Who really owns your website? A checklist for your domain, hosting and logins

A website is not one account or one piece of property. Your domain is the address people type. Hosting is the service that runs the site. The website itself includes its design, code, text and images. Business email can use the same domain while being supplied by a different company.

The domain registrar is the company that registers and renews your domain. DNS is the set of records that directs your domain to your website and email services. Your registrar, DNS provider, host and email provider might be the same business, or several different ones. Paying one invoice does not tell you who holds every account.

Make a simple account list before changing anything. Your existing web person can help fill in the gaps. This is a business record, not a demand to run your own server.

• List every domain your business uses, including addresses that redirect to the main website.
• Record the registrar, DNS provider, website host and business email provider for each domain.
• Record the website editing system and any separate booking, payment or form service.
• For each service, note the account holder, account reference, renewal date and person responsible.

The registrant is the person or organisation recorded as holding the domain registration. That is different from the registrar that supplies it. Domain registration gives you the right to use the address under its registration terms. It needs renewal, rather than being a permanent purchase.

For a limited company, check that the registrant organisation is the correct company, rather than a director, employee or supplier personally. A sole trader should check their own correct name and trading details. Ask the registrar to confirm the recorded registrant and the process for correcting a mistake. Do not assume the name on a hosting invoice settles this.

For ordinary .uk domains, Nominet provides a domain lookup. For endings such as .com, ICANN provides a registration data lookup. These can help identify the registrar. Public records may hide personal details, so a missing registrant name is not proof that the registration is wrong. Confirm the full details inside your registrar account or with its support team.

Keep the registrant contact email current and accessible to the business. Ask who receives renewal and verification messages, and who actually completes the renewal.

You normally buy a hosting service, not the physical server. If you pay the hosting company directly, check that its customer account and billing details are correct for your business. Keep the agreement, account reference and support contact with your records.

Managed hosting may sit inside your web person's wider account. That can be a sensible arrangement. You do not need their master password or access to other customers' websites. Instead, get a written record of your service, who can authorise changes and how support works if your usual contact is unavailable.

• Confirm exactly which website and domain the hosting agreement covers.
• Check who pays for hosting, certificates, software licences and any separate email service.
• Record who handles updates, outages and backups. Do not assume hosting includes all of them.
• Agree what website files, data and access records your business can obtain, and how to request them.

A website editor login is not necessarily the hosting or domain login. It may let you change text without letting you manage users, renew a domain or recover the site. Check what each login actually allows.

Use separate named accounts where the service supports them. Give each person the access they need, rather than sharing one administrator password. Keep a business-controlled owner or administrator account where available, and record who can recover it.

• Confirm that you can sign in to the website editing account you are meant to use.
• Check who can add users, change billing and recover the main account.
• Include separate form, booking and payment accounts. A working button does not prove you control the service behind it.
• Review access when staff or contractors change roles. Remove accounts that no longer need access.

Paying for a website does not automatically give you copyright in everything used to make it. The Intellectual Property Office says the creator normally owns copyright in commissioned work unless the parties agree otherwise in writing. A licence gives permission to use work, but does not necessarily transfer ownership.

Check the agreement for the design, custom code, logo, written content and photography. Separate the work created for your business from licensed fonts, stock images, themes and other software. Third-party materials can remain licensed even where you own the custom work.

Keep the contract and licence records. Ask what you may edit, reuse or reproduce, and whether any permissions depend on an ongoing subscription. If the wording is unclear or there is a dispute, ask a solicitor to check your particular agreement.

A login and a backup solve different problems. The login lets you access a service. A usable backup helps recover your website and data if something goes wrong. Ask what is backed up, where the copies are kept and who knows how to restore them.

For a site that stores enquiries, orders or bookings, check that the relevant data is included, not just the visible pages. Keep customer information protected in backup copies too. The NCSC recommends checking that a backup contains all your important data and learning how to restore it before you need it.

Ask what can be exported from your website system and in which format. Do not assume a screenshot, a folder of images or an export of page text is enough to recreate a working website. Keep a record of the most recent successful restore test and who performed it.

Use passkeys where available. If an account uses a password, make it strong and unique, and enable two-step verification. This adds another check when you sign in, such as an authenticator app. A password manager can keep the passwords securely without putting them in your account list.

Record the recovery method, but keep recovery codes and passwords in secure storage with controlled access. Do not send them in an ordinary email or paste them into a shared spreadsheet. Check what happens if the person holding the authentication phone is unavailable.

For the registrar account, consider a recovery address that remains usable if your business domain stops working. Otherwise, a domain problem could also stop the email needed to recover its account. Keep that recovery mailbox protected and under business control.

Keep one account register alongside your contracts and renewal records. Put account references and responsible people in it, not passwords. Record the date you last checked each entry, and review it when a service changes or someone takes on a new role.

The aim is continuity. You should be able to identify the right supplier, authorise work, pay a renewal and recover access without depending on one person's memory.

A fictional Acme Ltd record lists its domain in the company's name, the registrar account reference, the renewal date and Sam as the renewal contact. Alex manages hosting under a written agreement. Secure storage holds the access details, and the record says who can recover them.