Finding Who Controls Your Domain and Website Accounts

This is the only page in this section worth reading before anything has gone wrong. Every other entry ends here, because whether you control the accounts is what decides whether an incident takes an hour or a fortnight.

It takes about twenty minutes and requires no technical knowledge.

The six accounts: domain, hosting, DNS and access control

Account	What it controls	Worst case if you do not hold it
Domain registrar	The name, and where it points	You cannot keep your address
Hosting	The server the site runs on	You cannot move or restore the site
Platform administrator	The content and software	You cannot change your own site
Email or DNS	Where mail is delivered	You cannot recover your mail
Search Console	What search engines did	You lose the history permanently
Analytics	What visitors did	You lose the history permanently

The first is the one that matters most. With the domain you can point the name at a new site built anywhere and keep your address, your email and everything printed on vehicles and invoices. Without it, every recovery ends at a new address.

Check each one yourself: domain name, the WHOIS database lookup and registrar

1. Domain. Look the name up through auDA’s public .au WHOIS database, whose stated purposes include identifying the holder of a domain name licence. Domain administration globally traces back to ICANN, the body that oversees the domain name system; the .au namespace specifically is administered by auDA. Read three fields: the registrant, the registrar, and the expiry date. The registrant should be your legal entity, matching the ACN or business registration you trade under.

2. Hosting. Find a hosting invoice. Whose name and card is on it? If you have never seen one, hosting is being paid by somebody else, and that is the answer.

3. Platform administrator. Log in. Then look at the user list and read it — how many administrator accounts exist, and whose. Former staff and former suppliers are routinely still there years later.

4. Email or DNS. Where is your mail actually hosted, and who administers it? Frequently a different party from the website, and frequently nobody knows which.

5 and 6. Measurement accounts. Whose login are they verified under? If the answer is a supplier’s personal account, the history is not portable and cannot be recovered later — a new account starts from the day it is created. That is on the search console account.

What domain control and ownership actually mean: who owns it, versus who controls it

Three levels, and they are routinely confused.

Owner — can add and remove everyone else, including you. Should be the business.

Administrator or manager — can do the work but not remove the owner. This is what a supplier should have.

Contact — receives notifications. Your web designer sitting in a contact field is normal and often sensible.

The distinction on a domain is the important one. Your supplier as a technical contact is fine; your supplier as the registrant is not. The registrant is the licence holder, and a change of registrant is a change of the licence itself. The rules are on Australian domain eligibility.

Fixing what you find across your domains, while the relationship is good

Every correction here is easy with a co-operative supplier and hard without one, which is the whole argument for doing it now rather than during a dispute.

1. Move ownership to a business-controlled login, not an individual’s personal address. A role address on your own domain, with more than one person able to reach it.
2. Add the supplier as a manager, not an owner.
3. Remove accounts belonging to people who have left.
4. Turn on two-factor authentication, starting with the domain registrar.
5. Set renewals to a payment method that will not expire, with notices going to an inbox the business reads.
6. Write it down. One page listing each account, the provider, the login address and who holds it. Update it when a supplier changes.

Step 6 sounds trivial and is the one that pays. During an incident, that difference matters a lot. “The website is broken” versus “the domain is with this registrar, under this entity, and the expiry was last month” is a day of billed diagnosis.

The conversation to have with a supplier

Ask three questions, and ask them in writing:

• Which accounts relating to our website are held under your name or your login?
• Will you transfer ownership to us, with your access retained as a manager?
• What is in the handover if we ever part ways?

A supplier with nothing to hide answers all three quickly, and many will have set it up correctly already. Reluctance is itself the finding, and it is worth knowing now rather than later. What a contract should have covered is on what a contract should cover. The wider ownership position — code, content and domain, which are three separate things — is on who owns your website.

What this does not settle

Access is not ownership. Holding the login to a platform does not determine who owns the copyright in the design and code, which under the Copyright Act 1968 generally remains with the person who created it unless it has been assigned in writing.

The two questions are related and separate, and a business can hold every account and still not own the site’s design. Both are worth settling, and they are settled in different documents.

What to do next

Do the six checks today. Most take under three minutes and the domain lookup takes one. If any answer is “I do not know” or “the person who built it”, that is this week’s task. It is worth more than any other improvement to the website itself. Where account handover sits among the things a build is supposed to deliver is on what a website design company actually is.