Who Owns Your Website
and Marketing Accounts?

A business can own the custom design and copy but still lack control of the accounts required to operate the website. It can also control the hosting account while having limited rights to a leased template or licensed image.

For the copyright, leasing and portability side of the issue, read Who Owns Your Website After You Leave a Web Design Agency. This article focuses on operational control and access.

These are related but separate questions:

1. Who owns the original work? This concerns copyright, custom design, copy, code and contractual rights.
2. Who controls the account? This concerns the login, primary owner, billing profile, recovery methods and ability to add or remove users.
3. What is licensed? This concerns WordPress, plugins, fonts, stock media, platform subscriptions and other third-party components.
4. What is portable? This concerns whether files, data, settings and history can move to another qualified provider.

SoFloWeb regularly meets new clients who cannot access essential parts of their own digital presence. Before any strategic work begins, our team has to identify the registrar, find the host, verify website administration, recover Google properties, trace analytics codes and determine which records still exist.

The recovery work can take longer than the owner expects because there is no single master account for a business’s entire digital presence. The domain, DNS, hosting, website, email, Google properties, advertising, phone tracking and social accounts may all have different ownership structures and recovery procedures.

What should have been a routine handoff becomes digital archaeology.

Many business owners reasonably assume the agency created accounts correctly. They do not learn otherwise until:

• The agency relationship ends.
• The website goes offline.
• A domain renewal notice never reaches the business.
• The employee who knew the passwords leaves.
• A new agency requests access.
• Google Business Profile ownership cannot be confirmed.
• Analytics history is inside another company’s account.
• The tracked phone number belongs to a former provider.
• The business cannot authorize a website migration.
• A security incident requires immediate access.

An agency may have proprietary research methods, reporting systems, templates, tools and internal processes. Those can remain the agency’s intellectual property.

The agency does not need to give away every internal worksheet it has developed. It should show what it changed on the client’s property, what the client paid for and what information will remain available after the relationship ends.

If “our process is proprietary” becomes the response to a request for the client’s own accounts or work history, the business may be paying for dependency rather than expertise. Our related article, Is Your SEO Company Making Excuses?, explains how restricted access and invisible work can be used to avoid accountability.

That does not entitle the agency to conceal the client’s:

• Domain registration
• Hosting account
• Website files and database
• Website administrator access
• Search and analytics data
• Business Profile
• Advertising history
• Call recordings and lead data, subject to applicable law and privacy terms
• Published content
• Approved creative assets
• Local listings
• Campaign changes and results

The safest general structure has three layers.

The business is the primary owner

The account is created with accurate business information. The business controls the primary ownership role, billing relationship, recovery email and long-term records.

The agency receives named access

The agency is invited through the platform’s user, administrator, manager or partner system. Each person should use an identifiable work account where possible rather than sharing one generic password.

Permissions match actual responsibilities

The agency receives enough access to do the agreed work, but not unnecessary control. A reporting consultant may need read access. A development agency may need website and hosting administration. A paid-media manager may need standard campaign access without the ability to transfer ownership.

This is called role-based access. It is a normal security practice, not a sign that the client distrusts the agency.

Not every platform uses the word “owner.” The practical question is whether the business can see the account, manage users, preserve its history and continue operating without the agency.

The domain is the address used by the website and often by business email. Losing control can disrupt the website, email, advertising, customer trust and search visibility at the same time.

ICANN defines the registrant as the person or entity that registers the domain and enters into the registration agreement. Its information for domain registrants explains registrant rights and responsibilities involving management, transfer, renewal and restoration.

An agency can help manage these responsibilities. It should not register the client’s domain in an employee’s personal name or use an inaccessible agency email as the only recovery method.

The business should know:

• Which registrar holds the domain
• Which legal person or entity is listed as registrant
• Which email receives notices
• Who can renew or transfer it
• Whether automatic renewal is enabled
• Which payment method is used
• Where recovery codes and multifactor methods are stored
• Who controls DNS

Some agencies provide managed hosting because they maintain security, backups, updates and performance. That service can be valuable.

The ideal arrangement is client-owned hosting with the agency invited as an administrator or collaborator. If the agency uses managed infrastructure under its account, the contract should still define backup access, migration rights, notice periods, assistance, fees and technical limitations.

The client should not discover at cancellation that “hosting” actually meant the website could not leave.

The problem begins when the client cannot determine:

• Where the site is hosted
• Whether the hosting is shared with unrelated clients
• Whether the site can be separated
• Whether current files and databases can be exported
• Who owns the account or server subscription
• What happens when monthly service ends
• Whether email or DNS will be affected

WordPress supports separate user roles. Its official roles and capabilities documentation explains that an Administrator has access to all administration features on a single site, while Editor and other roles have narrower capabilities.

A client receiving only an Editor login cannot ordinarily install plugins, manage themes, control all users or change important settings. That may be appropriate for an employee who only edits content. It is not a substitute for the business retaining administrator control of its own site.

Shared accounts make it harder to tell who changed a page, installed a plugin or created a security problem.

At minimum:

• The business should have a verified administrator account.
• The agency should use its own named account.
• Former employees and vendors should be removed promptly.
• Administrator access should be limited to people who need it.
• A current backup should exist outside a single person’s laptop.
• The business should know where themes, plugins and premium licenses originate.

Google Search Console contains search-performance, indexing and technical information. A business should not have to ask a former agency whether Google can access its website.

Google distinguishes verified owners, delegated owners, full users and restricted users. Only owners can manage other users. Its Search Console users and permissions guidance also explains that removed verified owners may regain access if unused verification tokens remain on the website or in connected services.

Search Console now supports performance analysis across conventional and generative AI search features. Historical access is increasingly important for understanding whether a decline involves indexing, placement, AI visibility or changing search behavior.

A sound setup usually includes:

• The business as a verified owner, often through business-controlled DNS
• A second appropriate owner or continuity method
• The agency as a delegated owner or full user according to its duties
• Periodic review of users and ownership tokens
• Removal of former agencies and obsolete verification methods after transition

Google Analytics uses roles such as Administrator, Editor, Marketer, Analyst and Viewer at account or property level. Google explains those roles in its Analytics access documentation and provides instructions for adding and removing Analytics users.

The business should have administrator access to the relevant Analytics account or property. An agency can receive the role required for configuration or reporting without becoming the only administrator.

Google Tag Manager deserves extra care because it can control analytics, advertising and other scripts across the website. Google’s Tag Manager permissions documentation specifically recommends that the account be managed by someone in the organization rather than an external agency and that at least two active administrators exist.

Losing a Tag Manager administrator can mean losing the container history or having to rebuild tracking. Giving too many people publish access creates a different risk. The answer is deliberate permissions, not shared credentials.

Google Business Profile may contain years of reviews, photos, updates, customer actions and local visibility. It should not be treated as a temporary agency campaign.

Google’s Business Profile ownership guidelines state that authorized representatives should encourage the business owner to create the account, own the profile and add representatives as managers. Google also says representatives should transfer ownership to the business owner promptly when requested.

This structure is also important to ethical Google Maps listing optimization. A local-marketing agency should improve the profile on the business’s behalf, not make the business dependent on the agency to retain its reviews and history.

The recommended structure is:

• The business remains primary owner.
• A trusted internal account provides continuity.
• The agency is added as a manager or other appropriate role.
• Former providers and employees are removed.
• The business reviews unexpected access requests.

An agency may use a manager account to oversee multiple client advertising accounts. That is normal. The underlying advertiser account should still be identifiable as the client’s account, with appropriate client administration, billing visibility and the ability to unlink the manager according to platform rules.

Google Ads offers email-only, billing, read-only, standard and administrator access. Its account access documentation explains what those roles can do.

Starting a fresh account every time an agency changes can erase useful context and require a new learning period. It may also hide how the previous budget was managed.

Questions to settle before advertising begins include:

• Who owns the advertiser account?
• Whose legal information appears in billing and verification?
• Can the business see campaign and change history?
• Who controls conversion actions, audiences and linked accounts?
• Can the account be unlinked from the agency manager?
• Which data can be exported or transferred under platform and privacy rules?
• What happens to creative and landing pages after termination?

Tracked phone numbers, form submissions, recordings and lead-source data can be among the most operationally sensitive assets in a marketing program.

A phone number published for years may be saved by customers and indexed across the web. If it disappears when the agency relationship ends, the business can lose inquiries even after replacing the website.

The same principle applies to forms and CRM records. The business should know where leads go, which consent language was used and how to retrieve the data it is entitled to retain.

The agreement should define:

• Who owns or controls the tracking number
• Whether the number can be ported
• Where calls forward
• Who can listen to recordings
• Whether recording disclosures and consent requirements are satisfied
• How long data is retained
• How leads can be exported
• What happens when service ends

The business may own custom copy, graphics, photography or video while using stock assets under a license. It may have the right to display a finished image on the website without the right to redistribute the unmodified stock file.

Our guide, Do Web Designers Provide the Copy and Images for a Website, explains how client-supplied media, custom creative, paid stock and free stock licenses differ.

Saying “the client owns everything” should never be used to misrepresent third-party rights. The stronger promise is precise: the client owns the original work purchased from the agency and receives documentation for anything licensed.

Therefore, the project archive should identify:

• Original client-owned work
• Custom work transferred by the agency
• Stock media and license receipts
• Font, theme and plugin licenses
• Music and footage permissions
• Source files included in the agreement
• Usage restrictions and renewal dates

Use platform invitations, user roles and partner access whenever available. Require multifactor authentication for administrative access. CISA recommends MFA for business accounts and emphasizes stronger, phishing-resistant methods for privileged access in its small-business MFA guidance.

The client should not send its primary password through ordinary email or text because an agency asks for access.

One login shared by the owner, employees and agency can feel convenient. It creates serious problems:

• Nobody can reliably attribute changes to one user.
• A departing person may retain the password.
• Changing the password disrupts everyone.
• Multifactor prompts go to the wrong phone.
• Recovery depends on one email address.
• The platform may treat unfamiliar sign-ins as suspicious.
• The business may expose billing or customer data unnecessarily.

A digital asset register is a simple inventory of the systems the business depends on. It does not need to contain passwords in an unprotected spreadsheet.

Store credentials in an appropriate business password manager or identity system. Store backup codes securely and separately. The inventory should tell an authorized person where access is managed without exposing every secret to everyone who reads it.

For each asset, record:

• Platform and purpose
• Account or property name
• Public URL or account identifier
• Business owner
• Internal administrators
• Agency or vendor users
• Billing owner
• Recovery email and phone category
• Multifactor method and backup location
• Contract and renewal date
• Export or portability notes
• Last access review date

The goal is not to remove every agency administrator. The goal is to know who can do what and why. A scheduled review catches outdated permissions, recovery details, and connected tools before they become an emergency.

At least quarterly—and whenever an employee or vendor relationship changes—review:

1. Who has access
2. Which people have administrator or owner roles
3. Whether former users remain
4. Whether recovery information is current
5. Whether billing details belong to the correct entity
6. Whether multifactor authentication is active
7. Whether backups and exports are current
8. Whether undocumented tools were connected
9. Whether agency access still matches the contract
10. Whether the digital asset register is accurate

Account ownership should be settled before work begins, not when the relationship ends. Clear answers reveal whether the proposed setup gives the business durable control or creates avoidable dependency. Ask the following questions before signing, and require important commitments to appear in the agreement.

Account creation

How an account is created determines who can recover it, approve users, and retain its history later. The legal business name and a company-controlled email should be used wherever the platform allows. The agency can then receive the role it needs without becoming the business’s only route into the account.

• Will accounts be established under our legal business name and information?
• Will we be the primary owner or administrator?
• Will the agency join through a named user or manager account?
• Which platforms require an agency-owned master account, and why?

Ownership and licensing

Ownership language should separate original work from third-party tools and licensed materials. A business needs to know what it receives after payment, what remains subject to another company’s terms, and which source files are included. Precise definitions prevent a broad promise of ownership from hiding restrictions on portability or future use.

• Who owns custom design, code, copy and creative after payment?
• Which components remain licensed from third parties?
• Which source files and records are included?
• Are we leasing any part of the website or marketing system?

Data and visibility

Direct access allows the business to verify performance, retain historical context, and continue operating if a provider changes. Reports are not a substitute for appropriate access to the underlying platforms and records. Export rights, retention settings, and responsibility for consent should be agreed upon before data begins accumulating.

• Will we have direct access to Search Console, analytics, advertising and lead data?
• Can we see change history and completed work?
• Can data be exported in a usable format?
• Who is responsible for privacy, consent and retention settings?

Separation

The end of a working relationship should be planned before it happens. A written handoff process protects the business while giving the agency clear expectations for access removal, exports, and assistance. The answers should be in writing; a friendly verbal assurance is not a substitute for an agreement.

• What happens to each account if we leave?
• How quickly will agency users be removed or transferred?
• Will tracked numbers, domains, files and data remain available?
• Are there migration, export or release fees?
• What assistance is included in the handoff?

One unusual structure may have a practical explanation. A pattern that makes every asset dependent on the agency is different. The concern grows when restricted access, unclear ownership, and missing exit terms appear together because the business may have no practical way to verify work or change providers.

Warning signs include:

• The agency insists on registering the domain in its own name.
• The client will receive only an Editor login to a custom WordPress website it purchased.
• Analytics and advertising will exist only in the agency’s umbrella account.
• The agency refuses direct access to performance data.
• The contract does not explain what happens at termination.
• The client cannot export leads or call data.
• The agency calls basic account information proprietary.
• Hosting includes no backup or migration rights.
• One agency employee controls every recovery method.
• The proposal uses “ownership” without defining custom work, licensed components and account control.

Do not begin by making random changes or removing access before preserving evidence and backups.

1. Inventory what is known

Collect contracts, invoices, emails, renewal notices, account identifiers, tracking codes, DNS information and reports.

2. Secure the domain and business email first

The domain and email often control password resets for other services. Confirm the registrar, registrant, DNS and mail provider.

3. Preserve the live website

Obtain a complete backup when authorized, including files, database, media, configuration and redirects. Avoid an uncontrolled rebuild while ownership and access are unresolved.

4. Recover Google and advertising properties

Use the official ownership and user-recovery process for each platform. Verify which business account should become the owner before adding more users.

5. Export historical data

Preserve analytics, Search Console, advertising, call, form, CRM and local-listing data where access and law permit.

6. Rotate access carefully

After essential data and continuity are secured, remove obsolete users, verification tokens, API keys, passkeys, payment methods and connected applications. Test that the website, email, tracking and forms still operate.

7. Document the new structure

Record the owner, administrators, recovery method, billing, renewals and agency roles for every recovered asset.

If the access loss accompanied a ranking decline or damaging rebuild, use our guide SEO Rankings Dropped After Hiring an Agency? What Went Wrong and How to Recover to preserve search data and investigate technical changes.

Legal ownership disputes require advice from qualified counsel. A technical provider can identify accounts and help preserve data, but should not interpret a disputed contract as legal authority.

SoFloWeb sets up domains, hosting and essential business accounts under the client’s name and information. The client gives our team the administrator or manager access required to perform the agreed work.

Our clients own 100% of the original website design, custom code, copy and other original work we create for them after applicable payment obligations are satisfied. We do not lease websites. Licensed third-party technology and media remain governed by their respective licenses, and we explain those distinctions rather than hiding them in technical language.

The client can see the website, accounts, data and work. If the relationship ends, the business should not have to reconstruct its digital identity before another qualified company can help.

This model does more than make leaving easier. It makes the working relationship healthier. We retain clients by providing value, not by controlling the door.