Who owns your website? A checklist before you hire a web developer

Why ownership matters before you hire anyone

A website isn't one thing. It's a domain name, a hosting account, the code, the DNS settings that point everything in the right direction, your business email, your analytics, your email marketing list and, for a shop, your payment account. Each lives in a separate account, and whoever holds the top-level login to that account controls it.

If those accounts are in your developer's name, changing developers turns into a negotiation. Some platforms won't move an account without the current holder's say-so: Klaviyo, for example, says it cannot transfer account ownership without the current Owner's approval, outside a verification process run by its support team. It's far easier to get this right at the start than to unpick it later.

Who is the registrant of your domain name?

The registrant is the person or organisation a domain is registered to. For a .au domain that's the licence holder: you don't buy a .au name, you hold a licence to use it, and auDA's Licensing Rules say that licence doesn't create a property interest in the domain name.

The registrant must meet auDA's Australian Presence requirement, and keep meeting it for the whole licence period. auDA lists holding an ABN or ACN, or being an Australian citizen or permanent resident, as the most common ways. A com.au name adds a further condition: the holder must be a commercial entity with a connection to Australia, usually shown with an ABN or ACN, though a registered body number or an Australian trade mark can also qualify.

A developer can register a domain for you as your agent, but auDA's rules say the agent must make sure you are recorded as the registrant. If your developer's name or ABN is on your com.au, the licence is theirs, not yours.

• Look the domain up in auDA's WHOIS service and confirm the registrant is your business.
• Make sure the registrant contact email is an inbox you control. auDA's password recovery tool sends the domain password to the email address used to register the domain.
• Know your renewal date. A com.au licence runs for one to five years at a time, and you can renew it only while you still meet the requirements.
• As the registrant, you can move the domain to another registrar yourself. auDA's rules let the registrant transfer between registrars with a written request and the domain's authorisation code, and the registrant pays no fee for that transfer.

Hosting, code, DNS and business email

Hosting is where the site runs; the code is what runs there. DNS is the set of records, usually managed at your registrar or a DNS provider, that points your domain at the hosting and tells the world where your email should go. Whoever controls DNS can take your site or your email offline with one change.

• Hosting and deployment: the account is in your business's name and billed to your card, with your developer invited as a user.
• Code repository: the code lives in a repository your business owns, such as a GitHub organisation, with the developer as a collaborator. If it starts in the developer's account, GitHub can transfer a repository with its history, issues and settings intact, and links to the old location redirect automatically.
• DNS: you hold the login for wherever the DNS is managed, and you have a written list of the records and what each one does.
• Business email: the administrator account for Google Workspace, Microsoft 365 or whichever service you use is yours. That login controls every mailbox on your domain.

Analytics, Search Console, your email list and payments

These accounts hold your history: years of visitor data, your standing in Google, and the customers who asked to hear from you. They're the hardest things to rebuild if you lose access.

• Google Analytics: your business holds the Administrator role. Google's help says only Administrators can add and remove users.
• Google Search Console: your business is a verified owner of the property. Owners can add and remove users; full users can't. When a developer leaves, remove them and delete their verification token as well, or Google warns they can re-verify themselves.
• Email marketing platform: your subscriber list is one of the most valuable things your website produces. In Klaviyo, an account has exactly one Owner, and only the current Owner can assign a new one. That Owner should be you.
• Payment gateway: your Stripe, Square, PayPal or Shopify Payments account is set up in the business's legal name, paying out to the business bank account. Never let anyone set one up under their own details.
• Store platform: if the site runs on Shopify or similar, the store owner account is yours, and the developer has their own staff or collaborator login.

What to ask for at handover

At the end of a project, ask for these in writing. A good developer will have them ready.

• A list of every account the site uses, who holds it, and confirmation that each is in your business's name
• Top-level access to each one, tested by you actually logging in
• The code, in your repository, with a note on how to publish changes
• The DNS records and what each one is for
• Renewal dates for the domain, hosting and any paid services
• Plain-English instructions for the everyday changes you'll make yourself
• If the developer isn't staying on, confirmation that their access has been removed

How we handle ownership

For the record, this is how AENETWORKS works: the domain, the code and every account are in the client's name, the client gets written instructions for the everyday changes, and ongoing support is month to month with no lock-in contract. Whoever you hire, ask them to commit to the same in writing before the work starts.

Common questions

Can my web developer register my domain for me?

Yes, as your agent. auDA's rules say an agent registering a .au domain on your behalf must make sure you are recorded as the registrant. Check the WHOIS record afterwards to confirm it.

Do I own my .com.au domain?

You hold a licence to use it, which auDA says doesn't create a property interest. As long as you stay eligible and renew it, it's yours to use and to move between providers.

My developer holds my accounts. What should I do?

Ask in writing for each account to be transferred to your business, or for you to be made its owner or administrator. Most platforms have a process: GitHub transfers repositories, Klaviyo lets the current Owner assign a new one, and a change of registrant for a .au domain is made through the registrar on the current registrant's written request.

What if I can't reach my old developer?

Start with the platform. Klaviyo, for example, has a support-led verification process for when the previous Owner has left the business. For a .au domain, raise it with the registrar shown in WHOIS, then with auDA if the registrar's response doesn't resolve it.