Who actually holds the keys to your website?

The guy who built your website moved to Denver three years ago. He was great. He also still has the only login to your domain, and his email address is the one on file.

That's an easy spot to end up in without doing anything wrong, especially in a small town where the site got built by a friend or a local shop that has since closed up. Everything works fine right up until the day you need to change something.

Here is what I'd check this week, before that day comes. None of it costs anything and most of it takes an afternoon.

The pieces that make up "your website"

When people say "the website," they usually mean the pages. But there are a few separate accounts behind it, and each one can be in someone else's name.

1. The domain. That's the name itself, like yourbusiness.com. It's registered through a company called a registrar (GoDaddy, Namecheap, Cloudflare, Squarespace and so on).
2. DNS. The settings that point the domain at your site and your email. Sometimes this lives at the registrar, sometimes somewhere else entirely.
3. Hosting. Where the site's files actually live.
4. Email. If your email is [email protected], that's another account (usually Google Workspace or Microsoft 365).
5. Your Google Business Profile. The listing that shows up on Maps with your hours and reviews. For a lot of local businesses, that's the first thing customers see.

The domain is the big one. If you control the domain, you can rebuild everything else. If you don't, you're asking permission.

How to check who holds what

Start by looking up your domain on ICANN's lookup tool. It'll tell you which registrar it's with and when it expires. A lot of the contact details are hidden for privacy now, so don't panic if you can't see a name.

Then try to log in to that registrar yourself. If you can't, or you don't know which email it's under, that's your answer.

Do the same thing for every other account on the list. Write down the company and which email it's under, then note whether you can actually get in.

Don't be surprised if at least one account is tied to an email address you haven't touched since 2015 ;)

Getting your domain back

Good news is that the rules are on your side here. ICANN, the group that sets the rules for domains like .com, has a Transfer Policy registrars have to follow.

Under that policy, if you're the registered holder and you ask for the transfer code (registrars call it an "auth code"), the registrar has to give it to you within five calendar days. They also can't hold it back just because there's a payment dispute with them.

The catch is the word "registered." If your old web person registered the domain in their own name, the registrar sees them as the holder. Then you need them to either update the contact info to you or move it into an account you control.

That conversation is usually easy. Most people are happy to hand it over. They just never got around to it.

One other thing to note. Many registrars won't let a domain move to a new registrar for 60 days after it was registered or last transferred. ICANN's board voted in June 2026 to change some of these rules, but as of right now no effective date has been published, so plan around the current ones.

Your Google profile

If someone else set up your Google Business Profile, you can ask for it back. Google has a request access process where you search for your business, select Request Access and fill out a short form.

The person who currently manages it gets an email and has three days to respond. If they don't, Google may let you claim the profile by verifying the business yourself. It doesn't always work, but it's worth a shot.

What "squared away" looks like

Here is where I'd want every client to land:

1. The domain is registered in your business's name, under an email you'll still have in ten years.
2. Auto-renew is on, with a card that isn't about to expire.
3. Your web person (us included) gets added as a user with their own login.
4. The passwords live in a password manager, with a second person at the business who can get in.

That third one matters. When we build something for a client, the accounts are in the client's name and we get invited in. If you ever leave, you don't need anything from us. You already have it.

Same goes for the code. On custom projects the repository belongs to the client. If the source code only lives on one developer's laptop, whoever comes next is starting from scratch. Yikes.

If you're stuck

Sometimes the old developer is gone for good and nobody can get in. It's fixable. It just takes longer, and occasionally it means rebuilding the site on a domain you can actually control.

We work with businesses around Austin and Southwest Colorado. If you're in the middle of untangling one of these, give me a call. Ten minutes on the phone usually tells us how deep the hole is.