Who holds the hosting account

A hosting account can take a site, and every email address on its domain, entirely offline with a single cancellation, missed payment, or dispute. Whoever holds that account — not whoever built the site, and not whoever currently edits its content — controls whether it continues to exist at all, and checking who that actually is takes about five minutes.

Why the hosting account is a separate question from CMS access

A CMS login lets someone edit content. It says nothing about who can cancel the hosting plan, change the payment method, or delete the account entirely — those actions happen at the hosting provider’s own account level, one layer beneath the website itself. Who can edit the site after launch covers the content layer; this page is about the infrastructure layer underneath it, which is a materially higher-stakes account to lose control of.

The common pattern that creates the risk

A web designer or developer sets up hosting during the build, under their own account, because it is the simplest way to get the project moving quickly. This is common and not inherently a problem while the working relationship is good. It becomes a problem the moment the relationship ends, because the business’s website is now sitting inside an account it does not control, billed to a card it does not hold, and the supplier — not the business — decides whether it keeps running.

What to actually check about hosting account ownership and access

Whose name and payment details are on the hosting account, and whether that party is the business itself or a third party acting on its behalf. Whether the business has its own administrator access to the hosting control panel, independent of any developer’s own account, or whether access runs entirely through someone else’s credentials. And whether the domain name and the hosting account are held by the same party or split between two — a split that is not automatically a problem, provided both are documented and the business genuinely controls, or can readily reach, both.

Why this connects directly to the domain question

Who owns your business domain covers the equivalent question for the domain licence itself, and the two are frequently, though not always, held by the same party. A business should be able to state clearly who holds each of: the domain registration, the hosting account, the CMS admin login, and the DNS management panel — four separate things that can each independently end up in a different party’s hands.

What to do if a supplier currently holds the hosting account

Ask for the hosting account to be transferred into the business’s own name, or for the business to be given its own account with full administrative control, in writing, while the relationship is functioning well. Most suppliers cooperate without resistance, because there is rarely a legitimate ongoing reason for a business’s hosting to remain in someone else’s name once the point is raised directly.

Why this is worth revisiting at every supplier change

Each time a business changes web developer, agency or maintenance provider, the hosting account question should be asked again explicitly, because access arrangements from a previous relationship do not automatically update themselves when a new one begins, and an old contact can be quietly left holding access nobody remembers to remove.

What to do if a supplier relationship has already ended badly

Where cooperation is not forthcoming, contacting the hosting provider directly, with evidence of the business’s own identity and its relationship to the domain and site in question, is the next step — most reputable hosts have a process for resolving exactly this kind of dispute, though it is slower and more effortful than a cooperative handover would have been.

A note for businesses with more than one owner

Where a business has more than one owner or director, agreeing which of them is the named contact on the hosting account, and ensuring at least one other has genuine emergency access, prevents the account becoming inaccessible if that one person is unexpectedly unavailable.

Why two-factor authentication matters especially here

Because this single account can take down the entire site, enabling two-factor authentication on it specifically, even where it is not yet standard practice elsewhere in the business, is one of the highest-value individual security steps available — covered in full in two-factor authentication on the accounts that matter.

Documenting the answer, not just knowing it

An answer that exists only in one person’s head is not a resilient answer — writing down which account holds the hosting, who has login access, and where the payment method is registered means the business, not one individual, genuinely controls the information.

The single hosting provider question worth asking today

“If I logged into my hosting provider’s website right now, would I get in?” A confident yes is worth confirming occasionally; any hesitation in answering is the signal that this page exists to address. The registrar holding your domain name is worth the same confidence check — see who owns your website for that side of it.

Where to go from here

The fuller picture of what else can end up controlled by a different party once a build finishes — copyright, source files, the domain itself — is set out in who owns your website. And confirming this is settled correctly from the outset is exactly what a considered engagement with a supplier should include — see website design services.