When an agency or freelancer hands over a website, the files are the easy part. The domain registration, the hosting account, the admin logins and the Google accounts decide whether you can change providers later without starting over.
Each of those sits in someone's name. If it isn't your business's name, leaving can mean asking permission, waiting out deadlines or paying a lawyer.
You should finish a handover holding the domain, the hosting, your own logins and a written answer on copyright. If you're still comparing quotes, what a small business website costs covers the money side.
Key takeaways
- Register the domain with your business as the registrant of record. An ICANN blog post calls listing your web developer instead "generally not considered a good practice".
- In the US, paying for a website doesn't make you the copyright owner. A transfer of copyright needs a signed document in writing (17 U.S.C. §204).
- Hosting, email, the site's admin account and Google Analytics should all sit under logins your business controls.
- In Search Console, also remove the old agency's verification token. A deleted owner whose token remains can verify again.
- Agree on ownership in writing before work starts, while both sides want the project to begin.
Domain registration
Your business should be the registrant of record for its domain. The registrant is the person or organization the registrar lists as holding the domain, and ICANN's transfer rules give that registrant the right to the code needed to move it.
An ICANN blog post warns against letting someone else hold the registration. In it, Carlos Alvarez called it "generally not considered a good practice" for an organization to let "their hosting provider, web developer or law firm" register its domains (ICANN blog, June 23, 2017).
The organization then "will NOT be the registrant of record", which "might allow that third party to challenge the registration." Getting the domain back can cost legal fees, "and even after all that, there's no guarantee."
To check, log in to the registrar account (the company where the domain is registered) and look at the registrant contact. It should show your business's legal name and an email address you control.
If you don't have a login to that account, ask for one. ICANN's own guidance is blunt: "You may not be able to access the domain name if you are not the administrative contact/registrant of record" (ICANN RDRP FAQs, updated February 21, 2024).
Transfer rules for .com and other generic domains
A handover can involve two different changes. A change of registrant puts the domain in your name, and a transfer moves it to a different registrar.
Under ICANN's current Transfer Policy (ICANN, updated February 21, 2024):
- The registrar must give the registrant the transfer code, called the "AuthInfo" code, within 5 calendar days of a request.
- A registrar may deny a transfer within 60 days of the domain's creation or of a previous transfer.
- After a change of registrant, "The Registrar must impose a 60-day inter-registrar transfer lock". The registrar may let the current registrant opt out of that lock before the change is requested.
We suggest getting the registrant changed to your business first, since that is the change that protects you. If you also plan to move to another registrar soon, ask the current registrant to opt out of the lock before the change, if the registrar offers that. Otherwise expect to wait 60 days.
These rules are changing, but not yet. On June 7, 2026, ICANN's Board adopted all 47 recommendations of the GNSO Transfer Policy Review, with implementation "subject to prioritization" and no effective date set (ICANN Board resolution 2026.06.07.04).
Under those changes, which are not yet in force, the AuthInfo code becomes a "Transfer Authorization Code", the 60-day windows after creation or a transfer drop to 30 days, and the lock after a registrant change goes away (GNSO presentation of the Transfer Policy Review final report). Until your registrar announces otherwise, plan around the current 60-day rules.
ICANN's rules cover generic domains such as .com, .net and .org. Country-code domains such as .uk, .de or .rs follow their national registry's rules, so check those terms instead.
Copyright in the code, design and text
In the United States, paying for a website doesn't make you its copyright owner. Under 17 U.S.C. §201(a), "Copyright in a work protected under this title vests initially in the author or authors of the work." When an outside agency or freelancer builds your site, they are usually the author under this rule, unless one of the exceptions below applies.
Work made for hire
The exception is a "work made for hire" under 17 U.S.C. §101. It covers two situations:
- work by an employee within the scope of their job
- specially commissioned work in one of nine categories, such as a contribution to a collective work, a compilation or an instructional text, where the parties "expressly agree in a written instrument signed by them"
When a work is made for hire, "the hiring or commissioning party is considered the author and the copyright owner" (US Copyright Office, Circular 30, revised August 2024).
A website built by an outside contractor usually fits none of the nine categories. Whether yours does is a question for a lawyer, so don't assume a "work for hire" line in a contract settles it.
Written assignment of copyright
The dependable route is a written transfer. Under 17 U.S.C. §204(a), "A transfer of copyright ownership, other than by operation of law, is not valid unless an instrument of conveyance, or a note or memorandum of the transfer, is in writing and signed by the owner of the rights conveyed".
Without a signed assignment, the contractor generally keeps the copyright. You may still have an implied license to use the site, but how far that license goes depends on the facts. Talk to a lawyer before you rely on it.
Our recommendation, wherever you are: get a written assignment of copyright in the custom code, design and text you pay for, effective on final payment. If the agency reuses its own tools across projects, the contract can license those to you instead.
Copyright outside the US
Other countries handle this differently. In Serbia, a client who commissions a computer program acquires all rights to exploit it unless the contract says otherwise (Law on Copyright and Related Rights, Art. 95(3)). Whether a site's code counts as a computer program, and who holds the rights in its design and text, is a question for a local lawyer.
Hosting, admin and email logins
The hosting account should be in your business's name and billed to your business. Whoever holds that account controls the site's files and database, and usually its backups.
Some agencies host client sites on their own servers as part of a support plan. That can work, but get in writing how you would receive a full copy of the site (files and database) if you leave, and how quickly.
In the content management system, such as WordPress, you should have your own administrator account under your own email address. A shared login isn't enough. The agency works under a separate user that you can remove when the work ends.
Email runs on the domain's DNS records, which are usually managed at the registrar, the hosting company or a DNS provider. Make sure the email provider account, such as Google Workspace or Microsoft 365, is in your business's name and that you can reach the DNS settings yourself.
For every account, check where the recovery email and two-factor codes go. If they reach a phone or inbox at the agency, you don't fully control the account, even with the password.
Google Analytics, Search Console and Business Profile
Each Google tool has its own ownership model. An agency can keep control of one of them long after it has stopped working on your site.
Google Analytics 4
Your business should own the Analytics account, with the Administrator role on your own Google login. Google describes Administrator as "Full control of Analytics. Can manage users", while an Editor has full control of settings but "Can't manage users". The other roles are Marketer, Analyst, Viewer and None (Google Analytics Help, checked October 2026).
Roles set on an account carry down to its properties. Keep the account under your login, and add the agency as a user you can remove.
If the agency created your property inside its own account, the property can be moved to yours. "All reporting data associated with a property is moved (not copied)", and the move needs Administrator and Editor roles on both the source and destination accounts (Google Analytics Help, checked October 2026).
Google blocks the move if the two accounts belong to different Google Marketing Platform organizations, if the property is linked to Ad Manager, or if the destination account already has 50 properties. Because the move needs roles on the agency's account, the agency has to take part.
Google Search Console
Removing the agency as a user in Search Console isn't enough. A verified owner proves ownership "using a token", such as a DNS TXT record, an HTML file or a meta tag. A delegated owner is added by a verified owner and needs no token.
Google's help is explicit: "to add or remove a verified owner, you must add or remove a token on the site", and "as long as a user's verification token remains for a property, a deleted owner can re-verify ownership" (Search Console Help, checked October 2026).
Verify yourself with your own token first. Then find the agency's tokens, remove them from the DNS records, site files and page code, and only then remove its users.
Google Business Profile
Your business should be the primary owner of its Business Profile. A profile can have several owners but only one primary owner, and "Only the primary owner can transfer primary ownership" (Google Business Profile Help, checked October 2026). A primary owner can't remove themselves until they transfer that role.
Plan for a waiting period. New owners and managers must wait 7 days before they can delete the profile, remove users or transfer primary ownership (Google Business Profile Help, checked October 2026). In practice, the agency adds you as an owner and transfers primary ownership to you, and you remove the agency once that week has passed.
Theme, plugin, font and photo licenses
Ready-made themes, paid plugins, fonts and stock photos come with licenses. The license decides whether you can keep using them after the agency leaves.
Envato's Regular License, used for themes sold on ThemeForest, is a "non-exclusive, worldwide license" for "one single End Product for yourself or for one client" (clauses 1 and 2). The buyer "can transfer that single End Product to your client… This license is then transferred to your client" (clause 4) (Envato Regular License, revised March 11, 2025).
Envato's FAQ adds: "You're essentially buying the file on your client's behalf." At handover, the developer should point the client to the license and "delete the item from your own systems" (Envato License FAQ).
A plugin that the agency runs under its own multi-site or developer license is a different case. That license key normally stays with the agency, so ask which licenses become yours and which you would need to buy if you leave.
Free photo libraries have terms too. Unsplash grants "an irrevocable, nonexclusive, worldwide copyright license… for free" (Unsplash License), so photos used under it don't depend on the agency.
Paid fonts and stock photos are licensed as well. Ask whose name each license is in and get a written list, so you know what you would have to rebuy.
Website handover checklist
Use this table at handover, or on a site you already have. Every item in the right-hand column is something you can check without the agency's help.
| Asset | Whose name it should be in | How to check |
|---|---|---|
| Domain registration | Your business, as registrant | The registrant contact at the registrar shows your legal name and your email |
| Registrar account | Your business | You can log in with your own email and password |
| DNS settings | Your registrar, hosting or DNS provider account | You can see and edit the DNS records |
| Hosting account and billing | Your business | Invoices are addressed to your business and you can log in |
| Full backup | Your business | You hold a recent copy of the files and database outside the agency's systems |
| Site admin account | You, under your own email | You log in as an administrator, separately from the agency's user |
| Email provider account | Your business | The email admin console opens under your login |
| Google Analytics account | Your business's Google login | Your login has the Administrator role on the account |
| Search Console | Your business, as verified owner | Your token is in place and the agency's tokens are gone |
| Google Business Profile | Your business, as primary owner | People and access lists you as primary owner |
| Theme and plugin licenses | Your business, where the license allows | You have a list with license keys or purchase records |
| Fonts and stock photos | Your business, or a license that covers your use | You have a list of sources and their license terms |
| Copyright in custom work | Your business, by signed assignment | A signed document says what is assigned and when |
| Recovery email and two-factor | You | Recovery options point to your phone or inbox |
If the old agency won't cooperate
Start with a short written request that lists exactly what you need: the registrant change or transfer code, hosting access, admin accounts, Google roles and a full backup. A dated email gives you a record if you need to escalate.
For a .com or other generic domain, ICANN's advice is to contact "the individual or entity who registered the domain name to obtain access credentials", and the registrar if that fails. For a change of registrant, "contact the registrar that registered the domain name" (ICANN RDRP FAQs, updated February 21, 2024).
If you are the registrant and the registrar wrongly denies a transfer, you can "submit a formal Transfer Complaint with ICANN", and the registrar must state its reason (ICANN Name Holder FAQs).
If the agency is the registrant, your position is weaker. The warning in the 2017 ICANN blog post applies: recovery can involve legal fees with no guaranteed result. Bring in a lawyer at that point.
For a Business Profile you can't get into, go to business.google.com/add and choose Request access. The current owner "has 3 days to respond". If they don't, you "may have the option to claim" the profile, but "The option to claim a profile isn't always available" (Google Business Profile Help, checked October 2026).
In Search Console, you can become a verified owner with your own token if you control the DNS or the site files. Then remove the agency's tokens and users.
Google Analytics is harder without help, because moving a property needs roles on the agency's account. If the agency won't cooperate, you can start a new property under your own login, and the old reports stay where they are.
For copyright, unpaid invoices or contract disputes, see a lawyer. The answer depends on your contract and your country's law.
What to put in writing before work starts
Settle ownership in the scope document, before any work begins. These are the points worth writing down:
- The domain is registered with your business as registrant, in a registrar account you can log in to.
- Hosting is in your business's name and on your card. If the agency hosts, the contract says how you get a full copy and how quickly.
- You get your own administrator accounts from day one, and the agency works under separate users.
- Analytics, Search Console and Business Profile sit under your Google login, with the agency added as a user.
- Who holds copyright in the custom code, design and text, and from when, for example on final payment.
- Which themes, plugins, fonts and photos are licensed, in whose name, and what renewals cost.
- What the handover includes: logins, a full backup, a list of accounts and licenses, and basic instructions.
At Cokadex, we write ownership, hosting and access into the scope before work starts. Whoever you hire, ask for the same.
Frequently asked questions
Who owns my website, me or my designer?
The domain, hosting and accounts should be in your name. Copyright depends on your contract and country: in the US, the designer generally keeps it unless you have a signed written transfer.
My domain is registered in my designer's name. How do I get it back?
Ask the designer to change the registrant to your business through the registrar, and contact the registrar if that fails. If the designer refuses, talk to a lawyer.
If I leave my agency, do I have to buy the theme and plugins again?
Not if the licenses were bought for your site and passed to you, as Envato's Regular License allows. Plugins on the agency's own multi-site or developer license are different, so ask before you leave.
How do I remove my old agency from Google Analytics, Search Console and Business Profile?
In Analytics, remove its users once your login holds the Administrator role. In Search Console, remove its tokens as well as its users. In Business Profile, become primary owner, then wait out the 7 days.
Where to start with an existing website
If your site is already live, go through the checklist table this month. Start with the domain registration and the hosting account, since everything else depends on them.
To review the rest of the site, see what a website audit checks.
This guide was written by the Cokadex team. We checked every legal statement against the primary sources listed below on 29 October 2026; a lawyer has not reviewed it.
This article is general information, not legal advice. For a contract or a dispute, talk to a lawyer in your country.
Sources
- ICANN, "Good practices for the registration and administration of domain name portfolios, part II", Carlos Alvarez, June 23, 2017. https://www.icann.org/en/blogs/details/good-practices-for-the-registration-and-administration-of-domain-name-portfolios-part-ii-23-6-2017-en
- ICANN, Registration Data Reminder Policy FAQs, updated February 21, 2024. https://www.icann.org/en/contracted-parties/consensus-policies/registration-data-reminder-policy/faqs-domain-name-registrant-contact-information-and-icanns-registration-data-reminder-policy-rdrp-25-02-2012-en
- ICANN, Transfer Policy, updated February 21, 2024. https://www.icann.org/en/contracted-parties/accredited-registrars/resources/domain-name-transfers/policy
- ICANN Board, Approved Resolutions, Regular Meeting, June 7, 2026 (Resolution 2026.06.07.04). https://www.icann.org/en/board-activities-and-meetings/materials/approved-resolutions-regular-meeting-of-the-icann-board-07-06-2026-en
- GNSO, Transfer Policy Review final report presentation. https://gnso.icann.org/sites/default/files/policy/2025/presentation/transfer-policy-review-final-report-13feb15-en.pdf
- ICANN, Name Holder FAQs, checked October 29, 2026. https://www.icann.org/resources/pages/name-holder-faqs-2017-10-10-en
- 17 U.S.C. §101, §201 and §204, Cornell Legal Information Institute, checked October 29, 2026. https://www.law.cornell.edu/uscode/text/17/101 , https://www.law.cornell.edu/uscode/text/17/201 , https://www.law.cornell.edu/uscode/text/17/204
- US Copyright Office, Circular 30, revised August 2024. https://www.copyright.gov/circs/circ30.pdf
- Serbia, Law on Copyright and Related Rights ("Sl. glasnik RS" 104/2009 to 66/2019), Art. 95, via Paragraf. https://www.paragraf.rs/propisi/zakon_o_autorskom_i_srodnim_pravima.html
- Google Analytics Help, user roles and moving a property, checked October 29, 2026. https://support.google.com/analytics/answer/9305587?hl=en , https://support.google.com/analytics/answer/9305872?hl=en
- Search Console Help, owners and users, checked October 29, 2026. https://support.google.com/webmasters/answer/7687615?hl=en
- Google Business Profile Help, owners, managers and requesting access, checked October 29, 2026. https://support.google.com/business/answer/3415281?hl=en , https://support.google.com/business/answer/3403100?hl=en , https://support.google.com/business/answer/4566671?hl=en
- Envato, Regular License, revised March 11, 2025, and License FAQ. https://themeforest.net/licenses/terms/regular , https://themeforest.net/licenses/faq
- Unsplash License, checked October 29, 2026. https://unsplash.com/license