The short answer
Your business should be the owner, or the primary owner, of every account that matters: domain registrar, hosting, DNS, email, Google Analytics, Search Console, Google Business Profile and ad accounts. Agencies and freelancers should be added as users. Go through the table below, write down who the account holder is, and fix any that point to a person who might leave.
Why this is the most valuable hour you will spend
A website is not one thing. It is a chain of separate services, each with its own login, bill and owner: a domain name, a host that stores the files, DNS records that connect them, an email service, and a set of Google tools that measure and promote the site. If any link is held by someone who is not you, then your control of the rest is conditional.
The usual failure is not theft. It is drift. A designer registers the domain with their own email because it was convenient. An employee sets up the ad account on a personal card. A colleague creates the Business Profile and then leaves. Nobody did anything wrong at the time. Years later, a renewal email goes to a dead mailbox, the domain expires, and the business has to buy back its own name.
The rule to aim for is simple: the business is the owner, people are users. Where a service has an owner role, an authorized person from your company holds it. Where it has a billing contact, it is a shared company mailbox such as accounts@ rather than a person's name.
The ownership audit table
Copy this into a spreadsheet. For each row, find out who holds the account today and fill in the last two columns. Do not guess. Look at the actual account or the invoice.
| Account | What it controls | Who should hold it | How to find out who holds it |
|---|---|---|---|
| Domain registrar | Your domain name. Whoever controls it can point your name anywhere or let it expire | Your business, with a company email and billing | Look in your email for renewal or invoice messages. See domain renewal and expiry |
| Hosting | The server that stores your website files and database | Your business, or a hosting account clearly under your control | Check hosting invoices and welcome emails for the billed name. See hosting questions |
| DNS | The records that send visitors to your site and mail to your inbox. See what is DNS | Your business, or an account you can log in to | Ask where the nameservers point. The registrar or a service like a CDN may host it |
| Email service | Your business mailboxes and every password reset | Your business, with at least two administrators | Look in the admin console of your email provider. See email and your domain |
| Google Analytics | Your traffic data and conversions | Your business as Administrator | In Analytics, open Admin, then Account access management. Check who has the Administrator role |
| Search Console | Your search data and indexing tools | Your business as an Owner | In Search Console, open Settings, then Users and permissions |
| Google Business Profile | Your local listing, reviews and map pin | Your business as primary owner | Open Business Profile settings, then People and access |
| Ad accounts | Paid campaigns, billing and audience data | Your business, billed to a company card | Check who is the account admin and whose card is charged |
| Website admin | Content, plugins, users | Your business has at least one Administrator | Check Users in the dashboard. See add or remove a user |
| Social pages | Brand profiles and followers | Your business pages, with your admins | Check page roles on each platform |
| Password manager | Shared logins and recovery notes | Your business account | Check who administers the shared vault |
What owner means in the Google tools
Google's help pages spell out the roles, and they matter because the person with the top role controls everyone else.
In Search Console, an Owner has full control, can add and remove users and change settings. Full and restricted users have view access with some actions. Owners come in two types: verified owners prove ownership with a token on the site, and delegated owners are granted ownership by another owner. Google says that when you remove a verified owner you should also remove their leftover verification tokens, or they can re-verify later.
In Google Analytics 4, the Administrator role has full control, including managing users. Editor can change property settings but not manage users. Roles can be set at account or property level, and a role given at the account level is inherited by every property under it.
In Google Business Profile, owners have full control and can add or remove users. Managers have most of the same access but cannot add or remove users or remove the profile. A profile can have several owners but one primary owner, and a primary owner must transfer primary ownership before removing themselves. For a new owner or manager, Google restricts some sensitive actions for the first seven days.
The point of that last rule: if an unknown person is suddenly an owner of your profile, you have days, not minutes, to notice and respond. Check People and access once a quarter.
How to fix an account that is not yours
Our guide on how to move or transfer a domain explains what a transfer involves.
- 1Start with the registrar, because the domain is the one thing you cannot rebuild. Find out the account holder and the email. If it is a former agency, freelancer or employee, ask them in writing to transfer the account or the domain to your company.
- 2Create the account the business should own, using a company email address that more than one person can read, plus two-factor sign-in.
- 3Transfer or add. For Google tools, an existing owner adds your company's Google account as an Owner or Administrator, and you then remove the old person. For domains and hosting, the process is a transfer, or a change of account holder, depending on the provider.
- 4Update the billing contact to a shared company address and a company card, so renewals do not depend on one person.
- 5Add two administrators on every service. One person on holiday or off sick should not stop you getting in.
- 6Record the result in a single sheet: account, owner, billing email, second admin, date checked. Review it every quarter.
What to ask any agency, ours included
A good agency should be able to answer these without hesitation, and you are entitled to ask them of anyone who touches your site, including us.
With Webtec, who owns what, what happens to accounts, code and content if a plan ends, and how a handover works are all written in your proposal. If you have not checked that section recently, read it, and ask your project manager if anything is unclear. We will not describe those terms from memory in a support article, because the proposal is the document that binds both sides.
- Will the domain, hosting and Google accounts be registered in my business's name, with me as owner?
- Will you work as a user on those accounts rather than holding them yourself?
- Whose card or email is on each billing record?
- What access do you need, at what level, and when will it be removed?
- If we stop working together, how do I get everything I need, and how long does a handover take?
- Where are backups kept, and can I access them without you?
- Who at your agency can reach my accounts, and do they each have their own login?
Example: The domain that expired quietly
A family-run garden centre has used the same web designer since 2017. The designer registered the domain under their own email. When the designer retires, renewal reminders go to an inbox that is no longer checked. The domain lapses on a quiet January weekend. The site goes dark, email stops, and the Business Profile link breaks. The centre eventually recovers the name, but only after paying a third party, losing two weeks of enquiries, and a lot of stress. A half-hour audit in 2020 would have shown the domain was not theirs. They would have asked for a transfer, and the whole thing would never have happened.
When to ask us
Ask us if you do not know who holds one of the accounts above, if you suspect it sits with a previous provider, or if you want a hand reading the audit results and planning transfers.
Send a request through the support form with: your domain name, which accounts you have found and which you could not, any names or emails that appear as account holders, and screenshots of the relevant settings pages shared as a Google Drive or Loom link. Do not send any passwords or authentication codes. Our team can often work out who holds a domain or where DNS is hosted without any login. For anything about what we hold or do on your behalf, your project manager will point you to the proposal.
