If an old agency or freelancer still holds your domain, hosting or admin logins, you can almost always get them back, and usually without a fight. Start with the domain name, because whoever controls the domain controls the website, the email and the recovery route for most other accounts. Then work through hosting, the website admin, source code, Google accounts and email, and change every password once the handover is done.
This is very common in India, and it is rarely sinister. Agencies register things in their own accounts because it is quicker at launch, staff leave, freelancers change numbers, and sometimes an invoice is still pending. Treat it as an admin job, not a dispute, and most agencies will cooperate.
Owning is not the same as leaving
You do not have to change agencies to own your assets. Ownership means the domain is registered in your business’s name, the hosting is billed to you, and you are the top-level admin on every account. The agency can still manage everything with its own login under yours. If you are happy with your developer, ask for ownership and keep working together. If you want to move on, ownership comes first and the move comes after.
Every asset, and who should own it
Most small business websites have more moving parts than the owner realises. Use this table to list yours.
| Asset | Where it lives | Who should own it | What the agency needs |
|---|---|---|---|
| Domain name | Registrar account | Your business, as registrant, in your own account | Nothing, or a delegated login |
| DNS records | Registrar or Cloudflare | You | Edit access if they manage it |
| Hosting / cPanel | Hosting company | You, billed in your name | A cPanel or sub-user login |
| Website admin (WordPress, Shopify, Wix) | The site itself | You, as Administrator or store owner | A separate admin account |
| Paid themes and plugins | Vendor accounts | You, or licences transferred to you | Nothing |
| Source code and database | Git repository, server | You, with a written IP assignment | Collaborator access |
| Business email | Google Workspace, Microsoft 365 or hosting mail | You, as super admin | Usually nothing |
| Google Analytics | Google account | You, as Administrator | Editor or Marketer role |
| Search Console | Google account | You, as verified owner | Full user |
| Google Business Profile | Google account | You, as primary owner | Manager |
| Ad accounts, Facebook and Instagram | Google Ads, Meta | You, with your own payment method | Manager or partner access |
| Payment gateway, SMS, WhatsApp API | Each vendor | You (they are KYC-linked to your business) | API keys, changed after handover |
Step 1: Find out where the domain is registered
Run a WHOIS lookup (now called RDAP for most domains) using ICANN’s free lookup tool or any WHOIS site. .in domains show up in the same tools, and the .IN Registry, run by NIXI, has its own lookup. Look for four things:
- Registrar: the company the domain is registered with. This tells you whose account to ask about.
- Expiry date: if it is within 60 days, make renewal your first priority.
- Status: “clientTransferProhibited” is a normal lock that the account holder can switch off.
- Name servers: these show who runs your DNS, which is often different from the registrar (a Cloudflare account, for example).
Owner contact details are usually hidden for privacy. That is normal, not a sign of wrongdoing. Also search your inbox for “domain renewal” or the registrar’s name; sometimes the account is already on your email and you only need a password reset.
Step 2: Get the domain into your name, then your account
There are two separate questions: whose name the domain is registered in (the registrant), and whose account it sits in. Fix both.
If the domain is in your name but in the agency’s account, the quickest route is an internal move (often called a push) to a new account you open at the same registrar. It usually takes minutes and costs nothing. If you would rather change registrar, ask for the auth code, also called the EPP code. The agency unlocks the domain and shares the code, you start the transfer at your new registrar and pay for it (this usually adds a year to the expiry), and it typically completes in five to seven days. For .com and other generic domains, ICANN’s transfer rules require the registrar to give the registrant this code within five calendar days of asking.
If the domain is registered in the agency’s name, ask them to change the registrant details to your business first. Registrars commonly block transfers for about 60 days after registration, after a previous transfer and sometimes after a change of registrant. ICANN has been revising these rules, so as of 2026 confirm the current lock periods with the registrar.
.in domains (.in, .co.in and so on) follow the same auth-code process, but they can only be registered and transferred through NIXI-accredited registrars. Many sellers are resellers of an accredited registrar, which is fine; check the registrar of record in the lookup, and the accredited list on the .IN Registry’s site, before you choose where to move.
One warning: do not plan to “let it expire and buy it back”. Expired domains pass through grace and redemption periods, may be auctioned, and are watched by people who buy lapsed names for resale.
Step 3: Hosting and cPanel
Ask for either the hosting account itself, transferred to your name, or a full cPanel backup (files, databases and mailboxes). Many agencies host dozens of clients on one reseller plan, so they cannot hand you the whole account; a full backup restored on hosting you own is the normal answer, and most hosts will restore it for you. Our hosting cost guide covers what to buy.
Before anything is cancelled, export or screenshot every DNS record, especially MX, TXT and CNAME records. They carry your email routing and the verification codes for Google and other services. Restore the site on the new host, test it, switch DNS, and keep the old hosting running for a week or two as a safety net. If URLs change during the move, that becomes a migration SEO question; keep them identical and it is a non-event.
Step 4: Website admin, licences and source code
For WordPress, ask for a new Administrator account on your own email address rather than a shared login. Once the handover is done, remove or downgrade admin accounts you do not recognise. Check paid themes and plugins too: if they were bought on the agency’s licence, the site keeps working but stops getting updates, so budget to buy your own. Shopify has a transfer-ownership option in its Users settings, and most hosted builders, Wix included, let you move a site to another account.
For custom-built sites and apps, ask for the Git repository (or a full archive), a database dump, a list of every environment setting and third-party key the code uses, and short deployment notes. Then look at who owns the code itself. Under Indian copyright law, work written by an outside contractor generally belongs to the contractor unless it is assigned to you in writing, so if your contract says nothing, ask for a one-page assignment now. A lawyer can draft it quickly, and it matters most if you ever raise funding or sell the business.
Step 5: Google Analytics, Search Console and Business Profile
- Search Console: once you control DNS, verify yourself as owner of a Domain property with a TXT record; you do not need the agency for this. Then review the user list. To remove another verified owner, delete their verification token first.
- Google Analytics: ask to be made Administrator. If the property sits inside the agency’s own Analytics account, ask them to move it into an account you own. Setting GA4 up properly is a separate topic.
- Google Business Profile: ask to be made primary owner. If nobody responds, use the request-access option on the profile; if the current owner does not reply within the time Google allows, you may be able to verify it yourself. Do not create a duplicate profile.
- Ads and social: Google Ads and Meta ad accounts, Facebook Pages and Instagram should be owned by your business with your payment method; the agency gets manager or partner access. Your ad history has value, so keep the same accounts.
Step 6: Email accounts
Losing email hurts more than losing a website. A DNS lookup of your MX records shows where mail runs: Google, Microsoft or your hosting company. If it is on hosting, back up every mailbox before that hosting ends. If it is Google Workspace or Microsoft 365, make sure you are super admin and the billing is in your name. Google Workspace has an admin-recovery route that relies on proving you control the domain’s DNS, and Microsoft 365 support typically asks for similar proof, which is one more reason the domain comes first.
How to ask so it actually happens
Send one polite written message, by email and WhatsApp, with the full list and a reasonable date, say ten working days. Thank them for the work. If an invoice is genuinely pending, pay it; settling a small bill is almost always cheaper than rebuilding. A modest fee for a few hours of handover work is fair if your contract does not cover it. The list can be this simple:
- Change the domain registrant to our business and move it to our account, or share the EPP code.
- Transfer hosting to our name, or share a full backup and the DNS records.
- Create an Administrator login for us on the website.
- Share the code repository, database dump and a list of third-party accounts.
- Make us owner or Administrator on Analytics, Search Console, Business Profile and ad accounts.
- Confirm our super admin access to business email.
If the agency does not respond
If the domain is in your name, the registrar’s support team may help you recover the account with ID, GST and payment proof, though they are not obliged to. A lawyer’s notice usually gets a reply. Formal dispute routes exist, INDRP for .in and UDRP for most other domains, but they are built for bad-faith registrations, so ask a lawyer whether your case fits before paying for one.
Be realistic about cost. If only the hosting is stuck and the site is a small brochure site, rebuilding on a domain you own can be quicker and cheaper than months of chasing. For comparison, our pricing for a business website of up to seven pages is ₹24,999 + 18% GST (see website development). But if the domain itself is lost, think hard before switching to a new one: you lose search history, links and everything printed with the old address.
The handover checklist
- Domain registrant is your business; registrar account email is yours; auto-renew is on.
- All DNS records saved in a document you control.
- Hosting billed to you; a full backup stored off the server.
- Your own Administrator login on the website; unknown admins removed.
- Theme and plugin licences in your name, or listed for renewal.
- Code repository, database dump and a signed IP assignment in hand.
- Email super admin confirmed; mailboxes backed up.
- Owner or Administrator on Analytics, Search Console, Business Profile and ad accounts.
- Every password changed and two-step verification switched on.
- All logins registered to a company email, not an employee’s personal Gmail.
That last point matters: an account on a former employee’s personal email is the same problem with a different name.
Stop it happening next time
Put ownership into the contract before work starts: all accounts in the client’s name, credentials handed over at launch, code assigned on final payment. Our guide to writing a website RFP has points you can reuse. At Codelith Lab we create the domain, hosting and every login in the client’s name from day one, and we work inside your accounts, not the other way round. If you simply want someone to look after the site once you own it, our maintenance cost guide explains what that should cost.
The short version
- Get the domain first: find the registrar with a WHOIS lookup, then get it into your name and your account, using an EPP code if you change registrar (.in only through NIXI-accredited registrars).
- Then hosting or a full backup, website admin, code with a written assignment, Google access and email super admin.
- Ask politely, in writing, with a list and a date, and pay any genuine dues.
- Owning your accounts does not mean leaving your agency; it means the keys are in your business’s name.
Frequently Asked Questions
Can my web developer legally keep my domain name?
If the domain is registered in the developer’s name, they are the registrant on record, which is why getting it changed matters. That does not settle who is entitled to it; your contract, invoices and conduct also count. Most cases end with a polite written request and settlement of any dues. If that fails, a lawyer’s notice is the usual next step, and formal routes such as INDRP for .in domains exist for bad-faith cases. Take legal advice before relying on any of them.
How long does it take to transfer a website from an agency?
With a cooperative agency, most handovers take one to two weeks. An internal domain move within the same registrar can happen the same day, while a transfer to another registrar typically takes five to seven days once the EPP code is shared. Hosting moves take a day or two, plus a week of overlap. Lock periods, commonly around 60 days after registration or a recent transfer, can delay things, so confirm them with your registrar as of 2026.
What is an EPP or auth code, and where do I get it?
An EPP code, also called an auth code or transfer key, is a password for a domain that proves a transfer request comes from the account holder. It is generated in the registrar account where the domain sits, after the transfer lock is switched off. If the agency holds that account, they need to generate it and share it with you. For .com and similar domains, ICANN rules require the registrar to give the registrant the code within five calendar days of a request.
Do I need to move my website to new hosting to own it?
No. If the hosting account can be put in your name and billed to you, you can stay with the same company and even the same agency. Moving is only necessary when the site sits on the agency’s reseller account, which cannot be handed over as a whole. In that case, ask for a full backup, restore it on hosting you own, test it, then switch DNS and keep the old hosting live for a week or two.
What if my old freelancer has disappeared and I cannot reach them?
Start with what you can prove. Search your email for registrar and hosting invoices, because the accounts may already be on your email address. If the domain is registered in your name, the registrar’s support may help you recover access with ID and payment proof. Search Console and Business Profile can often be reclaimed through DNS verification or Google’s request-access process once you control the domain. If the domain itself is lost, speak to a lawyer before deciding to rebuild on a new address.
