Who controls your domain, hosting and website accounts?
If a former supplier holds the logins, a missed renewal or a changed setting can take your website or email offline. Find out who holds what before you need it.
This guide is for owners of small UK service businesses whose domain, hosting or website was set up by a former agency, freelancer, relative or employee. It explains the separate accounts your website and email depend on, what a public lookup can and can't tell you, how to check each account from your side, and how to give suppliers access without handing over your own. It includes a blank access record, a reachability check and a hypothetical worked example.
It isn't legal advice, and it can't tell you who legally owns a domain.
1. Five roles, not one "owner"
"Who owns the website?" can mean several different things. Keep these roles separate:
- Registrant: the person or organisation the domain is registered to.
- Registrar account: the account at the company you renew the domain through. The registrar's login is separate from your website's login.
- DNS: the settings that send your domain to your website and email. They may be managed at the registrar or somewhere else.
- Hosting: the account where your website's files run.
- Website admin: the login that edits the site.
Your email may have a separate admin account too.
Each role can sit with a different person or company. Whoever controls the domain's settings can change where your website and email point, so it matters who that is.
2. What a public lookup can and can't tell you
A public lookup shows some of the information held about a domain. For .uk domains, Nominet, which runs the .uk registry, says in its registrar guidance on WHOIS that the .uk WHOIS is now end of life and will be phased out over the next year. It provides a newer lookup, RDAP, for end users at rdap.nominet.uk.
What a .uk lookup can help with:
- Which registrar or reseller manages the domain. Nominet lists this as one of the normal uses.
- The registrant's details, but only if the registrant has opted in to showing them. If not, you won't see a name, and that's not a sign anything is wrong.
What a lookup can't do:
- prove who legally owns the domain
- prove who controls the registrar account, DNS, hosting or website
- confirm anyone's identity
Other domain endings, such as .com, are handled through registrars accredited by ICANN. ICANN's page on registrants' benefits and responsibilities says registrants must respond to inquiries from their registrar within fifteen days and keep their registrar account data current. It adds that if the registration renews automatically, payment information must be kept current too. That page is written for ICANN-accredited registrars. .uk domains are managed through Nominet's own registrar arrangements.
3. Check each account from your side
Go through each role and answer, honestly:
- Can someone in the business sign in today? Try it, rather than assuming.
- Who is the recovery contact? The email address or phone number that receives password resets should belong to the business, not to someone who has left.
- When is the renewal due, and who pays? A domain or hosting plan that lapses can take the site or email offline.
- Who gets the renewal reminders? Make sure they reach someone who will act on them.
- Does each supplier use its own login? Or are they using yours?
Use the reachability check in section 7 to record the answers.
4. If the wrong person holds an account
If an account is held under a former supplier's or employee's details, ask the provider about its own process for correcting it. Each provider has its own rules and checks.
- For a domain, start with the registrar. Nominet's contact page points registrants to their registrar first, and links to its lookup tools.
- Keep your requests in writing, with dates, so you have a record.
- Don't assume it's automatic. Paying for a domain, or knowing a password, doesn't by itself settle who owns it. Providers decide based on their own processes.
If someone disputes who should hold an account, get advice before acting.
5. Give suppliers their own access, and end it on time
Rather than sharing your own login, give each supplier their own account with the access they need, where the platform allows it. This makes it clear who did what, and lets you remove one person without changing everything else.
- Remove access when the authorisation ends, whether or not handover is complete. Your business's own authorised admin can preserve content and finish the handover.
- If a limited role genuinely has to continue, give it a recorded scope and an expiry date. Never leave an old admin account open by default.
- Have a second business admin where the platform supports it, so you're not relying on one person.
Our website maintenance checklist covers reviewing who has access as part of routine checks.
6. Keep an access record, without passwords
Write down who holds each role, how to reach it and when it renews. Never write passwords in the record. The record tells you who can get in, not how.
If you're redesigning your site, our website redesign checklist includes recording domain, CMS and hosting access at launch. This record is the fuller version to keep afterwards. DNS also holds your email authentication settings. Our guide to tracing a contact form that isn't sending emails explains why changes there are best left to whoever manages it.
- Copy the blank access card once for each role: registrant, registrar account, DNS, hosting, website admin and email admin.
- Fill in what you know, and write "unknown" where you don't.
- Turn every "unknown" into a next action with an owner.
- Date each card when you check it.
| Field | Your record |
|---|---|
| Role | |
| Provider | |
| Account held by: business, person or supplier | |
| Admins, by role | |
| Recovery email or phone belongs to | |
| Renewal date and who pays | |
| Supplier access: own login? | |
| Checked on |
7. Run the reachability check
| Question | Yes, no or unknown | Next action and owner |
|---|---|---|
| Can someone in the business sign in to the registrar account today? | ||
| Is the recovery email an address the business controls? | ||
| Does the renewal reminder reach someone who will act on it? | ||
| Does the lookup show the registrar you expect? | ||
| Does each supplier use its own login? |
Hypothetical example
Hypothetical example only: an invented dog-grooming business and invented providers. It is not a ScalePass client and not advice about any real domain or account.
The business's website was built by a freelancer whose engagement ended on an agreed date.
| Role | Finding | Next action |
|---|---|---|
| Registrant | Registrar shown; registrant details not shown (not opted in) | Ask the registrar in writing how to confirm the details |
| Registrar account | Held under the freelancer's email | Ask the registrar about its process to move it to the business |
| DNS | Managed at the registrar | Covered by the step above |
| Hosting | Business account; recovery email is a former employee's | Change the recovery email to a business address |
| Website admin | Two admins: the owner and the freelancer | Remove the freelancer's admin now (see below) |
| Email admin | The owner | Record it in the access record |
On the website admin, the freelancer's access is removed when their authorisation ends, whether or not the handover is complete. The owner, as the business's authorised admin, preserves the content and finishes the handover. If a limited role had to continue, the owner would record its scope and expiry date, for example "editor role, content export only, expires on 20 November". The old admin account isn't left open by default. A second business admin is added only if the platform supports it.
This illustrates the method; it isn't a decision about any real account.
8. Check renewals and recovery details regularly
Choose a regular time to check, such as when you review other business subscriptions. Look at renewal dates, recovery contacts and who has admin access. Also check whenever someone who held access leaves, or a supplier changes.
Common questions
My agency registered the domain. Is it mine?
A lookup or a payment record can't settle that on its own. Check with the registrar who the registrant is and how the account is held, and ask about its process for correcting it. If there's a disagreement, get advice.
Why can't I see my name in the lookup?
For .uk domains, Nominet shows registrant details only if the registrant has opted in. Not seeing a name doesn't mean the domain isn't registered to you.
Should my web developer have my registrar password?
It's better to give them their own access where the platform allows it, limited to what they need, and to remove it when their work ends.
What happens if the renewal email goes to someone who's left?
You may not hear about the renewal in time. Update the account's contact and recovery details to business addresses, and note the renewal date in your access record.
ScalePass agrees ownership of accounts, content and access with clients as part of the scope of website work. If you'd like help getting your website accounts clear, see how we approach websites.
In short
Keep five roles separate: registrant, registrar account, DNS, hosting and website admin, plus email. Use a public lookup to see what's public, but don't treat it as proof of ownership or control. For .uk, Nominet points to RDAP. Check that someone in the business can sign in, that recovery contacts are business addresses and that renewals reach someone. Give suppliers their own access and end it when their authorisation ends. Keep an access record without passwords, and check it regularly.