The short answer
Your website is made of five separate things, and each one can be owned by a different person: the domain name, the hosting, the Google Business Profile, the analytics accounts, and the site files themselves. Paying someone to build a website does not automatically put any of them in your name.
The one that matters most is the domain. Whoever is listed as the registrant controls it, regardless of who paid for it. Check that first, at lookup.icann.org, and check it while everyone is still on good terms.
Why this goes wrong so often
Almost nobody sets out to trap a client. What usually happens is much more ordinary.
A business wants a website. The developer says leave it to me, I'll handle everything. Which is genuinely helpful, and it is what the client wanted to hear. So the developer registers the domain on their own GoDaddy or BigRock account, because it is faster than walking a non technical client through a signup and a card payment. Hosting goes on their reseller plan, because that is cheaper than a separate account. The Google Business Profile gets verified on the developer's Gmail, because they were the one holding the postcard.
Two years later the business wants to move, or the developer stops replying, or they quit the business entirely and change their number. Nothing malicious happened at any point. The client still cannot get their own website back.
We do a fair amount of migration work, and this is the single most common thing that turns a straightforward move into a three week negotiation. It is also completely preventable with one afternoon of checking.
Check one: the domain name
This is the one that actually matters. Hosting can be rebuilt, files can be recreated, but a domain is a single unique thing and only one account controls it.
Domain records list several contacts, and they are not equal. The registrant is the legal holder. The administrative and technical contacts can make changes but do not own anything. A very common arrangement is your name in the admin field and your developer's name as registrant, which looks reassuring at a glance and means nothing.
Go to lookup.icann.org and enter your domain. You want to see your business name or your own name as registrant, and a registrar you have login details for.
If the details are hidden. Since GDPR, most registrars redact personal details from public lookups, so you may just see a privacy service instead of a name. That is normal and not a red flag on its own. The real test is simpler: can you log in to the registrar account yourself, see the domain listed, and reach the page where you would request a transfer code? If you cannot, you do not control it, whatever the public record says.
If your domain ends in .in or .co.in, it sits under the .IN Registry operated by NIXI rather than under the generic system, and disputes there run through a separate process described further down. The ownership question is identical either way.
Check two: the hosting account
Ask yourself whether you have ever logged in to the hosting control panel. Not the WordPress dashboard, the hosting panel itself: cPanel, Hostinger, SiteGround, whatever it runs on.
Plenty of Indian small businesses sit on a developer's reseller plan without knowing it. It works fine and it is often cheaper. The problem shows up when you want to leave, because a reseller sub account is not something you can take with you. You can move the site, but you cannot move the account, and you will need someone's cooperation to get a full backup out.
You are looking for three things: an account in your name or your business email, a way to download a complete backup yourself, and knowledge of who is actually paying the renewal.
Check three: the Google Business Profile
For a local business this is frequently worth more than the website. It is what puts you on Maps, it holds your reviews, and reviews cannot be transferred or recreated. Losing the profile means losing every review on it.
Open your profile while signed in to your own Google account and see whether you appear as an owner. There is a real hierarchy here: a primary owner can do anything including handing over the profile, plain owners can do almost everything, and managers can post and reply but cannot transfer the profile or remove other owners. Being a manager on your own business listing is a weaker position than most people assume.
If someone else holds the profile and will not hand it over, Google has a request ownership flow. You ask, the current owner gets an email, and they have three days to respond. If they ignore it, you may then get the option to claim the profile yourself. It is not instant and it is not guaranteed, but it exists, and it is a lot better than the situation with a domain.
Check four: analytics and Search Console
Lower stakes than the first three, but worth doing in the same sitting.
Google Analytics holds your entire traffic history. If the property lives on a developer's account and that relationship ends badly, you do not lose your website but you do lose years of data, and there is no way to reconstruct it. Same for Google Search Console, which is where you would find out about a security problem or a manual penalty.
Both let you add users in seconds. Add yourself as an administrator on the analytics property and an owner on Search Console today, and the problem disappears permanently.
Check five: the site files, and whether you could rebuild without help
Ask your developer for a full backup: the files and the database, as downloadable files you keep yourself. A reasonable developer will send it without any fuss. The reaction to this request tells you a great deal, and it is worth knowing now rather than during a dispute.
Two things to watch for. If the site was built on a page builder with a paid licence held by the developer, you may be able to keep the site running but not edit it after they leave. And if it was built on a nulled or pirated premium theme, which is more common in the lower price brackets than anyone admits, you have a security problem sitting on top of your ownership problem. We wrote separately about what to do when a WordPress site gets hacked, and that is very often where those sites end up.
What if you are already locked out?
Start with the least dramatic option, because it usually works. Ask plainly, in writing, for the domain transfer code and the account logins. Say you are moving providers and you need the handover. A lot of apparent hostage situations are just someone busy, disorganised, or waiting to be asked directly.
If you get the code, moving is mechanical. You unlock the domain at the current registrar, get the authorisation code, and start the transfer at the new one. A few timing rules will trip you up if you do not know them:
- A domain cannot move between registrars within 60 days of being newly registered, of a previous transfer completing, or of a change of registrant.
- The authorisation code goes by several names, including EPP code, auth code and TAC, and they all mean the same thing. It is case sensitive, so paste it rather than typing it.
- Nothing on your live site breaks during a registrar transfer as long as the nameservers stay pointed where they are.
If the answer is a flat no, or a demand for money well beyond anything you agreed, the picture changes. There is a formal route: generic domains like .com fall under ICANN's dispute policy, and .in domains go through the INDRP process run by NIXI's .IN Registry. Both apply broadly the same three part test, which is that the domain is confusingly similar to a mark you have rights in, the current holder has no legitimate interest in it, and it was registered or used in bad faith.
Be realistic about this route. It is arbitration, it takes months, it costs money, and it is built around trademark rights rather than around who paid an invoice. If you registered your business name as a trademark you are in a much stronger position than if you did not. This is the point to talk to a lawyer rather than to a web developer, and we are not one.
The honest commercial answer for a lot of small businesses is that buying a new domain and rebuilding is faster and cheaper than fighting for the old one, painful as that is to hear. Weigh what the old domain is genuinely worth to you in traffic and printed material before committing to a fight.
How to set this up properly from the start
None of this is complicated when it is done at the beginning. It only becomes hard retroactively.
- Register the domain yourselfTen minutes, your own card, your own registrar account. Then give your developer access if they need it. Never the other way round.
- Use a business email nobody can take awayEvery account should be tied to an address on your own domain, or at minimum a Gmail your business controls. Not your developer's address, and not a personal address belonging to an employee who might leave.
- Own the Google Business Profile as primary ownerAdd your agency as a manager. That gives them everything they need to do the work and nothing they need to hold it.
- Keep your own backupAsk for a full export at handover, and once a year after that. Store it somewhere you control.
- Write the handover into the agreementOne line covering what gets transferred at the end of the engagement, and that you are the registrant throughout. Most disputes never start if this exists.
For what it is worth, this is how we set up every project, and we say so plainly on our website migration page because a surprising number of our migration enquiries begin with someone who cannot get into their own account.
Common questions
I paid for the website. Doesn't that mean I own the domain?
Not automatically. A domain belongs to whoever is recorded as the registrant with the registrar, and paying an invoice for design work does not change that record. If your developer registered the domain on their own account, they are the registrant on paper even though you paid for it. Your contract may give you a contractual right to it, which is a separate matter from the technical control, and enforcing that right takes time you would rather not spend.
How do I check who owns my domain right now?
Enter your domain at lookup.icann.org and look at the registrant field, not the administrative or technical contact. Since GDPR many registrars hide personal details, so you may see a privacy service instead of a name. The more reliable test is whether you can log in to the registrar account yourself and reach the transfer settings for that domain. If you cannot, you do not control it.
Will transferring my domain take my website offline?
No, provided the nameservers stay pointed at the same hosting. A registrar transfer changes who bills you and who manages the record, not where the site is served from. Downtime happens when hosting is moved at the same time and the migration is handled carelessly, which is a different job that needs planning around DNS and email.
My developer has disappeared. Can I get my Google Business Profile back?
Usually yes, and this is the most recoverable of the five. Use Google's request ownership flow on the profile. The current owner is emailed and gets three days to respond, and if they do not, you may then be offered the option to claim it. It is slower than being handed the account but it does not depend on the other person cooperating, which makes it far better than the equivalent situation with a domain.
What is an EPP code and why won't my registrar give it to me?
It is the authorisation code that proves you are allowed to move a domain to a different registrar, also called an auth code or TAC. Registrars release it to the account holder, so if you are not on the account you will not be given it. There are also legitimate reasons a transfer is refused temporarily: domains are locked for 60 days after registration, after a completed transfer, and after a change of registrant.
Is it worth fighting for an old domain or should I just start again?
It depends on what the domain is actually carrying. If it has years of search rankings, links from other sites, printed signage and cards, and an email address your customers use, it is worth real effort. If it is two years old with modest traffic, a new domain plus redirects you cannot control is often the faster and cheaper path. Formal dispute processes exist for both .com and .in domains but they are arbitration, they take months, and they turn on trademark rights rather than on who paid the invoice. Get legal advice before starting one.
Do the five minute version today
If you read this and do nothing else, open lookup.icann.org, type in your domain, and look at the registrant field. That single check catches the expensive version of this problem.
If something looks wrong and you are not sure what it means, send us the domain on WhatsApp and we will tell you what we see. There is no charge for looking, and the answer is often reassuring.