Who owns your website when the relationship ends

This is the problem that turns an ordinary parting into a bad month. The work was fine, the relationship ran its course, and then it turns out the domain sits in a registrar account nobody at your company can log into.

It is rarely malicious. Someone set it up years ago with their own credentials because it was faster, and nobody revisited it. That does not make it less expensive to fix.

Which assets are we actually talking about?

Five, and you should know the answer for each one today.

The domain name, held at a registrar under an account with an email address on it. Whoever holds that account can point your web address anywhere.

The hosting, where the files live. Separate from the domain, often at a different company, sometimes bundled into an agency plan.

The platform account. WordPress, Shopify, Squarespace, or something the agency built. Admin access is not the same as account ownership.

The files and content. Pages, images, the theme, any custom code, the copy someone wrote for you.

The connected accounts. Analytics, Search Console, your Google Business Profile, ad accounts, call tracking, the review platform. These are the ones people forget, and they hold the history that makes future decisions possible.

Losing your analytics history is worse than losing the site. A site can be rebuilt in weeks. Three years of before and after data cannot be recreated at all, which means the earliest baseline you could ever hold would be the day you lost it.

How do I score my own ownership in thirty minutes?

Run one test per asset and count. The test is the same every time: attempt a password reset using your own business email address, and see where the reset message goes.

Five assets, five attempts. Say two succeed, the platform and analytics, and three go somewhere else: the registrar, the hosting account, and the ad account. You own 40%derived of your own marketing infrastructure. That is the number to put in the email, because it is factual and it removes the argument about intent.

Then weight the three you failed. They are not equal. The registrar sits above everything, because a domain pointed elsewhere takes the site, the email, and every link anyone has ever built to you. Hosting is recoverable if you hold the domain. An ad account is painful because it holds conversion history and audience data that does not export cleanly.

Then check three things at the registrar while you are there: the expiry date, whether automatic renewal is on, and who the administrative contact is. An expired domain does more damage in a weekend than a bad agency does in a year, and the recovery process runs on the registrar's timetable rather than yours.

Then check the roles, not just the access. In your Google Business Profile, open the list of people with access and confirm your own account holds an owner role rather than manager. The profile has a primary owner, and that role is the one that controls transfers and removals, so confirm who holds it. Managers can be removed. Do the same in analytics and in any ad account, where the equivalent distinction is between account level administration and property or campaign level access.

If you are already suspecting that work has slowed, do this check before you raise it, because the signals that an agency has stopped doing the work are easier to act on when you are not locked out.

What did they install on my site that I am inheriting?

Whatever it is, it becomes your problem on the day they leave, and one item shows up often enough to check for by name.

Open your homepage source and search it for AggregateRating. A large number of local business sites carry a plugin that scrapes the business's own Google reviews and marks them up as an aggregate rating in structured data on the site. It is the most common schema violation on local business websites.

Google's structured data guidelines prohibit marking up reviews about your own business on your own site. The review snippet guidance is explicit that self serving reviews are not eligible. So the plugin carries manual action risk with no upside, and it usually got installed because it made a report look richer.

The related rule is worth writing down because it governs everything else in the same file: Google requires that structured data match the visible text on the page. Markup describing services you do not list, hours you do not publish, or ratings you did not earn is the category of problem that surfaces long after the person who installed it has moved on.

Where this breaks down, and it matters: displaying your reviews on your site is fine and often useful. The prohibition is on the markup, not on the content. Show the reviews, drop the schema.

The second inherited artifact to check is the website field on your Business Profile. If it points at a domain the agency owns rather than yours, that is both a dependency and a documented risk: forwarding the profile URL to a different domain appears on Whitespark's 2026 list of practices its expert panel flagged as suspension risks. Point it at your own domain before anything else changes.

How do I check who owns my domain right now?

Try to log in. That is the whole test, and it is the first of the five above for a reason.

Go to the registrar directly and attempt a password reset with your own business email. If the reset email arrives, you control the account. If it goes to someone at the agency, or to an address that no longer exists, you have found your problem.

The recovery path when it goes wrong depends on your registrar and on documentation you may not have, which is why the check is worth running while the relationship is good. A transfer requested by a cooperative agency takes days. A transfer disputed by an uncooperative one takes considerably longer, and your site is live the entire time.

What if the site is on the agency's own platform?

That is a legitimate business model, and it means you are renting rather than owning. Both facts are true at once.

Proprietary platforms often work well. They are fast to launch, maintained centrally, and cheaper than custom builds. Plenty of businesses are better served by one than by a bespoke site they cannot update. If you are on one and it works, there is nothing to fix.

What you should do is price the exit before you need it. Ask three questions in writing. Can I export the content and the images in a usable format. Can I export the form submissions and any customer data. And is the domain mine to point elsewhere.

If the answer to the domain question is yes, you are fine. Rebuilding a small site is a project with a known cost. Losing the address people type is a different order of problem.

And keep the site in proportion to what actually drives your calls. Patient Prism's analysis of 11,552,668 dental patient calls across 8,280 locations in 2025 attributed 90% of the calls it could source to the Google ecosystem, with the Business Profile alone accounting for 54% and organic plus ads another 36%. That is dental specific, and it is a customer cohort of a call intelligence vendor, so it skews toward more sophisticated practices. It still describes where the phone calls come from. For some businesses the honest answer is that a light site plus a strong profile is enough, and it is worth knowing what AI search actually means for a business with no real website before you spend on a rebuild you may not need.

What transfers with me and what does not?

Most of it transfers, and the exceptions are worth knowing.

Your rankings are attached to the domain and the business, not the vendor. Change agencies and nothing moves on its own. If your position varies across the city, that is a proximity and profile issue rather than a vendor issue. Proximity of your address to the point of search scored 225 in Whitespark's 2026 expert survey, second only to primary category, which is why ranking well in one part of town and badly in another has its own explanation that has nothing to do with who you hired.

Your reviews stay on the platform, attached to your profile. Nobody can take them.

Content written for you transfers if the contract assigns it on payment. If the contract licenses it instead, it can revert, and you will find out at the worst moment. This is not theoretical: copyright in text and images is the mechanism behind takedown requests, and a page removed on a takedown notice loses its traffic immediately while the dispute proceeds.

Tools do not transfer. Rank trackers, review platforms, call tracking numbers, and reporting dashboards usually sit on the agency's account. Call tracking numbers matter most, since a number printed on a vehicle or a menu can stop working. Ask for numbers to be ported into an account you hold.

What to do this week

Five logins, thirty minutes total, and one number at the end.

Attempt a password reset on the registrar, the hosting account, the site platform, analytics, and any ad account, using your own business email. Count the successes out of five. That fraction is your actual ownership position, whatever the contract says.

Then open your homepage source and search for AggregateRating, and open your Business Profile and check where the website field points.

Whatever you could not do, put in one email to your agency asking for it to be transferred, with a date. This is a normal request and a normal agency will process it in a day. Any resistance you get is information you needed anyway.

Then ask the two questions that a good agency answers in one line, and that we should have to answer as well. First, point me at the clause that assigns the content to me, rather than telling me it does. Second, if we parted tomorrow, would you assert any claim over the pages you wrote for me? SEOD assigns work on payment, and the correct response to any agency saying that sentence, including this one, is to ask for the clause number and read it yourself. An assignment you cannot find in the document is a licence.

If a previous vendor left you without access, that repair is a project of its own, and there is a specific way to rebuild after a bad agency experience that starts with recovering what you own.

Questions about what you actually own?

Email me at eric@seod.com with your domain and what platform your site runs on, and I will send back a short checklist of exactly which accounts to check and what owner level access should look like in each one. You run the checks yourself. I do not need access to anything, and there is no followup message.

There is more on hiring and working with agencies if you want to read further.