Your business should own the domain, the hosting account and every login connected to your website, each tied to an email address the business controls. Your developer, marketer or IT person gets their own user access, never ownership. Most of the website lockouts we untangle have nothing to do with hackers. They involve a developer who stopped answering emails, a former office manager whose personal Gmail is on the domain record, or a family friend who “set it all up” years ago and kept every password in their head.
Nothing goes wrong until something does: the domain needs renewing, the site goes down, or you want to move to a new designer. Then you find out you don’t control the thing your business depends on.
The fix is simple and a bit tedious. Do the audit below once, write the answers down, and you’re covered for years.
The rule: your business owns it, your suppliers get access
Every account that touches your website should be registered to your business, using an email address your business controls. Your developer, marketer or IT person should be added as a user with their own login, not handed yours, and they should never be the owner of record.
That applies to us too. We register domains on behalf of clients regularly, and when we do, the registrant is the client’s business, with its own name and ABN on the licence, not ours. That’s the right way to do it: we handle the paperwork, you own the name. The client also gets their own logins, so if you ever left, you’d take everything with you. Any supplier who resists that arrangement is telling you something.
The ownership audit
Go through this table with a cup of tea and your laptop. For each row, find out who the owner is and which email address it’s tied to.
| Asset | Who should own it | How to check | Red flag |
|---|---|---|---|
| Domain name | Your business entity, matching your ABN | Look up the registrant name with your registrar or a WHOIS lookup | Registered to your web developer or an old staff member |
| Domain registrar account | You, with your developer added if needed | Can you log in and see the renewal date? | Nobody knows which company it’s registered with |
| DNS | Whoever you choose, but you need a login | Ask: where are the name servers pointed? | DNS sits in an account belonging to a previous agency |
| Hosting | Your business, or a host you have a direct agreement with | Do you receive the hosting invoices? | Hosting is bundled into a developer’s account with no access for you |
| WordPress admin | An administrator account in your name | Log in at yoursite.com.au/wp-admin | You only have an “Editor” login, or none |
| Business email (Microsoft 365 or Google Workspace) | Your business, with a global admin you control | Who is the super admin or global admin? | The only admin is someone who has left |
| Google Business Profile | You as primary owner | Check users in the profile settings | A marketing agency is primary owner |
| Google Analytics and Search Console | You as administrator or owner | Check property access settings | Created under your developer’s Google account |
| Facebook and Instagram | Your Meta business portfolio | Check who has full control | Page admin is a former employee’s personal profile |
| Paid plugin licences (Elementor Pro, backups, forms) | Your business, or covered under a hosting agreement that says so | Ask your developer whose account holds the licence | Licences expire when your developer stops paying |
Write the answers into a single document and store it somewhere safe. That document is worth more than you’d think the day something breaks.
Checking who the domain registrant is
The registrant is the legal holder of the domain licence. For a .com.au, it should be your company, sole trader name or other eligible entity, linked to your ABN or ACN. auDA’s own guidance makes the point that you must stay eligible for the whole licence period and keep your contact details current, or you risk missing renewal notices and even losing the name.
The two things to fix if they’re wrong:
- The registrant name. If it’s your developer’s business, ask them to transfer it to you. This is a registrar process, not a favour, and it’s usually quick.
- The registrant contact email. Renewal reminders and transfer codes go here. If it’s an old staff member’s address, your domain could lapse and you’d never get a warning.
We’ve written more about .com.au domain rules, renewals and the fake invoices that target them.
Where logins should live
A sticky note under the keyboard isn’t a system, and neither is “Sarah knows”. This is the setup we recommend for a small business:
- A shared admin mailbox such as admin@ or accounts@ on your own domain (an easy job during business email setup), used as the login email for website, hosting, domain and Google accounts. When staff change, the mailbox stays.
- A password manager with a shared business vault (1Password, Bitwarden and Keeper all do this). The owner holds the master account. Staff and suppliers get access to only the entries they need.
- Two-factor authentication on everything that offers it, with the authenticator tied to a device the business controls, plus recovery codes saved in the password manager.
- Recovery details that point to the business. Old recovery phone numbers are a common trap. If the backup number on your Google account is a former employee’s mobile, they effectively hold the spare key.
What to ask your developer for
You don’t need to be awkward about this. A good developer will be glad you asked. Copy and adapt this:
Hi [name], I’m doing a tidy-up of our business accounts. Could you please confirm, or send me, the following:
- Which registrar our domain is with, and that it’s registered to [business name, ABN].
- Where our DNS is managed, and a login for us.
- Hosting provider and account details, or an admin login for us.
- An administrator login for WordPress in my name.
- Who holds the licences for Elementor Pro and any other paid plugins, and their renewal dates.
- Owner or admin access to Google Analytics, Search Console and our Google Business Profile.
Thanks. Happy for you to keep your own access, I just need ours on record.
If the reply is vague, or comes back with a fee to “release” your own accounts, that’s the moment to start planning an exit, calmly and before you need one.
When someone leaves
Staff and suppliers leave. Your website shouldn’t notice. Run this list on their last day:
- Remove their user accounts from WordPress, hosting, the registrar, Google and Meta. Don’t share their login with their replacement; create a new one.
- Change any shared passwords they knew, starting with email admin and the domain registrar.
- Check that recovery emails and phone numbers on key accounts don’t belong to them.
- Forward their mailbox to someone else rather than deleting it straight away, so password reset emails and supplier invoices aren’t lost.
- Update your ownership document.
For a supplier, add one more step: get written confirmation of which accounts they held and that everything has been handed back.
Where to start this week
Pick the two rows that would hurt most if they went wrong: the domain registrant and your email admin. Check those today. The rest can wait for a quiet Friday.
Ownership is also part of looking after a site properly, which we cover in what website maintenance involves. If you’re on a subscription website where you don’t own the build at all, our website ownership service explains how to get off it. If a few rows of your audit are still blank after some digging, send us a message with what you’ve found so far. Tracking down a forgotten registrar or Google login is everyday work for us.