Most business owners think of "the website" as one thing they either own or don't. It is actually three, and they can be held by three different parties. The distinction only becomes urgent at the worst possible moment: when you want to change provider, when a supplier stops responding, or when a renewal is missed. This guide explains the three parts, why the domain matters most, how to check all three in about ten minutes, the ownership situations that come up most often and what each means, what to ask for if you do not control everything, how to set up a new project so the question never arises, and the mistakes that leave a business locked out of its own site.
The three parts, and why they are separate
- The domain name. Your address on the web. It is registered to a named legal owner, and renewed annually.
- The hosting account. The server space the site sits on, under someone's account with a hosting provider.
- The site files. The pages, design, images and any database behind them.
You can own all three, some of them, or none. Owning the files is little use if you cannot point a domain at them. Owning the domain is little use if the only copy of the site sits in an account you cannot access.
What each part controls
| Part | Who is "the owner" | What it controls | If someone else holds it | How hard to replace |
|---|---|---|---|---|
| Domain name | The registrant recorded at the registrar | The web address, every email address on it, search history, printed materials | They can let it lapse, move it, or point it elsewhere; you cannot stop them | Very hard; a new domain means new email and lost rankings |
| Hosting account | The account holder at the hosting provider | Where the site and mailboxes live, backups, who has access | They can suspend, delete or lock you out; you depend on their cooperation | Moderate; a new account is easy, moving the site needs a backup |
| Site files and database | Whoever holds a copy, and whoever the contract says owns the work | The ability to move, change or rebuild the site | You may need to rebuild from scratch | Moderate; a small site can be rebuilt, content can be copied from the live pages |
| Also check: email | The hosting or email provider account holder | Mailboxes and stored messages | Email history vanishes with the account | Hard; stored messages cannot be recreated |
| Also check: third-party accounts | Whoever created them | Analytics, business profile, search console, payment gateway | Data and verification stay with them | Easy to recreate, but history is lost |
The domain is the one that matters most
If you have time to check only one thing, check this. The domain is what customers type, what your email addresses depend on, and what your search rankings are attached to. Whoever is named as the registrant controls it.
A common and entirely avoidable situation: an agency registers the domain under their own account as a convenience during the project. Years later the business wants to move, and the domain — along with every email address on it — is not theirs to take.
A typical version of this: a shop's first website is built in 2019, and the developer registers the .com.my domain under his own personal account "to keep things simple" during the build. Four years later the business wants a redesign from a different vendor, the original developer has stopped replying to calls, and the new quote stalls because nobody can produce a registrar login for the name printed on the shop's signboard. Nothing about this is technically hard to fix — it is a registrant-change request — but it only turns into weeks of delay and a stalled project because nobody checked who the registrant was on day one.
How to check, in about ten minutes
- The domain. Look up your domain in a public WHOIS lookup and read the registrant name and administrative contact. It should be your business, and the contact email should be one you can access. If privacy protection is enabled the details may be masked — in that case, log in to the registrar account and confirm from inside.
- The hosting. Do you have a login to the hosting control panel, in your own name? Not a login your developer shares with you when asked — your own.
- The files. Do you have a copy of the website somewhere you control, or does the only copy live on the server?
Three yeses means you are fine. Any no is worth fixing now, calmly, rather than during a dispute.
The situations that come up most often
| Situation | What it means | What to do |
|---|---|---|
| Domain in the agency's name, "managed for you" | They own it; you use it at their discretion | Ask for the registrant to be changed to your business, or for a transfer to your own registrar account |
| Domain in a former employee's personal name | A person who may have left controls your address | Contact them for a registrant change; if unreachable, the registrar's process with your business documents |
| Domain in your name, renewal email goes to the developer | You own it but will not hear when it is about to expire | Change the contact email to one you check; switch on auto-renew |
| Hosting on the agency's reseller account | Your site is one folder in their account; no login of your own | Ask for a full backup and move to hosting in your own name, or ask for your own cPanel login if they offer one |
| Site on a builder platform in the agency's account | The site may not be exportable, and the account is theirs | Ask for the account to be transferred, and export what the platform allows |
| You paid for the site but the contract says nothing about ownership | Ownership of the work may be unclear | Ask for written confirmation that you own the finished site and are entitled to the files |
| Everything in your name, but no backup anywhere | You own it and can lose it in one incident | Download a full account backup today; see the backup guide |
| Site built on a DIY platform (Wix, Shopify and similar) under the agency's own account | Export options are limited by the platform, and the account itself belongs to them, not you | Check what the platform allows you to export before anything else, then ask for the account itself to be transferred into your name |
Why the renewal email address matters
Domains expire. The warning notices go to the administrative contact on record. If that is a former developer's address, or an email nobody checks, the first sign of a problem is the website and all your email going down at once. Recovery after expiry is possible but time-limited and sometimes expensive. Point renewal notices at an address someone actually reads. Our guide to what happens when a domain expires covers the grace period and what it costs to recover.
What to do if you do not control everything
Ask, plainly and early. Most suppliers will transfer ownership without argument — it is often just how the project was set up rather than anything deliberate. Ask for the domain to be transferred into your own registrar account, ask for your own hosting login, and ask for a copy of the site files.
Do this while the relationship is good. Requests like these are straightforward between people who are getting along, and much harder once there is a disagreement about an invoice. If the supplier has already stopped responding, our guide to what to do when a web designer disappears covers recovery; if you are leaving on good terms, moving away from an agency gives the orderly sequence.
If the supplier will not cooperate
Most of the time, asking in writing is enough. When it is not, the fallback depends on which of the three pieces is stuck.
- Domain disputes. A .com, .net or other generic domain registered in someone else's name can be challenged through ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP) if you can show prior rights to the business name. A .com.my or other Malaysian domain goes through MYNIC's own dispute process instead. Both exist and both work, but both take weeks and cost money — which is exactly why checking the registrant on day one is so much cheaper than disputing it later.
- Hosting access. If a provider will not hand over a login or a backup, put the request in writing and reference the project the account was originally set up for. Most hosts will act on a clear, documented request from the paying customer, even where a middleman originally created the account.
- Site files. With no backup and no cooperation, a simple brochure site can usually be rebuilt from what is visible on the live pages. A site with a database behind it — bookings, memberships, a store — is harder to recreate from scratch and worth a professional opinion before you assume the content is lost for good.
The handover request, in one message
- Confirm the domain registrant is our business name, or change it to that, and transfer the domain to a registrar account in our name.
- Point the domain's contact and renewal emails to an address we control.
- Provide a hosting control panel login in our name, or a full account backup if the hosting is yours.
- Provide a complete copy of the site files and database.
- Provide an administrator login to the CMS in our name.
- List any licences, third-party accounts and email mailboxes, and transfer them to us where possible.
Six lines, sent once, with a reasonable date. The reply tells you where you stand.
Getting it right from the start
On a new project, agree three things in writing before work begins: the domain will be registered in the business's name, you will have your own hosting account access, and you will receive a copy of the files on completion. None of these are unusual requests, and a supplier who resists any of them has told you something useful. Our list of questions to ask a web design company puts them alongside the others worth asking.
Put it in the signed quote itself, not just a verbal assurance — one line is enough: "the domain is registered to [business name], hosting access and a full copy of the files are provided to the client on completion." A supplier with nothing to hide signs that line without a second thought.
Common mistakes
- Assuming payment equals ownership. It does not, unless the agreement says so.
- Letting the agency register the domain "to keep it simple". Simple for them; a problem for you later.
- Treating a shared password as access. Access is an account in your own name.
- Never checking the renewal contact. The domain expires and nobody told you.
- Leaving the only copy on the server. One suspended account and the site is gone.
- Waiting until there is a dispute. Everything is easier while the relationship is good.
- Forgetting email and third-party accounts. Mailboxes and analytics history are owned too.
Where Gotka Technologies fits
Gotka Technologies has provided hosting and domains in Malaysia since 2004. Domains from RM10/year are registered in your name, with domain lock and privacy protection available, and full ownership. Hosting from RM17.80/month comes with your own cPanel login, daily backups and free SSL.
If your site is currently held in someone else's account and you want it moved, migration is free and our team handles the transfer, and domain transfers in are free with the domain registered to you.
Key terms used in this guide
- Registrant: the person or company recorded as the legal owner of a domain.
- Registrar: the company a domain is registered through, which holds the account it sits in.
- Administrative contact: the email address on the domain record that receives renewal and transfer notices.
- WHOIS lookup: a public query that shows a domain's registrar, registrant and expiry date.
- Privacy protection: a registrar service that hides the registrant's details from public lookup.
- Reseller account: a hosting account that holds many client sites under one provider login.
- Full account backup: a single archive of a hosting account's files, databases and email.
- Domain lock: a registrar setting that blocks transfers until the account holder switches it off.
- Handover: the transfer of files, logins, licences and accounts from a supplier to the owner.
- UDRP: the Uniform Domain-Name Dispute-Resolution Policy, an ICANN process for contesting who a generic (.com, .net) domain is registered to.
How do I find out who owns my domain name?
Look your domain up in a public WHOIS service and read the registrant name and administrative contact. That name is the legal owner. If privacy protection is switched on the details may be hidden, in which case log in to the registrar account directly and confirm from inside. If you cannot log in at all, that is itself the answer to the question.
My web designer registered my domain. Is that a problem?
It depends entirely on whose name it is registered in. If it was registered on your behalf with your business as the registrant, that is normal and fine. If it is registered under the designer's own name or company, they legally control it, and you would need their cooperation to move it or even keep it. Check, and if needed ask for it to be transferred to you.
What happens if nobody renews my domain?
The domain expires and your website and any email addresses using it stop working, usually without warning to you if the renewal notices go to someone else. There is normally a grace period in which it can be recovered, sometimes at a higher fee, but after that it can be registered by anyone. Make sure renewal notices reach an address you personally check.
Do I own my website if someone else built it?
Not automatically — it depends what was agreed. Payment for a project does not always transfer ownership of the files by default, which is why it is worth stating in writing that you own the finished site and are entitled to a copy of the files. Ask at the start of a project; it is a normal request and easy to agree to before work begins.
Should I have my own hosting login?
Yes. Your own account, in your own name, not a shared password handed over when you ask. It means you can grant and revoke access to whoever works on the site, you can see what is running, and you are never in a position where one person's cooperation is the only route to your own business's website.
What if my site is on a website builder in the agency's account?
Two things need checking: whether the platform lets the site be exported in a usable form, and whether the account itself can be transferred to you. Some builders allow a full export, others only the text and images, and some none at all. Ask the agency to transfer the account, export whatever the platform allows, and above all confirm the domain is in your name, since that survives any platform.
How do I take control of a website someone else is holding?
Ask directly, and ask while the relationship is still good. Request the domain be transferred to a registrar account in your name, request your own hosting login, and request a copy of the site files. Most suppliers agree without any fuss. If you meet resistance, the domain is the priority — it is the piece that is hardest to replace.
What a Clinic or Dental Practice Website Actually Needs
Services, doctors, hours, location and a way to book — clearly on a phone. What a clinic or dental practice website needs, and what to be careful about.
Web DesignWhat a Restaurant or Café Website Actually Needs in Malaysia
Menu, hours, location and a phone number, all readable on a phone in seconds. What a restaurant or café website in Malaysia actually needs, and what to skip.
Web DesignCopywriting vs Design: Which Actually Moves the Needle on Conversions
Copywriting vs design: which actually drives enquiries? Clear, specific copy usually does more work than polished layout alone — and together they do most.