The worst calls we get open the same way: the developer stopped answering and the domain is in his name. The ownership list, how to check it in twenty minutes, and what to do when it has already gone wrong.
The worst calls we get open the same way. The site is down, or needs one small change, and the person who built it has stopped answering. Then the real problem surfaces: the domain is registered in his name, the hosting sits on his card, and the analytics live in an account nobody else has ever logged into.
Rebuilding a website is a project with a price and an end date. Recovering a domain that somebody else owns is a legal process with neither. The distance between those two facts is why this list matters more than any design decision you will make this year.
Look up who is listed as the registrant of your domain. Find out which inbox receives the renewal notices. Then try to sign in to every account on the list above without asking anybody for help.
That last step is the entire test. If you have to ask somebody for a password, you do not own it yet — you have been granted use of it, which is a different thing and lasts exactly as long as the relationship does.
Nobody sets out to hand over their domain. It goes in one of three ordinary moments.
The first week. Somebody needs a domain today, a card is nearer than yours, and the account gets made in thirty seconds. Everything that follows is built on that thirty seconds, and it is invisible until the day it matters.
An emergency. The site is down on a Friday, a developer asks for access to fix it, and access gets granted the fastest way possible — a shared login, a new administrator, an account created on their side. The fire gets put out and nobody revisits the arrangement, because revisiting it feels like an accusation.
A trial that became production. A tool was tested on somebody's personal account, it worked, and the business quietly started depending on it. This is how companies discover that their analytics history, their invoices or their booking system belongs to a former employee.
All three are fixable in an afternoon while the relationship is good, and expensive the moment it is not. That asymmetry is the whole argument for doing it now.
One document. Every account, who owns it, who else has access, at what level, and how to revoke that access. The repository transferred to your organisation. And the step almost everybody skips: one backup that you have restored yourself, once, while the people who built it are still available to answer questions. An untested backup is a rumour.
Agencies hold access for reasons that are not sinister. Support is impossible without it, clients lose passwords, and someone has to be able to act at two in the morning when the payment provider changes something. The answer is not to take everything away — it is to get the shape right: you own, they are granted, and grants can be withdrawn without breaking anything.
There is a simple test for whether the shape is right. If revoking a studio's access would take your site down, the arrangement is wrong, no matter how good the relationship is. Good relationships end for ordinary reasons — someone retires, someone sells, someone changes career — and the arrangement has to survive that.
Order matters, because everything is recoverable except the thing most people try to save last.
Start with the domain. Registrars have dispute and transfer processes, and they respond to documented evidence: invoices showing you paid for it, correspondence, your company name or trademark. Then DNS and email, because those affect the people currently trying to pay you. The website itself comes last — it is the only item on the list you can rebuild from scratch.
And the uncomfortable advice: when someone is holding an asset and the price of getting it back is lower than the cost of losing it, pay, take the asset, and move everything the same week. Then never hold anything in another party's name again. Principle is worth less than your domain.
You do not need a lawyer to close most of this gap. Three plain requirements, agreed in writing before work starts, cover the expensive cases:
Any supplier worth hiring will sign all three without a discussion. The reaction to being asked is itself information, and it arrives before you have paid anybody.
We create accounts in the client's name from the first week, hand over keys as routine rather than as a favour, and build on ordinary infrastructure — a plain database, plain files, documented interfaces — that can be hosted anywhere by anyone competent.
That position is not generosity; it is experience. We moved our own platform over a weekend when a vendor we depended on stopped existing, and the exercise settled the question internally: leaving has to be possible for staying to mean anything. A studio that keeps clients by making departure expensive is not keeping them. It is holding them, and everybody involved knows the difference.
If there is something on that list you cannot log into right now, that is this week's task, not next quarter's.