Who Owns Your Website? Domain, Code and Content Explained

If you are asking "who owns my website?", the honest answer is: whoever controls the accounts. On paper you may own the business, the brand and the content, but if your domain is registered in your designer's name and the hosting sits on their account, they can switch your site off and you cannot stop them. This guide shows you how to check where you stand, how to get access back, and what to collect at launch so the question never comes up again.

The five things you must own

A website is not one thing. It is five separate assets, and each can belong to a different person.

The domain is the one that hurts most. It carries your email addresses, your Google ranking and every business card you have printed. Lose it and you lose all three.

How it usually goes wrong

Picture a hypothetical driving school in Nyeri. In 2021 the owner paid a freelancer to build a site. To save time, the freelancer registered the domain using his own email and M-Pesa, set up hosting on his reseller account and created the business email addresses there. Everything worked for three years. Then the freelancer took a job abroad, his number changed, and the renewal reminders went to an inbox nobody read. The domain expired in the middle of the school's busiest intake. The website vanished, the office email stopped receiving messages, and the owner had no login to any of it.

Nobody in that story set out to cause harm. The arrangement was simply never written down, and the accounts were never in the school's name. That is the pattern to break.

How to check who the domain is registered to

You can check most of this yourself in ten minutes.

1. Find your registrar. For .com, .org and similar names, use ICANN's lookup tool at lookup.icann.org. For .ke names (.co.ke, .or.ke, .ac.ke and so on), start with KeNIC, the registry, at kenic.or.ke. The result shows which registrar manages the domain and the expiry date.
2. Look at the registrant. Personal details are often hidden for privacy, so you may only see the registrar. That is normal.
3. Check your inbox. Search your email for renewal reminders or invoices from the registrar. If you have never received one, the account is probably not in your name.
4. Ask directly. Send your developer a short written message: "Please confirm which registrar holds our domain, whose name and email are on the account, and send us the login." A good developer will answer the same day.

Do the same for hosting: ask who the hosting provider is, whose account it sits under, and when it renews.

What to do when a developer won't hand over access

This happens more than it should in Kenya, usually not out of malice but because a freelancer has moved on, changed numbers or is waiting on an unpaid balance. Work through these steps in order and keep everything in writing.

1. Settle what you owe, or agree it

If there is a genuine unpaid balance, clear it or agree a plan. It removes the developer's main reason to hold back, and it strengthens your position if you need to escalate.

2. Make a clear written request

Email (and copy by WhatsApp) a specific list: domain registrar login or transfer, hosting login, website admin login, and any licence keys. Give a reasonable deadline, such as seven days.

3. Gather proof

Collect your business registration certificate, M-Pesa or bank records showing payments, the original quote or contract, and any message where the developer agreed the site was yours.

4. Go to the registrar

Contact the registrar that manages your domain. Explain the situation and ask about their process for changing the registrant when the business named in the domain can prove its claim. Processes differ, and they may ask for documents.

5. Use the formal route for .ke domains

KeNIC has a dispute resolution process for .ke names. Check the current policy on its website before relying on it, and consider getting legal advice if the domain matters a lot to your business.

6. Rebuild if you must

If the hosting is gone for good but you still control the domain, a new developer can rebuild from the live site, your files and archived copies. It costs time and money, but it ends the dependency. Our website support team handles this kind of rescue job regularly.

Template and theme licences: what transfers and what doesn't

Many Kenyan business sites run on WordPress with a premium theme and a few paid plugins. Those items are licensed. You do not own them; you have the right to use them under the author's terms.

• What you own: your content, your custom design work if the contract says so, and any code written specifically for you once paid for.
• What you license: the theme, premium plugins, stock photos and some fonts. Licences are often tied to whoever bought them, and updates stop when they lapse.
• What to ask for: a list of every paid item, whose account it was bought under, the renewal date and the cost. Ideally, new licences are bought under your business email.

A related warning: some developers use "nulled" (pirated) themes to save money. These often contain hidden malicious code and never receive security updates. If you suspect yours does, read what to do first if your website is hacked, because nulled software is a common entry point.

A handover checklist to request at launch

Ask for this in writing before you make the final payment, and tick each item off on the day the site goes live.

• Domain registrar account login, in your business name and email
• Hosting or server account login, or at least a control panel user with full rights
• Website administrator account for a named person in your business
• Email account admin access, if your business email runs on the same hosting
• Google Analytics and Search Console: your Google account as owner
• Google Business Profile: your account as primary owner
• List of paid themes, plugins and services with renewal dates
• For custom builds: a copy of the source code and database, or access to the code repository
• Any M-Pesa Daraja or payment gateway credentials, held in your own Safaricom or gateway account
• A short guide on how to edit content and who to call for help

This list belongs in the contract, not just in your head. We explain how to write it in what a website development contract should include, and the wider hiring process is in our guide to hiring a web design company in Kenya.

Storing credentials safely in your business

Getting the logins is half the job. Keeping them is the other half. Too many businesses end up locked out again because the only copy lived on a staff member's phone and they left.

• Use a password manager with a shared business vault, rather than a notebook or a WhatsApp chat to yourself.
• Use a role email such as admin@yourbusiness.co.ke for account registrations, not a personal Gmail of whoever happened to set it up.
• Turn on two-factor authentication for the registrar, hosting and Google accounts.
• Give staff their own logins instead of sharing one admin password, and remove them when they leave.
• Record renewal dates in a shared calendar with reminders a month ahead.
• Write one page that lists every account, what it is for and who holds access. Review it once a year.

When you register a new domain, do it yourself, in the business name, through any accredited registrar such as our sister company HostingKE. Then add your developer as a helper, not the other way round.

Getting your website back under your control

If you are not sure who holds your accounts, or a past developer has gone quiet, we can help you work out what you own, recover what can be recovered and set up a clean handover. Start with our support service or send us a message describing where things stand.