Do You Actually Own Your Website? A Plain Checklist for Local Business Owners

Why this matters before you ever need it

Plenty of POS companies, agencies and builders do good work. The trouble shows up when you want to change something. At that point, whoever controls the accounts controls the timeline, and I'd rather you find that out on a quiet afternoon than in a dispute.

This isn't legal advice, and your contract may say things I can't see.

1. Who is the domain registered to?

Your domain is the most important piece, because your email and every link to your site depend on it. The person or company listed as the registrant is the one the rules treat as the holder. Under ICANN's Transfer Policy, the Registered Name Holder is the only party with authority to approve or deny a transfer to a new registrar. If an agency registered your domain under its own name, that's a real problem to fix.

To check, run your domain through ICANN Lookup. It uses RDAP, which ICANN says became the definitive source for this data on 28 January 2025, replacing the old WHOIS services. Expect some fields to say "redacted." ICANN's lookup FAQ explains that privacy rules hide some data from the public. The lookup will still show you the registrar, the creation and expiration dates, and status codes such as clientTransferProhibited. If the registrant is hidden, the reliable check is inside the registrar account itself.

2. Do you have your own registrar login?

Knowing the registrar's name isn't enough. You want a login in your own name, tied to an email address your business controls, ideally with two-step verification turned on. If only your provider can sign in, ask them to move the domain into an account you own.

3. Who owns the hosting or website-builder account?

The domain is the address. The hosting or builder account is the house. Many POS and builder plans keep the site inside the provider's platform, which is normal. The question is whether the account is in your business's name and whether you can sign in without asking anyone.

4. What happens if you cancel?

Terms vary by provider and plan, so I won't guess at any specific company's policy. In general, cancelling a hosted builder plan can mean the site goes offline, and not every platform lets you export your design in a form you can move elsewhere. Read your own provider's terms and help pages for three things: what happens to the site when service ends, what you can export, and whether the domain is included in the plan or registered separately. Then save a copy of your content now, while you still have access.

5. Google Business Profile, Analytics and Search Console

These hold your reviews, traffic history and search data. Google spells out the roles:

Google Business Profile: Google's help page on owners and managers says owners have full control, including adding or removing users and deleting the profile. Managers can do almost everything else but can't add or remove users. There's only one primary owner, and it should be someone inside your business. Your provider can be a manager.

Google Analytics: Google's access management page lists Administrator, Editor, Marketer, Analyst and Viewer roles. Only an Administrator can manage users. Make sure someone in your business holds that role.

Search Console: Google's owners, users and permissions page describes verified owners, delegated owners, full users and restricted users. Only owners can add users, and Google warns that if all verified owners are removed, everyone else loses access after a grace period. Be a verified owner yourself.

If reviews are a big part of how customers find you, my post on handling Google reviews and fake reviews covers why owner access matters there too.

6. Domain transfer basics

If you decide to move your domain to a registrar you control, here's what ICANN's current Transfer Policy says. This version was updated on 21 February 2024, and registrars had to implement it no later than 21 August 2025.

You request an authorization code (the policy calls it an "AuthInfo" code) from your current registrar. If they don't let you generate it yourself, they must provide it and remove the transfer lock within five calendar days of your request.

A registrar may deny a transfer within 60 days of the domain's creation date or within 60 days of a previous transfer.

Changing the registrant's name, organization or email counts as a Change of Registrant and triggers a 60-day lock on moving to a new registrar, unless your registrar offered an opt-out beforehand. ICANN's registrant FAQ suggests transferring first if moving is your end goal.

A completed transfer generally adds one year to the registration, up to a ten-year maximum.

One update worth knowing: on 7 June 2026 the ICANN Board adopted all 47 recommendations from the Transfer Policy Review, which include shorter locks and a one-time transfer code. They are not in effect yet. ICANN's implementation page lists the review as in the queue, and I couldn't find a published effective date. For now, the rules above still apply.

Moving the domain also touches DNS, and DNS mistakes are how a site or email goes dark. My post on why a website isn't live until DNS agrees explains what to double-check.

Your 15-minute "do it today" checklist

Look up your domain on ICANN Lookup. Note the registrar and the expiration date.

Sign in to that registrar yourself. If you can't, ask your provider for access this week.

Confirm the registrant is your business, and that auto-renew is on.

Write down where your site is hosted, whose name the account is in, and whether you can sign in.

Open Google Business Profile, go to People and access, and confirm who the primary owner is.

Check that someone in your business is an Administrator in Google Analytics and a verified owner in Search Console.

Save a copy of your site's text and photos somewhere you control.

Keep this list in a safe place, and use a login manager rather than sticky notes.

None of this means your provider is doing anything wrong. Usually the fix is a polite email asking to be added as an owner. It's also a good moment to make sure your site's software is current; see my post on the October 2026 PHP security update.

If you'd like a second set of eyes on who controls what, get in touch and I'll help you sort it out.