A website's domain, hosting account and source code should belong to the business that paid for the site. The domain should be registered with the company as registrant, every admin panel should be owned by the company, and source code delivery and usage rights should be written into the contract. Otherwise, switching agencies becomes difficult.
The problem rarely starts with bad intent; it starts with convenience. To move faster, the agency buys the domain from its own account, hosts the site on its own server and keeps the code in its own repository. When a payment dispute happens, the agency closes, or the business simply wants to move on, it discovers it cannot access its own website. Here is what should sit where so you never reach that point.
Whose name should the domain be registered in?
A domain should be registered to the legal entity that uses the website, with the company name and an email address the business controls long-term in the registrant field. An agency can manage the domain as a technical or administrative contact, but if the agency or an employee is the registrant, the business does not control the domain.
- —Registrant: company legal name, tax details and company address.
- —Registrant email: owned by the business, not the agency, ideally hosted with a separate provider. If you use an address on the same domain, renewal warnings stop arriving the moment the domain lapses.
- —Registrar account: opened in the company's name, with two-factor authentication enabled.
- —Auto-renewal: switched on, tied to a valid payment method, and the expiry date recorded in a calendar.
In Türkiye, .tr domains such as .com.tr have been allocated through the TRABIS system via accredited registrars since 2022. The same rule applies there: the holder field should show your business. To check, look at the domain details in your registrar panel or run a WHOIS/RDAP lookup; privacy protection may hide some fields, in which case ask the agency for a screenshot of the panel.
Related services
Who should hold hosting, DNS and registrar access?
Hosting, DNS and domain registrar accounts should be owned by the business, and the agency should access them as an authorized second user with its own login. That way, when the relationship ends, only the agency user is removed, and the website, email and DNS records keep working without any interruption.
A website does not depend on one account but on several connected services. For each line below you should know, in writing, who owns it and who has access:
- —Domain registrar panel.
- —DNS management and any CDN or security layer (for example a Cloudflare account).
- —Hosting or server panel (cPanel, CyberPanel, a cloud provider account).
- —Content management system (CMS) administrator account.
- —Google Search Console and Google Analytics, with the business in the owner role.
- —Google Business Profile, with the business as primary owner.
- —Company email service (Google Workspace, Microsoft 365 or hosting email).
- —Source code repository (GitHub, GitLab, Bitbucket) and third-party services such as payment gateways, SMS and map APIs.
Hosting billed through the agency is fine in itself; many agencies offer managed hosting. What matters is that the contract promises a full backup on request and a handover of the account or files when the service ends.
Who owns a website's source code?
Ownership of a website's source code in Türkiye is largely decided by contract under the Law on Intellectual and Artistic Works (FSEK, Law No. 5846). Computer programs are protected as works, and if there is no written transfer or license clause between agency and client, the economic rights generally stay with the party that developed the code.
Under FSEK, contracts transferring economic rights must be in writing and must list the transferred rights individually. A vague line such as “the site will be delivered to us” may not clearly cover the right to modify the code, copy it, or have another agency develop it. A lawyer's opinion is the safest route for your specific case, but in practice two models are common:
- —Rights transfer: economic rights to the code written specifically for your site (adaptation, reproduction, distribution, communication to the public) pass to the business. This is the strongest protection.
- —Perpetual license: the agency keeps ownership of the reusable components it builds on, and grants the business a perpetual, irrevocable license that includes the right to modify the code and have third parties develop it.
- —Open-source components (React, the WordPress core, libraries) come with their own licenses; nobody owns them, but their terms still apply.
- —Paid themes, plugins and fonts should be licensed in the business's name; anything installed under the agency's bulk license may not be transferable when you part ways.
Support in your region
Which ownership clauses belong in a web design contract?
Ownership clauses in a web design contract should state that the domain and accounts are opened in the business's name, define when and in what format the source code is delivered, set the scope of the rights transfer or license, and describe transition support if the relationship ends. Written at kickoff, these clauses need enforcing later, not negotiating.
- —Accounts: domain, hosting, DNS, analytics and Search Console are opened in the business's name; the agency is an authorized user.
- —Deliverables: repository access or a code archive, a database dump, setup/build instructions (README) and a list of environment variables.
- —Timing: for example, within 5 business days of the final payment.
- —Rights: a transfer of economic rights for site-specific code or a perpetual, transferable license, plus the status of reused agency components.
- —Third-party licenses: a list of paid themes, plugins, fonts and images used, and whose name they are licensed in.
- —Backups: how often they are taken and how quickly the business receives a full backup on request.
- —Termination and transition: the agency supports access handover and migration for a reasonable period (for example 30 days) after the contract ends.
- —Data protection (KVKK): if the agency can access form submissions or customer records, its obligations as data processor are defined.
How do you stop an agency from holding your site hostage?
An agency can only hold a website hostage under three conditions: the domain is registered to the agency, the hosting account sits with the agency, and the source code was never delivered. The way to prevent that scenario is to open all three in the business's name at kickoff and tie code delivery to a specific date in the contract.
If you are already in this situation, start with a calm written request; most disputes come from an unpaid invoice or a communication breakdown. If that fails, you may need to approach the registrar with invoices, the contract and company documents to prove you are the rightful holder. Legal action is a slow last resort, which is why prevention is the real fix. As long as you hold the domain, even in the worst case you can rebuild the site and publish it at the same address.
For your project
A website ownership checklist
A website ownership checklist lets a business test in 15-20 minutes whether it actually controls its domain, hosting, DNS, source code and digital accounts. If you answer “I don't know” or “the agency has it” to any item below, fixing it today is far cheaper than dealing with a crisis later.
- —Is our company the domain registrant, and do we know the expiry date?
- —Can we log in to the registrar, DNS and hosting panels with accounts opened in the company's name?
- —Are we owners in Search Console, Analytics and Business Profile?
- —Do we have an up-to-date copy of the source code or access to the repository?
- —When was the last full backup of the database and files taken, and where is it stored?
- —Does the contract contain a rights transfer or perpetual license clause?
- —Whose name are paid themes, plugins and font licenses registered in?
- —If we part ways with the agency, is transition support and its duration in writing?