You paid the invoice. The site went live. It works. Then one of three things happens: you want to move to faster hosting, your agency stops replying to email, or you go to sell the business and the buyer’s solicitor asks for proof you own your own website.
That is usually the moment people discover what “yours” actually meant.
Here is the uncomfortable part, stated plainly: paying for a website does not, by itself, transfer ownership of it. Not in the United States, not in the United Kingdom. Ownership transfers when somebody writes it down. If nobody wrote it down, the default rules apply — and the default rules do not favour you.
This is not an argument that agencies are villains. Most lock-in is not malice; it is a contract that nobody bothered to write, plus a hosting arrangement that was genuinely convenient at the time. The problem is the absence of a written exit, not the arrangement itself. But the absence costs you the day you need to leave.
Below is a twelve-point audit you can run this afternoon. Every check tells you what to look at, how to look at it, and what a bad answer looks like.
The default nobody explains: paying for it is not owning it
In the US, the developer owns the copyright unless you have it in writing
Americans tend to assume a commissioned website is “work made for hire” and therefore theirs. It almost certainly is not.
Under US law, work made for hire arises in only two situations: work created by an employee within the scope of their employment, or a specially commissioned work that falls into one of nine enumerated categories. Those categories are a contribution to a collective work, part of a motion picture or audiovisual work, a translation, a supplementary work, a compilation, an instructional text, a test, answer material for a test, and an atlas.
A website is not on that list. Neither is software.
The US Copyright Office is explicit that for a commissioned work the parties “must expressly agree that the work is to be considered a work made for hire,” that the agreement “must be signed by all parties,” and that if a commissioned work “fails to satisfy any of these requirements, it is not a work made for hire.” (Circular 30, US Copyright Office)
The practical consequence matters more than the legal theory. What you want in your contract is not a work-for-hire clause — that clause does not even work for websites. What you want is an assignment of copyright, in writing, signed, ideally taking effect on final payment.
In the UK, the same trap with different wording
Section 11 of the Copyright, Designs and Patents Act 1988 says the author of a work is the first owner of the copyright in it. There is an exception where a work is made by an employee in the course of employment, in which case the employer is first owner “subject to any agreement to the contrary.” (CDPA 1988, s.11)
A contractor is not an employee. So a freelancer or agency you commission keeps the copyright unless they assign it to you in writing. Commissioning something and paying for it does not move the copyright on its own.
The three layers people confuse
Nearly every ownership dispute is really a confusion between three separate things:
- Legal ownership — who holds the copyright in the code and design. Governed by your contract.
- Account control — who can actually log in to the domain registrar, the host, the CMS, the repository. Governed by whoever has the password.
- Licensed components — themes, plugins, fonts, stock photography and SaaS subscriptions that neither of you owns outright, and which may be licensed in the agency’s name.
Most people who feel trapped are trapped at layer two, not layer one. That is good news, because layer two is the layer you can fix in an afternoon.
The 12-point ownership audit
1. The domain — are you the registrant?
Start here, because this is where you have the most leverage. Look up your domain at lookup.icann.org and find the registrant organisation.
Note that WHOIS was formally sunset on 28 January 2025 and replaced by RDAP, which is what the ICANN lookup tool now uses. (ICANN announcement) If your current supplier still tells you to “run a WHOIS,” that is a small but telling sign.
Bad answer: the registrant is your agency’s company name. Being listed as the administrative contact is not the same as being the registrant.
2. The registrar account — can you log in yourself?
Being the registrant on paper while your agency holds the only login is still lock-in. You want your own account, at a registrar you chose, with billing on your card.
3. DNS — where do the records actually live?
DNS is separate from registration. Your domain might be registered in your name while the nameservers point at infrastructure only your agency can edit. If you cannot change an MX record without asking permission, you do not control your email either.
4. Hosting — whose account is it?
Ask directly: is the hosting account in my company’s name and billed to my card, or is my site a sub-account on the agency’s reseller plan? The second is extremely common and it is the single most effective form of lock-in, because moving requires their cooperation.
5. Administrator access to the CMS
On WordPress, log in and go to Users. Check two things. First, that your own account role is Administrator and not Editor — Editors cannot install plugins, change themes or manage users, and the difference is easy to miss. Second, look at every other account listed and confirm you recognise it. Old contractor accounts with admin rights are both an ownership problem and a security problem. This applies to any WordPress or WooCommerce build.
6. The source code and the repository
For anything custom, ask who owns the Git repository and whether you have access to it. A common arrangement is that the code lives in the agency’s GitHub organisation, which means that if the relationship ends, your version history ends with it.
A note on WordPress specifically, because this point is routinely overstated. WordPress is released under the GPLv2 or later (wordpress.org/about/license), and themes and plugins that derive from it inherit that licence. That means the code can be moved, modified and re-hosted freely. It does not mean you have the files, the credentials or the database. Licence freedom and possession are different things.
7. The database, and a backup you can actually restore
Your content, your customers and your orders live in the database, not in the theme. Ask for a current export and — this is the part people skip — confirm you could restore it somewhere else without the agency’s help. A backup you cannot restore independently is not a backup.
8. Design files and licences
You want the layered source files in an editable format, not flattened exports. Then check the licensing on fonts and stock imagery. If a font licence or an image licence was purchased in the agency’s name, it may not travel with the site, and you can inherit a rights problem without knowing it.
9. Your online store
Stores add their own ownership layer. On Shopify, a store built by a partner and then transferred means, in Shopify’s words, that “the merchant owns the store and it leaves your organization.” Worth knowing before the handover: prior to transfer only free and partner-friendly apps can be installed and real transactions are not supported, and after transfer the store “isn’t eligible for promotions or free trials.” (Shopify Help Center)
Separately, your payment gateway and merchant accounts are their own assets. They should be in your business’s name, tied to your bank account, with you as the account owner. If you are planning or reviewing an ecommerce build, settle this before launch rather than after.
10. Your mobile app’s developer accounts
This is the one that catches people hardest, because some of it is genuinely irreversible.
If your app was published under your agency’s Apple or Google developer account, transferring it later comes with real constraints. Apple requires that the app has had at least one version released, that it is not on pre-order, and that it is not in Processing for Distribution, Waiting for Review, In Review, Accepted, Pending Developer Release or Pending Apple Release. Apple Arcade apps cannot be transferred at all. (Apple, App transfer criteria)
And some things simply do not survive the move. The Apple Pay merchant ID is not transferred and the recipient must create a new one. Sign in with Apple requires the transferring party to generate transfer identifiers for every user in their database beforehand. TestFlight builds and testers must be removed first, and Wallet passes must be reissued with new identifiers. (Apple, Overview of app transfer)
“We’ll just publish it under our account for now” is not a convenience. It is a cost you pay later, and occasionally one you cannot pay at all. Anyone commissioning mobile app development should insist on their own developer accounts from day one.
11. Third-party and marketing accounts
Google Business Profile, Search Console, Analytics, Tag Manager, ad accounts, and any email or DNS records tied to them. These are frequently created under an agency email address and then forgotten. Check that you are listed as an owner rather than a manager — owners can add and remove users and delete the profile; managers cannot.
12. Integrations and API keys for custom tools
If you have a portal, a CRM or an internal tool, ask whose API keys the integrations use, whose server the environment variables live on, and what happens to those keys if the agency’s accounts close. A custom software build can be fully yours in code and still be unusable if the credentials it depends on are not.
What to do if you are already locked out
Start with the domain — you have more leverage than you think
Under ICANN’s Transfer Policy, registrars “must provide the Registered Name Holder with the unique ‘AuthInfo’ code and remove the ‘ClientTransferProhibited’ within five (5) calendar days of the Registered Name Holder’s initial request.”
More usefully, the same policy states that a registrar “must not refuse to remove the ‘ClientTransferProhibited’ status or release an ‘AuthInfo Code’ to the Registered Name Holder solely because there is a dispute between the Registered Name Holder and the Registrar over payment.” (ICANN Transfer Policy)
Set expectations realistically, though: a 60-day inter-registrar transfer lock follows a change of registrant, and registrars may deny transfers within 60 days of a domain’s creation date.
Escalate to ICANN if the registrar will not comply
ICANN’s Contractual Compliance function accepts complaints directly, including transfer complaints. Most people never get this far, because mentioning that the process exists tends to resolve things. (ICANN complaint form)
Reclaiming your Google Business Profile
You can request ownership of a profile someone else controls. The current owner is notified by email and has three days to respond. If they do not, you may be able to claim it — though Google notes the option to claim a profile is not always available. (Google Business Profile Help)
What you may have to rebuild rather than recover
An honest note. If the copyright was never assigned to you and the relationship has broken down, rebuilding is sometimes cheaper and faster than fighting. That is not a satisfying answer, but a rebuild you own outright frequently beats a legal process over a site you will want to replace in two years anyway. Weigh the cost of the dispute against the cost of the rebuild before you commit to either.
When to get a lawyer
If there is a signed contract that says something different from what you were told, if the site generates meaningful revenue, or if the business is being sold, take proper legal advice. The rules described here are the defaults; your contract can override them, and only a lawyer who has read it can tell you what it actually says.
How to never be here again
The clause to agree before work starts
One sentence, in plain English, in the contract: copyright in all work produced under this agreement is assigned to the client on final payment. Not “work made for hire” — as established above, that does not work for websites. Assignment.
The handover manifest
Agree in advance the list of what changes hands at launch, and insist it happens at launch rather than on request. At minimum: domain registrar login, DNS control, hosting account, CMS administrator account, the source repository, a restorable database export, editable design files, and every third-party account created for the project.
The one question that reveals everything
Before you sign anything, ask your prospective developer this:
“If I wanted to move to another developer next month, what would I need from you, and how long would it take?”
A supplier who answers in a straightforward paragraph is fine. A supplier who becomes uncomfortable, changes the subject or starts explaining why you would never want to do that has just answered a different and more important question. The same applies whether you are commissioning a website build or a larger system.
Frequently asked questions
Does my web designer own my website?
Unless your contract assigns copyright to you in writing, in most cases yes — they own the copyright in what they created, even though you paid for it. In the US a commissioned website does not qualify as work made for hire; in the UK the author is first owner and a contractor is not an employee. Written assignment is what changes this.
Can a web developer take my website down?
If they control the hosting account or the domain, practically speaking they can. Whether they are entitled to is a contract question. This is exactly why account control matters as much as copyright.
Who owns the domain if my agency registered it?
Whoever is listed as the registrant. Check at lookup.icann.org. If it is not your business, ask for the registrant to be changed, and be aware a 60-day transfer lock can follow that change.
Do I own my website if it is built on WordPress?
WordPress itself is GPL-licensed, so the software is free to move and modify. That is separate from whether you have the files, the database, the hosting and the admin credentials — and separate again from who owns the copyright in any custom theme or plugin built for you.
What should a web designer give me when the project is finished?
Domain registrar access, DNS control, the hosting account, an administrator login, the source repository, a restorable database backup, editable design files, and every third-party account opened on your behalf. If any of those are missing, the handover is not finished.
The short version
Run the twelve checks. Most people find one or two gaps rather than a catastrophe, and most gaps close with a polite email. The ones that do not close are worth knowing about now, while the relationship is still good, rather than on the day you need to leave.
For what it is worth, this is how we handle it at PixelBot: copyright assigned in the contract, and the code, hosting, domain, design files and every credential transferred at launch rather than on request. Not because it is generous, but because being easy to leave is what makes people willing to start.