is not a recovery plan.

Include content, databases, uploaded media, configuration, and custom code as applicable. Hosted platforms may provide resilience without providing every export or rollback option the business expects; verify the actual plan and terms.

A vendor handover checklist

Before a relationship ends:

• Inventory accounts, administrators, subscriptions, and billing.
• Confirm business-controlled recovery access.
• Export agreed content, data, reports, and files.
• Receive current documentation and open-issue notes.
• Transfer or replace licenses as the agreement permits.
• Confirm forms, analytics, search tools, email, and CRM still operate.
• Rotate credentials or remove named access through secure procedures.
• Record the date and person who confirmed each step.

Do not abruptly remove a vendor who still operates a critical transition unless the risk requires immediate action and an authorized owner approves it.

Questions every owner should be able to answer

• If the current vendor became unavailable today, who could renew the domain?
• Who could publish an urgent website change?
• Who receives a lead, and who knows if routing fails?
• Can the business access its underlying analytics and search accounts?
• Which assets are owned, licensed, or unavailable as source files?
• What can be exported?
• Where are backups and documentation?
• Which access should be removed when someone leaves?

Use this control review before hiring someone to redesign the site. A redesign may also expose needs for web design and development, digital transformation, or CRM and funnel architecture. For a practical review of your current setup, contact me.