Who owns my website? A guide for SA businesses

The call usually starts the same way. "Our web guy has stopped answering, the site's down, and we can't get into the email." Then the real question: who owns my website, if he has all the passwords?

The short answer: you should own every piece of it, in your company's registered name, with logins you control. A website is really nine separate things, from the domain to the ad accounts, and each has its own owner on paper. If any of them sits in your designer's name, you own less than you think.

Website ownership is really nine separate questions

Most articles on this topic stop at "make sure you own your domain". But a business can have the domain in the right name and still be stuck, because the Google Ads account, the hosting login and the only copy of the code belong to a freelancer who has since emigrated.

Piece	Whose name it should be in	What goes wrong if it isn't
Domain (.co.za)	Your company, as registrant, with a company email address	You can't move registrars or renew without the other person
Hosting account	Yours, or the agency's with a written right to your files	Site disappears when their invoice goes unpaid
Files and database	Yours, with a downloadable copy	You rebuild from scratch
CMS or admin login	An administrator account in your name	You can't change a phone number without asking
Business email	Your domain, your admin account	Staff mailboxes held by an outsider
Google Business Profile	You as primary owner	Your reviews and map listing sit in someone else's account
Google Analytics and Search Console	You as administrator or owner	Years of traffic history lost on handover
Google Ads and Meta ad accounts	Your business, agency added as partner	Campaign history and audiences leave with the agency
Images, fonts and code copyright	Licences and a written assignment in your name	Takedown notices, or a dispute over who may reuse the code

The domain: who owns a .co.za, legally

A .co.za domain is sold to you by a registrar (the company you pay each year) and recorded by the central registry, run by the ZA Registry Consortium (ZARC, previously ZACR). Its published policy makes three points worth knowing.

First, you don't technically own a domain the way you own a vehicle. ZARC's 2025 policy describes registering a domain as "akin to obtaining a licence to use" it, and says domains aren't regarded as property. Whoever is listed as the registrant holds that licence, so the registrant field is the closest thing you have to a title deed.

Second, the registrant must be free to choose their registrar, and registrars may not lock a registrant in. That protection belongs to the registrant, though. If your designer registered the domain under their own business, the rules protect them.

Third, and most people miss this: when a domain moves between registrars, the registry sends authorisation tokens to the registrant and the losing registrar. If the registrant email is your designer's Gmail address, the approval lands in their inbox. Your company name with somebody else's email is half a fix.

Hosting, files and the admin login

It's normal for an agency to host your site on its own servers, and often better, because someone who knows the build is watching it. (Ours are run by our own in-house Unix team.) What matters is what happens when you leave: you should get a full copy of your files and database on request, in a format another host can use.

The admin login is the day-to-day test. You need your own administrator account, not a shared password the designer can change. If updating your trading hours means emailing someone, you're renting.

One warning from our own work. When we rebuilt a page-builder site into custom PHP, the old site's backups turned out to contain exposed SSH keys and database credentials. Handovers are where this surfaces, so when access comes back to you, change every password and have someone look at what's actually on the server.

Email, Google and ad accounts

These get forgotten, and they're often worth more than the website.

Start with your Google Business Profile. Your map listing and every review you've collected live here. Google lets only the current primary owner transfer primary ownership, and only to someone who's already an owner or manager on the profile. If a marketing person set it up under their own Google account, they have to add you first. Ask while you're on good terms.

Analytics and Search Console work the same way: your agency should be a user on your property. A new property starts with no history.

Google Ads and Meta ad accounts should sit under your own business, with the agency given partner access. Campaign history, audiences and pixel data belong to the account, so they leave with whoever owns it. We run ads for clients ourselves, and this is the one we'd push hardest on: an agency that insists on running your spend from its own account is making it expensive to leave.

Then email. Whoever controls the domain's DNS controls where your mail goes, so your company needs the admin login for the mailbox service as well as the mailboxes.

Copyright in the code: the part nobody explains

Paying for a website doesn't automatically give you the copyright. Under South Africa's Copyright Act, an employee's work generally belongs to the employer. An outside designer or agency is different.

For computer programs, which covers much of a custom site's code, the author is the person who controlled making it. Law firm MJK Inc. explains that this turns on the facts, citing Haupt v Brewers Marketing Intelligence (2006), where a commissioning client who closely directed development was found to own the copyright. A developer who ran the project independently usually owns it, even though they were paid. Section 22(3) of the Act says an assignment of copyright is only valid in writing, signed by the person assigning it. A verbal "of course it's yours" transfers nothing.

In practice: get a clause assigning copyright in the work to your company once it's paid for. Open-source libraries and an agency's reusable tools are fair exceptions, licensed rather than assigned. Images work the same way. A stock licence bought on the designer's account is the designer's licence, so ask for it in your name.

This is general information, not legal advice. For a dispute, speak to an IT law attorney.

Platform lock-in is a quieter kind of not owning your website

Some website builders don't let you take your site with you at all. Wix's help centre says plainly that your site must run on Wix's servers. You can move the domain and copy your text out by hand, but the site stays. For a small business that can be a fair trade. For a company spending real money, know it before you start.

WordPress is better: the files and database move to any host, though you're tied to its plugins and page builder and their licences. A custom site in plain HTML, CSS, JavaScript and PHP is the most portable of all, and runs on practically any standard Linux server. We compared the three in custom website vs WordPress vs an AI builder.

Check this today: a ten-minute ownership audit

Run a WHOIS lookup on your domain. For .co.za, the Registrant Organisation is public while personal details are redacted, so check that line shows your company. Note the registrar and expiry date too.
Ask your registrar which email sits on the registrant contact, and change it to a company address like domains@yourcompany.co.za.
Log into your hosting control panel yourself. No login? Ask for one, or for a full backup.
Confirm you have your own website administrator account.
In Google Business Profile, open People and access and check who the primary owner is.
In Google Analytics and Search Console, check that someone at your company is an administrator or owner.
In Google Ads and Meta Business settings, check which business owns the ad account.
Search your website contract for "copyright" and "assign".

If all eight come back in your name, you're ahead of most businesses we speak to.

What to do if your web designer won't give access

Usually the designer isn't malicious, just overloaded, unpaid or gone. Start there.

Ask in writing. One email listing what you need (registrant change, transfer code, hosting backup, logins, Google and Meta access) with a reasonable date.
Settle anything genuinely owed. It's usually the cheapest route.
Go to the registrar. If the domain is in your company's name, the registrar can help update the contact details. A registrant change sits pending for five days before it goes through.
Use the .za dispute process for the domain. If someone registered your business name to keep it from you, the .za Alternate Dispute Resolution Regulations cover abusive registrations, and ZADNA's FAQ explains you lodge a complaint through an accredited provider.
Recover what you can on your own. Google has a process for requesting ownership of a Business Profile, and your content can be copied from the live site.
Get an attorney involved if the amounts are meaningful or the copyright is in dispute.

What a good handover looks like

Picture the version where none of this is a problem. The registrant record shows your company and a company email. You have every login and a copy of the files. Your agency is a user on your Google and Meta accounts. If you move on, it's a week of admin.

At X3WEB, the domain, website and ad accounts are always in the client's name, and we don't hold anything hostage when someone leaves. If you're comparing agencies, our guide on how to choose a web design company in South Africa has the questions worth asking, and ownership is near the top.

If you've run the checklist and something came back in the wrong name, send us your domain and tell us what you found. We'll tell you honestly what it'll take to get it back, whether or not you work with us. You can meet the team first.

Frequently asked questions

Who owns my website if a designer built it?

The domain belongs to whoever is listed as registrant, and copyright in the code depends on your contract and who controlled the build. To be safe, get the domain in your company's name and a signed written copyright assignment.

How do I check who owns my .co.za domain?

Run a WHOIS lookup. For .co.za, the registrant organisation, registrar and expiry date are public, while personal details are redacted. If the organisation isn't your company, contact your registrar.

Can I transfer my .co.za domain if my web designer won't give access?

If you're the registrant, yes, and the transfer approval goes to the registrant's email address. If the domain is in the designer's name, they need to change the registrant, or you use the .za dispute process.

Can my web designer legally keep my website?

They can keep what's genuinely theirs, like a hosting account in their name or code they own copyright in. Holding a domain registered to your business, or your Google and ad accounts, is much harder to justify. For a real dispute, speak to an attorney.

Do I own my Wix or website builder site?

You own your content and can move your domain, but a Wix site can't be exported to another host. If you leave, you rebuild. A WordPress or custom-coded site moves with its files and database.

Who owns my website? A plain guide for South African businesses