Here is a question most business owners cannot answer: if your web company vanished tomorrow, would your website keep working, and could you get into it?
For a worrying number of businesses the honest answer is no. Not because anyone set out to trap them, but because it was easier at the time to let the web company "handle all that". Five accounts decide who really owns your website. Check each one today.
1. The domain
Your domain is the single most valuable digital asset you have. Search WHOIS for your domain (any lookup tool works) and look at the registrant. If it is your web company's name, they own your address, and moving away from them means asking permission to take your own name with you.
The fix: ask for the domain to be transferred to a registrar account in your name. A reputable company does this without fuss. Resistance tells you everything.
2. The hosting
If your site is hosted in the agency's own account, you cannot see it, back it up, or move it. When the relationship ends, the site ends with it, and rebuilding from scratch is quoted accordingly.
The fix: hosting should be an account in your name with the agency added as a collaborator. Modern hosting for a small business site costs little or nothing, so a large monthly "hosting" line is usually paying for the lock, not the server.
3. The code
Ask where the code for your website lives, and who can access it. The right answer is a repository, usually GitHub, owned by you, with the developer added to it. If the only copy lives on the developer's laptop or their server, one departure, dispute or hard drive failure takes your site with it.
4. The CMS
The content management system holds your words, your images, your product list. If your login is a user inside the agency's account, your content is theirs to hold. This is also where WordPress maintenance contracts quietly earn their keep: the plugins, the licences and the admin all belong to someone else.
The fix: the CMS workspace should be created under your email address, with the agency invited in.
5. The Google accounts
Google Business Profile, Search Console and Analytics. Agencies routinely set these up under their own Google accounts, and every one of them is painful to recover later. Your Business Profile in someone else's account means your map listing, your reviews and your customer messages are controlled by a supplier.
The fix: each of the three lets you add managers. You should be the owner; anyone helping you should be a manager you can remove.
The pattern
Ownership is not a document. It is whose email address is on the account.
Every one of the five has the same shape: the asset should sit in an account registered to you, and the people who help you should be collaborators you invited. That arrangement costs nothing extra. The only thing it removes is the lock in.
It is also, for what it is worth, how we build every site: domain in your Cloudflare, code in your GitHub, CMS in your Sanity, profiles in your Google account, from day one. Not because we are saints, but because a client who stays out of choice is better business than one who stays because leaving is expensive. That thinking runs through the whole product, and if you want to check your own setup against the five, the free audit takes two minutes.