You almost certainly own your website, but not as one single thing. A website is three separate parts: a domain name your business leases from a registrar, hosting you rent from a provider, and the WordPress site itself along with your content, files and database. The third part you own outright. The first two are accounts, and ownership comes down to whose name is on them.
That split is why owners get a nasty surprise years after their website went live. The pieces were bought at different times, from different places, usually by someone else, and nobody explained which was which. Here is that explanation, from the developer’s side of the desk.
Why website ownership is more confusing than it should be
Website ownership is confusing because the word “website” covers three products that are bought separately, paid for separately, and can sit with three different companies. You can own your content while renting the address it lives at and paying someone else for the space it sits in.
| Your domain name | Your hosting | WordPress and your content | |
|---|---|---|---|
| What it is | The address people type in, such as yourbusiness.co.nz | The server space your website files sit on | The software running your website, plus your pages, images and database |
| Who you pay | A domain registrar, yearly or every few years | A hosting provider, monthly or yearly | Nobody. WordPress itself is free |
| What you get | The exclusive right to use that name while you keep renewing it | Space, bandwidth and an environment to run your website in | Your content and files, owned outright |
| If you stop paying | The name expires and someone else can register it | Your website goes offline and the files are eventually deleted | Nothing expires, but you need hosting to serve it |
| Whose name should be on the account | Your business | Your business, or a provider you can leave | Your business, with admin access you hold or can get on request |
None of this matters on a quiet Tuesday. It matters when you want to change developers, move to a faster host, or when a renewal notice goes to an email address nobody has read in four years.
Your domain name: the address you rent, not own
A domain name is leased, not bought. You register it for a period, usually one to ten years, and hold the exclusive right to use it for as long as you keep renewing. Stop renewing and the name goes back on the market. Nobody owns a domain permanently, including the largest companies in the world.
What matters more than the lease technicality is the registrant: the name and email on the registration. It should be your business, in your business’s own email address. The common trap is a developer registering the domain inside their own account instead, often with good intentions and no conversation about it. The website works, the invoices get paid, and the business cannot move its own address without asking permission.
You can check yours in about a minute. The Domain Name Commission runs a public WHOIS search at dnc.org.nz for every .nz domain. Businesses cannot hide their registrant details, so if the name that comes back is your web developer’s rather than yours, that is your answer.
There is a fourth piece nobody mentions, sitting between your domain and your hosting: DNS, the records that point your address at your website and your email at your mail provider. In most cases we set clients up with a shared Cloudflare account, so both sides can see and change those records. Plenty of website emergencies turn out to be DNS problems, and they get solved faster when nobody has to hunt for a password.
Your hosting: where your website lives
Hosting is the server space your website files and database sit on, paid for on an ongoing basis. It is separate from your domain and from WordPress, and it can be moved. Changing host does not mean rebuilding your website or changing your address.
Hosting is where the ownership question gets less black and white, so here is how ours works. Every website we host runs on our own Amazon Web Services infrastructure, and the hosting accounts are ours, not yours. You do not get a server login. What you do get is a complete copy of your website files and database whenever you ask, at no charge and with no exit fee.
That distinction is the one worth holding onto, and it applies to your WordPress login too. The test of control is not whether you hold a password, which most owners would never use. It is whether you can leave and take everything with you. Our post on reliable WordPress hosting covers what else to look for beyond the monthly price.
WordPress and your website files: what you actually own
WordPress is free, open-source software released under the GPL licence. No company owns it, so no company can take it away from you, change its pricing, or decide your website is no longer allowed to do something. Your content, images, database and theme files are yours outright, and will run on any WordPress host in the world.
That nobody owns WordPress sounds like a weakness and is the whole point: it is why a WordPress website can be picked up and put down somewhere else. We have made the wider case for WordPress as the best CMS for New Zealand businesses, and portability is the argument that holds up longest.
Hosted platforms work the other way around. On Wix or Squarespace you rent the software as well as the space, and your pages exist only inside it. You can export your text and images in some form. You cannot export the website, which is why moving off one is a rebuild rather than a transfer, as we cover in migrating from another CMS to WordPress.
The three logins every business owner must have
Three logins decide whether you control your website: your domain registrar account, your hosting, and your WordPress admin. Holding all three yourself is one way to be in control. The other is knowing exactly who holds each one and having it in writing that it comes to you on request. What you cannot afford is a login nobody will hand over.
- Your domain registrar account. Where the domain is renewed and where DNS can be pointed. Registered to your business, in your business’s email address. Know where your DNS is managed too, because it is often somewhere else again.
- Your hosting account, or a written promise you can leave with your files. Either you hold the account, or your provider has said plainly that a full export of your website and database is yours on request.
- Your WordPress administrator access. If you look after your own WordPress, hold an Administrator account in your own name and email, not a shared login and not an Editor account that cannot see the settings. If someone manages the site for you, they may hold the admin instead, which is defensible for the reason below, as long as you know who has it and it comes to you on request.
Keep whatever you do hold in a password manager the business owns, not in one person’s browser. The most common version of this problem is not a bad-faith developer. It is a staff member who set everything up under a personal email address and left two years ago.
The third one deserves expanding, because our own practice runs against the usual advice. On our Managed, Care and Dedicated plans we hold the WordPress admin rather than handing it out, and we say so at the start. Compromised client-side admin accounts are one of the most common ways a WordPress site gets broken into, often through a reused password on an account belonging to someone who left months ago. And where we are accountable for updates, plugins and security, an admin account we do not control can undo that in an afternoon with one abandoned plugin. On Basic hosting, where running WordPress is your job rather than ours, the admin is yours.
What makes that fair rather than merely convenient is the exit. The admin comes to you whenever you ask for it, and it comes to you when you leave, the same as your files. A provider holding admin so they can do the job properly is reasonable. A provider holding admin so you cannot leave is not, and the difference is whether they told you which one it was before you signed.
Warning signs you might not control your own website
Four signs suggest your website is not fully under your control: nobody will tell you whose name the accounts are in, everything runs through one person with nothing written down, your invoice is a single bundled figure, and the accounts sit under someone else’s email address.
- You cannot get a straight answer about who holds what. A provider who holds your admin on purpose will tell you so and tell you why. One who will not answer the question is a different proposition, and so is one who cannot find out.
- One person handles all that. Convenient until they are on holiday, unwell, or gone. Documentation is the difference between a delay and a crisis.
- One bundled invoice, no breakdown. If you cannot tell which part is domain, which is hosting and which is maintenance, you cannot tell what you would keep paying for if you changed providers. Our post on the hidden costs of websites covers what should be itemised.
- Your accounts are in an agency’s email address. Renewal notices, security alerts and transfer approvals go to whoever holds that address. If your domain is about to expire, you will not be the one who hears about it.
How to take back control without burning bridges
Getting ownership sorted is an administrative job, not a confrontation. A good developer will hand over access without being asked twice, because they know the alternative reflects badly on them. Ask in writing, be specific, and give them a sensible deadline.
- Ask for a written list of what sits where. Which registrar holds the domain, where DNS is managed, who the host is, what plugin licences are in play, and which email address each account is under.
- Move the domain into an account in your business’s name. A transfer between registrars takes a few days and needs an authorisation code from the current one. If the domain is already yours and only the contact email is wrong, that change is quicker.
- Settle who holds the WordPress admin, and get the handover in writing. If the site is yours to run, ask for your own Administrator user in your own name and email, never a copy of someone else’s password. If someone manages it for you, ask instead for a written commitment that admin comes to you on request and on exit. Our guide to giving your web developer access to your WordPress site covers how access should be granted and removed, a fair standard to hold them to.
- Take a backup you hold yourself. A copy of the files and database, stored somewhere the business controls, alongside all three logins. Do this before any other change, not after.
Not sure who owns what? Let us sort it out
We settle this at the start rather than at the end. The domain stays registered to your business, DNS sits in a Cloudflare account we share with you, and we tell you plainly who holds the WordPress admin and why: yours on Basic hosting, ours on the managed plans, and yours the moment you ask for it. Across 800+ websites over 15 years, the handovers that went smoothly were the ones where the paperwork was boring.
Unpicking a setup you inherited is harder, particularly when it was built years ago by someone you can no longer reach. That detective work is part of our Website Clean Up: we go through the existing setup, tell you plainly who holds what, and get the accounts into your business’s name.
If you are not sure what you control, get in touch and tell us your domain and who built the website. We will tell you what we can see from the outside and what we would need from you to work out the rest.
