This is different from a project falling apart mid-build, covered in an earlier post specifically about that scenario. This is about a site that's already live, working, and generating real business value, when the person who built and manages it becomes genuinely unreachable, health issues, a closed business, simply moving on to other work with no transition plan in place.
The Question Most Businesses Never Actually Ask Until It's Urgent
Who actually owns the domain, the hosting account, the codebase, and the database behind your own website. For a lot of businesses, particularly ones that hired a developer or agency and never thought much about it afterward, the honest answer is uncomfortably unclear, and the moment that unclear answer actually matters is exactly the worst possible moment to discover it.
Domain Ownership: The Single Most Critical Piece
A domain registered under a developer's own account, rather than the business's own account, means the business does not actually control its own domain name, regardless of who paid for it or how long they've been using it. If that developer becomes unreachable, transferring a domain away from an account you don't control, or even simply renewing it before it expires, can become a genuinely difficult, sometimes impossible, process.
What to actually verify: log into whatever registrar your domain is with directly, using your own business's credentials, not a developer's. If you can't do this right now, this is worth resolving immediately, not after a real problem forces the issue.
Hosting Account Access
Similarly, a hosting account, Vercel, another platform, registered under a developer's personal account rather than an account your business genuinely controls, means your live site's actual infrastructure isn't something you can access, update, or move if needed, without that specific person's cooperation.
What to actually verify: whether your business has genuine admin-level access to wherever the site is actually hosted, not just knowledge that it's hosted "somewhere," but real, working login credentials your business controls directly.
Source Code Ownership and Access
Where does the actual codebase live, and does your business have real access to it, a GitHub repository under your own organization's account, or at minimum, a genuine, verified, downloaded copy of the complete, current code, not just a developer's private repository you've never actually seen or confirmed exists.
What to actually verify: request, and actually receive and verify, a complete copy of the current codebase, confirming it's the genuinely current version, not an outdated snapshot from early in the project.
Database Access and Backups
For any site with real data behind it, customer records, content, transactions, does your business have genuine access to that database directly, and are there real, verified backups existing somewhere your business controls, not solely within a developer's own personal infrastructure or accounts.
What to actually verify: direct database access under your own credentials, and confirmation that backups exist somewhere genuinely independent of the original developer's personal setup.
Why This Gap Exists So Commonly
Most businesses hire a developer specifically because they don't want to deal with the technical details themselves, which is completely reasonable, and that same instinct often extends, without anyone deciding it deliberately, into never actually verifying who controls the underlying infrastructure either. It's not usually a deliberate withholding of access, it's simply nobody on either side raising the question explicitly during a project that otherwise felt like it was going fine.
What to Actually Set Up Now, Before It's an Emergency
Domain registered under your own business's account, from the very start of any new project, or transferred to your own account as soon as possible for an existing site.
Hosting account access under your own credentials, even if a developer manages day-to-day deployments, genuine admin-level access should exist on your side independently.
A real, verified, current copy of the source code, stored somewhere your business controls, not solely trusted to exist somewhere in a developer's own accounts.
Documented, tested backups of any real data, existing independently of the original developer's personal infrastructure.
A simple, written document listing all of the above, what exists, where it lives, who has access, kept somewhere your business can actually find it later, not scattered across old email threads nobody remembers to search.
Why a Good Developer Should Want This Too, Not Resist It
A professional, legitimate developer generally has no real reason to resist providing genuine ownership and access to their client, and a request for exactly this kind of access and documentation is completely reasonable to raise directly, at any point in a working relationship, not just at the start. Genuine resistance to providing this, covered in more depth in an earlier post on red flags to watch for, is itself a meaningful signal worth taking seriously.
Frequently Asked Questions
Is it normal for a developer to manage hosting and domain registration on my behalf? Yes, this is common and often genuinely convenient, particularly early in a relationship or for a business without technical staff. What matters is that "managing it on your behalf" means administering something registered under your own account, not something registered and controlled entirely under theirs, with you having no direct access at all.
What should I do right now if I'm not sure who actually owns my domain or hosting? Ask directly, and request to be added as a genuine account owner or administrator wherever the answer reveals a gap. A professional developer should have no issue with this request, and it's worth resolving proactively rather than waiting for an actual crisis to reveal the gap at the worst possible time.
If I discover my developer controls everything and I can't reach them, what are my actual options? This varies significantly by platform and situation, and options range from domain registrar support processes for regaining control of a domain, to, in more serious cases, genuine legal consultation if a business relationship has broken down and access is being withheld improperly. This is exactly the kind of situation the preventive steps above exist to avoid needing to navigate reactively.
If you want an honest audit of where your own site's actual ownership and access currently stands, I'm happy to help you check and get it properly set up under your own control.
Get in touch: https://pixelanas.com/contact
Anas, full-stack Next.js developer building SaaS products and premium templates. X: @ASheikh69751