You Own Your Website. Can You Prove It?
Handing over access was a reasonable act of trust. The business should still hold the root credentials, and a supplier worth keeping hands them over on request. Here are the five, and how to ask for them back without it being awkward.
Most business owners cannot say in under a minute where their domain is registered or who can log in to it. Quite a few cannot say at all without ringing someone, and that person is often someone they have not spoken to in three years.
That is not a character flaw. It is the ordinary result of how websites actually get built, and it is one symptom of a wider pattern: what happens to a website once nobody is assigned to watch it.
Our view at Webgold is that the business holds the root credentials — the domain, the Domain Name System (DNS), and the hosting — and a supplier worth keeping hands them over on request.
What this looks like from our side
When Webgold takes on a new client, one of the first things we need is access: the domain, the DNS, the hosting, and the site itself. It sounds like a formality, but it is routinely one of the slowest parts of the whole engagement.
With larger organisations it becomes an internal search. Somebody knows the website has a hosting account, but nobody knows who set it up. It turns out to be a manager in a different department, someone in finance whose name is on the billing, or an IT contractor engaged for something unrelated who was handed the login once and never asked about it again. The organisation owns everything. It simply does not know where anything is.
With smaller businesses there is no internal search, because the access sits with whoever built the site. So we ring the original developer. Sometimes they answer immediately and hand everything over within the hour. Sometimes the number is dead, the email bounces, and the business finds that the person who registered its domain five years ago, as a favour, has emigrated.
The part I find most telling is that in almost every case the owner did not know any of this was theirs to hold. Nobody told them at the time, because at the time there was no reason to bring it up.
Why this happens, and why it is not carelessness
Across the Caribbean, Trinidad and Tobago included, suppliers arrive by recommendation. You hire the developer your accountant used, your cousin’s friend, or the firm that did the job well for the business across the road. Personal referral is how most of this market actually works, and it works because it is a reasonable way to buy something technical that you cannot assess yourself.
So when that person asked for access, you gave it, because they were vouched for, they were helpful, and they needed it to do the work you were paying for. Handing over the keys was not a lapse in judgement. In most cases it was the only way the job was getting done.
Our Founder and Chief Executive Officer, Stephan De Roche, puts the trust question this way. We board an aeroplane and place our lives in the hands of somebody we have never met. We do not interview them. We do not ask to see their licence or check how long they have been flying. We sit down and read the safety card. If we can extend that much trust to a stranger where our own survival is concerned, the objection to trusting a supplier with a business cannot simply be that trusting people is unwise.
It isn’t. Trust the pilot.
But you do not hand over everything at the gate. You keep your passport, not because the airline is untrustworthy, but because that document proves who you are and lets you travel again, with this airline, with a different one, or on a day when this one has cancelled the flight. It is yours regardless of who is flying the plane.
Your domain, your DNS, and your hosting are the passport.
The five, in order
These are not equal. They are listed in the order that matters.
1. Your domain registrar. This is the root, and everything else grows from it. The domain is the address people type; the registrar account is where that address is controlled. Whoever holds it can point your website anywhere, redirect your email anywhere, or let the registration lapse. Without it you cannot move suppliers, you cannot recover from a dispute, and you do not control your own address.
How to check: look up your domain on a public WHOIS service and see which organisation is listed as registrant. Then try a password reset on the registrar’s site using your own email address or the company’s email address. If the reset email never arrives, the account is not in your name.
2. Your DNS. The DNS is the instruction sheet that tells the internet where to find things at your domain: the website here, the email there. It is often, though not always, controlled in the same place as the registrar.
Most owners have never thought about the DNS, and it has the widest reach of the five. Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC) records — the settings that tell the world an email genuinely came from your business — live in DNS. Whoever controls DNS controls whether your email is trusted. If you lose it you have not lost a website; you have lost the ability to prove your own messages are yours, which is a considerably bigger problem for most businesses than the website ever was.
3. Your hosting account. This is where the site physically lives. It controls your backups, your ability to move to a different provider, and in most cases your certificates. A supplier holding it is common and not in itself a concern, but you should know whose name is on the account and how you would get into it tomorrow if you needed to. An account you cannot reach and a backup nobody has tested are the two things that turn a recoverable incident into an expensive one, and incidents are not hypothetical here.
4. Your content management system (CMS) administrator account. This gives day-to-day control of the site and, more importantly, the ability to grant and remove everyone else’s access. If you cannot remove a user, you cannot end a relationship cleanly.
5. Your analytics property. This is the one people forget, and the only one here where the loss is permanent. Every other credential can eventually be recovered or rebuilt, but analytics history cannot. A new property starts empty, and the three years of data showing how your business actually behaves online do not come back. If the property was created under a supplier’s account, ask to be made an owner today rather than at the point you part company.
The five at a glance. Fill in the last column. Any blank, or any name that is not yours, is the one to recover first.
| # | Credential | What it controls | Without it | Held by |
|---|---|---|---|---|
| 1 | Domain registrar | Where your address and your email point | You cannot move suppliers or control your own address | |
| 2 | DNS | Where the internet finds your website and email; SPF, DKIM, and DMARC | You cannot prove your own email is yours | |
| 3 | Hosting account | Backups, moving provider, and certificates | A recoverable incident becomes an expensive one | |
| 4 | CMS administrator | Day-to-day control; granting and removing access | You cannot end a relationship cleanly | |
| 5 | Analytics property | Your history of how the business behaves online | Lost permanently — history cannot be rebuilt |
What a good supplier does
Webgold holds credentials for the clients we manage, so we should say where we stand on this. We manage on the client’s behalf with documented access, the client retains full ownership throughout, and anyone who leaves goes with complete documentation and a clean handover.
That is a benchmark you can hold any supplier to, including us.
The practical test is simple. A supplier worth keeping hands these over on request, without friction, and without asking why you want them. There is no legitimate reason for the question to be difficult. A good arrangement usually has the supplier holding operational access, which means the day-to-day logins needed to do the work, while the business holds the root credentials underneath. Both parties can work, and neither is stuck.
If asking produces delay, deflection, or a change of subject, that in itself is the answer to a question you were probably already wondering about.
How to ask, without it being awkward
Most owners never ask, and the reason is not fear of the answer. Asking feels like an accusation, and the relationship is usually a good one.
So do not frame it as one. Frame it as record-keeping, because that is what it is. Something close to:
Hi — I’m updating our business records and making sure we have all our own account details on file. Could you send me confirmation of where the domain is registered, who holds the DNS and hosting accounts, and make sure I’m listed as an owner on the analytics property? No rush, and nothing’s wrong — I just want our records straight.
That is a normal request and any competent supplier will read it as one. Send it to whoever built or currently manages the site.
If the developer has moved on and you cannot reach them, start with the registrar rather than the developer. Every registrar has a documented process for recovering an account where the business can prove it owns the domain, using company documents, matching billing records, and so on. It is tedious and it usually works.
If the trail has gone cold
Sometimes asking does not work, and we should be honest about that.
We have helped businesses recover domains registered by developers who had vanished. We have also sat with owners and concluded that the domain was not coming back, because the registration had lapsed and been bought by somebody else, or because the only evidence of ownership was an email address nobody controls any more. When that happens the honest advice is sometimes to start fresh on a new domain and migrate what can be migrated. That is a real cost and an unwelcome conversation, but it is still better than a year of trying.
Either way, the sooner you look, the more options you have.
If you have worked through the five above and cannot account for one of them, talk to us. We will tell you what we think is recoverable, what is not, and what we would do in your place, including when we think the answer is that you do not need us.
