A domain name and a website usually get set up once, and then nobody thinks about them again, until a renewal notice bounces, a site goes down, or the person who originally set everything up is no longer around to ask. The account that actually controls a domain is the registrar account it’s registered under, and whoever can log into that account can renew it, move it, or let it quietly expire, whether or not that’s still their job. The same is true of the hosting account and the website platform behind it. None of this requires anything technical to fix; it mostly requires finding out where these accounts actually live, confirming the business itself is the one that controls them, and locking them down so a single missed step, or a single person leaving, can’t take the whole site with it. This guide walks through exactly that.
How to find out who controls your domain, step by step
!Who can actually log in?
If your domain’s renewal notice goes to an inbox nobody checks anymore, you don’t control it.
1Find out where your domain lives
Check who your registrar is, and make sure you, or your I.T. provider, can actually log into that account.
2Register it to the business, not a person
Use the business’s own contact email, not someone’s personal account, and never an address at the domain itself.
3Turn on two-factor, and lock transfers
Most registrars offer two-factor authentication and a transfer lock; turn both on.
A few tips
- Keep a written account inventory — Domain registrar, hosting, website platform, and who’s allowed to log into each
- Review access when someone leaves — An old employee or agency shouldn’t still be the one who can change your site
- If an agency set it up, confirm who owns it — The account should be registered to your business, not held indefinitely by someone else
Recap: who controls your domain and website
- Find out who can actually log into your domain and hosting
- Register it to the business, with the business’s own email
- Turn on two-factor authentication, plus the domain transfer lock
- Keep a written inventory, and review access when someone leaves
Printable quick guide
Frequently asked questions
How do I find out who controls my business’s domain name?
Start with the registrar, the company your domain is actually registered through; that account, not your website host or your email provider, is the real control point. If you don’t know who that is or can’t log in, a domain lookup tool can often show the registrar, or your I.T. provider can help track it down.
Why shouldn’t I use a personal email address to register a domain?
Because that person’s inbox becomes the recovery path for the domain; if they leave the business, you may lose the ability to prove ownership or reset access. Use a business-owned email address instead, and never one at the domain itself, since that inbox goes down if the domain ever does.
What is a domain transfer lock, and should I turn it on?
A transfer lock, sometimes called a registrar lock, blocks a domain from being moved to a different registrar without your explicit approval. Most registrars let you turn it on for free, and leaving it on is one of the simplest ways to prevent an unauthorized transfer.
What should I do if an outside agency or freelancer set up my website?
Confirm, directly, that the domain, hosting, and website accounts are registered to your business, not held indefinitely under that person’s or agency’s own account. It’s reasonable for them to manage it day to day, but your business should still be able to log in, or at least verify ownership, without depending on them.
Related guides
- The First Hour After a Cyberattack (Small Business)
- What Is Managed IT? A Plain-English Guide for Small Business
- Password Managers: Why You Need One and How to Start
Source: SAC044: A Registrant’s Guide to Protecting Domain Name Registration Accounts (ICANN SSAC)