Here's a statement that gets nods from business owners and the occasional eye-roll from the people who build for them: the person who builds your website shouldn't own any of the accounts it depends on. Not the domain, not the hosting, not the admin login, not the email that receives password resets.

It sounds obvious until you look at how most small sites actually get made. A friend sets it up "to save you the hassle". An agency registers the domain on its own account because that's faster. A former employee turned on two-factor authentication with their personal phone. Years later, nobody quite knows who can get in.

We keep seeing the consequences across the communities we follow. A small business locked out of its own video channel because the two-factor codes go to a former employee's phone. A home builder whose site was hacked, putting up a "contact us directly" notice while trying to work out who could even log in to fix it. A church group whose developer chose a hosting setup for its annual conference app, leaving volunteers unsure what they'd signed up to maintain. A club committee trying to hand admin access to new volunteers without the outgoing ones keeping it. Business owners comparing notes on an agency relationship they regret, and freelancers asking how to earn trust with clients who've been burned before. One agency owner went as far as ranking agencies by how much maintenance burden they leave behind for clients.

So, should the business hold every key? Here are both sides, argued fairly.

Side A: the business owns everything, no exceptions

The case is simple. Your website is a business asset, and assets belong in the business's name.

  • People leave. Freelancers retire, agencies close, employees move on, relationships sour. Accounts in someone else's name leave with them, sometimes by accident and sometimes on purpose.
  • Emergencies don't wait. When a site is hacked or the domain is about to expire, you can't spend three days tracking down whoever registered it.
  • It keeps the relationship honest. If you can leave at any time, the people you work with have to keep earning the work. That's healthy for everyone, including good agencies.
  • It costs almost nothing. Creating accounts in the business's name and inviting the builder as a user takes an hour at the start of a project.

On this side, the builder gets access, never ownership. Their own named login, removed when the work ends.

Side B: let the professional hold it, that's what you pay them for

The other side isn't careless. It comes from people who have watched owners lose access to accounts they technically held.

  • Owners lose passwords too. Many small businesses don't have a password manager, a shared admin inbox or a process. Handing them the keys can mean handing them a problem.
  • Speed matters in a crisis. An agency that controls hosting and DNS can fix things at midnight without waiting for the owner to find a code.
  • Billing is simpler. One invoice covering domain, hosting and care is easier for a business that doesn't want five vendors.
  • Good agencies hand everything over on request. The issue isn't who holds the keys, it's whether the people holding them are trustworthy.

On this side, ownership is a service: the professional holds it, documents it and transfers it when asked.

The grey areas

Most real setups sit somewhere in between, and that's where the arguments get interesting.

  • Domain vs everything else. Many people who'd accept agency-managed hosting draw a hard line at the domain. Lose the domain and you lose your email and your address on the web.
  • Two-factor authentication. It protects you and can lock you out at the same time. Whose phone, whose authenticator app, and what are the recovery codes? This is where many lockouts actually come from.
  • Reseller hosting. Some agencies host many clients on one account at a discount. Convenient, but moving a single site out can be painful.
  • Volunteer organisations. Clubs and charities change committees every year. "The organisation owns it" only works if there's a shared account and a handover habit, not one treasurer's personal email.
  • Who's responsible after a hack. Owning the accounts doesn't mean you're equipped to clean up. Many owners want the keys and someone else to be on call.

Where we lean

We build and maintain sites for clients, so we've stood on both sides of this. We lean firmly toward Side A for ownership, with a nod to Side B for operations.

The business owns the domain, hosting, admin, email and payment accounts in its own name, with at least two people able to get in and recovery details that don't depend on any one person's phone. The builder or agency gets named access to do the work, and that access is reviewed when the relationship changes. If the business wants someone else to run things day to day, that's a service agreement, not a transfer of ownership.

And we'd ask agencies to make it easy: set up client-owned accounts at the start, leave a one-page note of where everything lives, and never make a client ask twice for their own keys.

Your turn

  • Business owners: have you ever been locked out of something you thought you owned? What was the hardest account to get back?
  • Freelancers and agencies: do you insist clients own their accounts, or do you hold them for convenience? What changed your mind either way?
  • Where do you draw the line: is it fine for an agency to hold hosting as long as the domain is in the client's name?
  • For clubs and volunteer groups, what actually works for handing admin access to the next committee?