Do You Actually Own Your Website? A Handover Checklist

Cardamom Street Bakes runs five outlets in Kochi. When they decided to change agencies, the answer to "do I own my website code" turned out to be no. Not the code, not the domain, not the Google Ads account that had spent ₹19 lakh over three years. Everything sat under a Gmail address belonging to a developer who had stopped replying in 2025. It took them nine weeks and a legal notice to get the domain back, and they never recovered the ad-account history.

The Nine Assets to Check

People ask "do I own my website" as if a website were one object. It is nine or ten, and they can be owned by different parties. Cardamom Street Bakes owned exactly two of the nine.

Start With the Domain, Always

Before you worry about "do I own my website code", settle the domain. Everything else can be rebuilt. The domain cannot. If the registrant email is not one you control, nothing else on this page matters yet.

Check it now — a public WHOIS lookup shows the registrar even when contact details are privacy-masked, and your registrar account shows the registrant email in plain text. If the registrant is your developer, your cousin, or an address ending in a defunct agency domain, fix that this week. Transfers need an auth code from the current registrant, which is easy while everyone is friendly and slow when they are not.

Do I Own My Website Code, or a Licence to Use It?

This is where answers get slippery, and it is worth asking directly rather than assuming. When you ask "do I own my website code", there are three honest possible answers and you should know which one applies to you.

Third-party components complicate this honestly. Premium themes, plugins and fonts are licensed, not assigned, and a good agency will list which licences are in your name and which are theirs. Ask for that list. If the answer to "do I own my website code" is "yes, apart from four plugin licences we renew for you", that is a fine answer — as long as you heard it before you needed it.

Ad Accounts and Analytics Are Separate Problems

Ownership questions do not stop at "do I own my website code" — advertising data is often worth more than the site. Cardamom Street Bakes lost three years of Ads history because the account lived inside the agency's manager account rather than being linked to it. Those are different arrangements and the difference only becomes visible on the day you split.

The correct pattern is simple. You create the account under your own Google login. The agency requests manager access. When the relationship ends, you remove their access and the data stays. Historic conversion data is genuinely valuable — it is what makes new campaigns start smarter — and it does not travel between accounts.

The Handover Checklist

Run this at the end of any project, and again the day you decide to change vendors. If you can tick all nine, "do I own my website code" stops being a question you have to ask anyone.

• Registrar login, with registrant email set to a company address you control.
• DNS provider access, plus an exported copy of the current zone file.
• Hosting or server credentials, with billing on your own card.
• Git repository transferred to an organisation you own, with commit history intact.
• A written answer to "do I own my website code", naming any licensed third-party parts.
• Super-admin on the CMS, and one other person in your team with it too.
• Owner or administrator role on Analytics, Search Console, Ads and Business Profile.
• SSL certificate details and renewal responsibility stated in writing.
• A recorded walkthrough of how to publish a page and restore a backup.

What to Put in the Contract Next Time

Four clauses cover most of this and remove any future argument about whether you own your website code, and none of them are unusual to ask for: copyright in custom deliverables assigns to you on final payment; all accounts are created in the client's name with the agency granted access; a handover package is defined by name and delivered within 14 days of termination for any reason; and no asset may be moved to an agency-controlled account without written consent.

If You Are Already Leaving an Agency

The checklist above assumes a friendly handover. If things have already gone wrong, the order changes and speed matters.

Secure the domain first, then email, then everything else — because whoever controls the domain controls password resets for the rest. Take a full backup of the site files and database before you announce anything. Screenshot your analytics dashboards for the last two years, since access can vanish before an export finishes. Then put the request in writing with a deadline: which credentials, in what format, by what date. A calm written request has recovered more assets for our clients than any angry phone call, and it also creates the paper trail you would need later.

If the answer to "do I own my website code" turns out to be no and the agency will not budge, rebuilding is often faster than fighting. Content, brand and domain are the expensive parts, and you probably have those. Code that took ten weeks to write the first time takes considerably less the second, because the decisions are already made.

The Case for Letting the Agency Hold Some Keys

Here is the uncomfortable counterpoint. Sole ownership with no shared access has its own failure mode, and we have seen it more often than the horror stories. The one director who held every password left the company. Nobody enabled two-factor recovery. The site could not be patched for five months.

Ownership and access are different things, and the healthy arrangement is that you own everything and at least two people — one internal, one at your agency — hold working access with recovery codes stored somewhere other than one person's phone. So when someone asks us "do I own my website code and everything else", the useful follow-up is who else can get in when you are unreachable. Both questions need a good answer, and only the first one is about paperwork.

The 20-Minute Test That Settles It

Paperwork claims one thing and access proves another, so stop reading contracts and try four things without asking anyone for help. Log into the registrar and change the technical contact. Invite a new user to Google Analytics with admin rights. Clone the repository onto a laptop your agency has never touched. Reset the hosting control panel password. Twenty minutes, four attempts, no phone calls.

If all four succeed, you can stop asking "do I own my website" and get on with your quarter. Anything that fails is not an argument; it is a specific asset with a specific owner, and now you know which one. Rahim ran the test at the bakery on a Sunday and got two out of four, which is how "do I own my website" stopped being a rhetorical grumble and turned into two emails he could actually send on Monday morning. Repeat the test the week after any handover, because credentials that worked at handover have a habit of expiring quietly.