Most business owners assume they own their website. They paid for it, it has their name on it, and it shows up when you search for the business. Case closed. Then one day they try to move to a new provider, update their email, or simply log in to change a price, and they discover they can’t. The domain is registered to someone else. The hosting sits in an account they’ve never seen. The logins belong to a developer who has moved overseas, gone quiet, or gone out of business.
It happens more often than you’d think, and it’s rarely anyone being dishonest. It’s usually just how things got set up in the early days, when the priority was getting the site live rather than sorting out who holds what. The trouble is that “who holds what” is exactly what ownership comes down to. A website isn’t one thing you own outright. It’s a small stack of separate accounts, and you only truly own the site when every key in that stack is in your name.
This article spells out what those keys actually are, why it matters, and how to check that yours are where they should be.
Owning the design is not the same as owning the access
Here’s the distinction that trips people up. There’s the website itself, the design, the words, the images, the thing your customers see, and then there’s the access that keeps it online and lets you change it. You can own the first completely and still not control the second.
Think of it like a shop. You might own everything inside, the fit-out, the stock, the signage, but if the lease and the keys are in someone else’s name, you can’t get in the door without them, and you certainly can’t move to a better location. A website works the same way. The build can be yours while the door is controlled by a domain registrar account, a hosting account, and a set of admin logins that were never handed over. When people say “I own my website,” they usually mean the shop. What actually matters in a pinch is the lease and the keys.
The keys you need to hold
There are four sets of keys behind every website. Ideally each one lives in an account that belongs to your business, with you as the primary contact, using an email address you control. Here’s what each one does and why you want it.
1. The domain name
Your domain, the yourbusiness.co.nz address, is the single most important asset in the stack, and the one most often held by the wrong person. In New Zealand, every domain has a registrant, and the registrant is the legal holder of that name. Whoever is listed as the registrant controls the domain, full stop. If that’s your web developer or a former staff member rather than your business, they hold the address your customers, your email, and your search ranking all depend on.
The .nz system, overseen by the Domain Name Commission, is actually built to protect the registrant. To move a domain to a new provider you need a UDAI, a single-use authorisation code that only the registrant can request. That’s a good safeguard when you’re the registrant. It’s a real problem when you’re not, because it means you can’t move your own domain without the cooperation of whoever is. Changing the registered holder requires the current holder to agree to and action the change, so the time to sort this out is now, calmly, not in the middle of a dispute.
If you’re setting a business up from scratch, our simple guide to getting your business online walks through doing this in the right order from day one.
2. The hosting
Hosting is the space on a server where your website’s files actually live. No hosting, no website. The catch is that hosting is often bundled into a developer’s or agency’s own account, sometimes on a plan shared with dozens of other clients. That can be perfectly fine while the relationship is good, and it can become a serious headache the moment you want to leave, because your site is sitting inside an account you have no login for.
You don’t necessarily need to manage the server yourself, and for most businesses you shouldn’t have to. What you need is clarity on whose account it’s in and how you’d get your site out if you ever needed to. If you’re weighing up how much of this to handle in-house versus hand off, our article on managed versus unmanaged hosting explains the trade-off in plain terms.
3. The editor or admin logins
This is the login that lets you actually run the site: add a page, change a price, update your hours, publish a blog post. On most sites that’s the content management system, often WordPress. If you don’t have an editor or administrator-level login of your own, every small change has to route back through whoever does, which turns a two-minute edit into an email, a wait, and sometimes an invoice.
Having your own admin access isn’t about doing all the work yourself. It’s about not being locked out of your own website. Do keep that access secure, though, because an admin login is exactly what attackers go after. Our piece on why passwords matter more than they seem is worth two minutes if you’ve been reusing the same one everywhere.
4. The supporting accounts
The last set is easy to forget because it lives around the edges of the website rather than inside it. This is your DNS settings, which quietly point your domain at your hosting and your email, plus the accounts that make the site work commercially: your Google Business Profile, Google Analytics, Search Console, any email hosting, and third-party tools like booking or payment systems. These are frequently created “on your behalf” during a build and then never transferred.
Losing access here is less dramatic than losing your domain, but it still hurts. It can mean losing years of analytics history, being unable to update your business details on Google, or having your email break when nobody remembers who controls the DNS. Get these into accounts in your business’s name too.
Why this matters before anything goes wrong
The reason ownership feels invisible is that nothing forces the question while things are running smoothly. The site is up, the emails arrive, and the keys sit quietly in whatever account they were created in. The problem only surfaces at the worst possible moment: when you want to switch providers, when a contractor stops responding, when a business partnership ends, or when the person who set everything up is simply no longer reachable.
At that point, missing keys turn an ordinary task into a stressful one. Moving to a new web team should take days. Without your domain and logins it can take weeks of chasing, or in the worst cases it doesn’t happen at all and you’re stuck rebuilding on a new address and starting your search ranking from scratch. A website is a long-term business asset, not a one-off project, and assets are worth protecting. We’ve made that case more fully in why a website is a building, not a project.
None of this is a reason to distrust your web provider. A good one wants you to hold your own keys, because it makes the relationship a genuine partnership rather than a dependency. If a provider is reluctant to give you access to your own domain and accounts, that reluctance is itself the answer to how much you should rely on them.
How to check where your keys are
You can get most of the way there without any technical knowledge. Start by asking your provider three straightforward questions: Is our domain registered in our business’s name, with our email as the contact? Are our hosting and admin logins in an account we can access? And if we ever chose to move, what would that actually involve?
If the answers are clear and the access checks out, you’re in good shape. If the answers are vague, or everything seems to run through one person’s personal account, that’s worth tidying up now while the relationship is friendly and everyone is willing to help. Write down where each key lives, in whose name, and under which email, and keep that record somewhere safe. It’s a five-minute exercise that can save you weeks later.
The bottom line
Owning your website means owning the keys to it: your domain, your hosting, your admin logins, and the supporting accounts that hold it all together. The design might be the part you paid attention to, but access is the part that determines whether the site is genuinely yours or just something you’re renting without realising it.
If you’re not sure where your keys are, we’re happy to help you find out. We’ll walk through the stack with you, tell you plainly what’s in your name and what isn’t, and help you get everything back where it belongs. No pressure, no jargon, just a clear picture of what you actually own.
Frequently asked questions
Do I own my domain name if I paid for it?
Not necessarily. In New Zealand, the person or organisation listed as the registrant is the legal holder of the domain, regardless of who paid. If your developer or a former staff member is the registered holder, they control it, not you. Check that your business is named as the registrant.
What is a UDAI and why does it matter?
A UDAI is a single-use authorisation code, 16 characters long, that you need to move a .nz domain from one provider to another. Only the registrant can request it. It protects your domain from being transferred without permission, which is great when you’re the registrant and a problem when you’re not.
Can I move my website to a new provider whenever I want?
Yes, if you hold the keys. Moving is straightforward when your domain, hosting, and logins are in your name. It becomes slow or even impossible when those accounts belong to someone else who has to cooperate, so it’s worth confirming your access before you ever need to move.
What happens if my web developer disappears?
If everything is in your name, very little changes and you simply move to a new provider. If your domain, hosting, or logins sit in their accounts, you can be locked out of your own website and email, and recovering access can take weeks. This is the main reason to hold your own keys in advance.
What should I ask my current provider?
Ask whether your domain is registered in your business’s name with your email as the contact, whether your hosting and admin logins are in an account you can access, and what moving providers would involve. Clear answers mean you’re in good shape. Vague ones are worth acting on now.
