Own your domain and email. Don't rent them from anyone.

Every year, businesses lose their website, their email, or both. Not to hackers. To the nephew who set it up in 2019 and moved to Texas, to the freelancer who got angry over a late invoice, to the agency that went quiet and then went out of business. The site goes dark, the email bounces, and the owner discovers that none of it was ever in their name. Don't be that story. This guide gives you the five-minute audit, then the fix for each thing you find, with the exact steps and the exact words to use.

The five-minute audit

There are four keys to a business's online life: the domain (your address, like yourbusiness.com), the hosting (where the site's files live), the email (you@yourbusiness.com), and the passwords to all three. Answer these four questions honestly. "I'm not sure" counts as "no."

1. Whose name is on the domain? Go to lookup.icann.org, type your domain, and press Enter. Look at the "Registrar" line (the company it's registered with) and the "Registrant" section. Many domains hide the personal details for privacy, and that's fine, but the registrar should be a company where you have a login. If you've never heard of the registrar, or the registrant is your web person's name or company, that's a no.
2. Can you log in to the hosting? Not "can you ask someone to." Do you have an email and password, in your hands, that opens the hosting account? If your site is on a builder, that's the builder account. If you don't know where the site is hosted, that's a no.
3. Is your business email on your own domain, and in your own account? If your business runs on a personal Gmail, that's half a no. If it's on your domain but the account was created by someone else, that's a full no.
4. If your web person vanished today, could you change the phone number on your site by Friday? If the honest answer is "I'd have no idea how to reach anyone," that's a no.

Count the no's. Each one is a fix below. Do them this week, not "sometime," because the person you'd need to cooperate is friendliest now, before anything's gone wrong.

Rule one: the domain is registered in your account

The domain is the key that matters most. Whoever controls it can point it anywhere, and if it expires under someone else's card, it can be bought by a stranger. Here's how to fix each situation.

If you don't have a domain yet: register it yourself, tonight, before any web work starts. Go to any well-known registrar, search for the name, and check out with three things set correctly: the account email is your business email (not your web person's, not a staff member's), the card is your business card, and auto-renew is on. Then, in the account settings, turn on two-factor authentication so a password alone won't open it. Write the registrar name and the login into your password manager (rule four, below). Then give your web person access as a collaborator or manager, or just give them the technical settings they need. Never the account itself.

If someone else registered it for you: you need it transferred into an account you own. The steps, in plain terms:

1. Create your own account at a registrar, with your email, your card, two-factor on.
2. Ask the current holder (script below) to unlock the domain and send you the transfer code, sometimes called an EPP or authorization code.
3. In your new account, choose Transfer a domain, type the domain, and paste the code when asked. Transfers usually take a few days and the site keeps working during it.
4. When it lands, check lookup.icann.org again. The registrar should now be yours.

If the holder is your current web person and they're decent, this is a ten-minute favor. If they resist, that tells you something, and it's the moment to read our guide on what to ask before you hire anyone.

The domain is the key that matters most. Whoever holds it holds your address.

Rule two: business email lives on your own domain

A personal Gmail works until it doesn't: it's tied to one person, it looks amateur on a business card, and if that person leaves or the account gets locked, every customer thread goes with it. You want you@yourbusiness.com, in an account the business owns. Here's the setup with a hosted email service (Google Workspace is the common one; the steps are similar elsewhere):

1. Sign up for a business email plan using the domain you now own. Use the owner's details, not an employee's.
2. It will ask you to prove you own the domain by adding a small record at your registrar. It shows you exactly what to paste; log in to your registrar, find DNS settings, add the record, and come back. This is the step people find scary and it's copy-and-paste.
3. Create the address you'll actually use, like info@yourbusiness.com or yourname@yourbusiness.com. Keep it to one or two addresses to start.
4. Add it to your phone's mail app so you see messages the same day.
5. Set up forwarding from the old personal address for six months, so nothing falls through the crack, and update your Google Business Profile, your cards, and your website with the new address.

When someone else needs email at the business, create their address under your account. When they leave, you turn it off and keep the mail. That's the whole point.

Rules three and four: hosting access and a password manager

Hosting. Even if someone else manages the site day to day, you need owner-level access to the place it lives. Ask for it plainly (script below). What "owner-level" means: you can log in, you can add or remove other people's access, and you can download a copy of the site. If you're on a monthly plan with any studio, including ours, this should be the default. When we build a site, the domain is yours, the accounts are yours, and we hand you the keys in writing at launch. If you ever leave us, everything goes with you, and it should work that way everywhere.

Passwords. The fourth key is the one owners neglect: all of the above is useless if the logins live in one person's head or on a sticky note under the register. Set up a password manager this week. Any of the well-known ones works. Then:

1. Create the account under the owner's email, with a long master password you'll remember, and two-factor on.
2. Add four entries first: registrar, hosting, email, and your Google Business Profile login. Then add the scheduling tool, the payment processor, and social accounts.
3. For each entry, note in the comments who else has access and what they can do.
4. Share only what each person needs, through the manager's sharing feature, so you can revoke it later without changing every password.
5. Put a printed recovery code in the safe with the lease. If you're the only one who knows the master password, one bad week can lock the business out.

A worked example: what a hostage situation actually costs

Here's a hypothetical mechanic shop to show why this matters in dollars, not just in principle.

The shop's site was built by an agency that owns the domain. The agency charges $299 a month for "care," toward the top of the $99 to $499 range agencies typically charge. The owner wants to leave; a studio has offered a Growth monthly plan at $45 a month with 12 changes. But the agency holds the domain and won't release it without a "transfer fee" and three months' notice.

The cost of staying one more year: $299 × 12 = $3,588. The cost of the plan he'd rather be on: $45 × 12 = $540. The difference, $3,048, is what not owning the domain costs him this year alone, before the notice period, before the fee, and before the week of downtime if the handoff goes badly.

Now the version where he owned the domain from the start: he changes one setting at his registrar, the new site goes live under the same address, and the old agency gets a polite email. Total cost of the switch: an afternoon. The five-minute audit is cheap; the alternative isn't.

The email version is worse and harder to price. A dental office running on a receptionist's personal Gmail loses that receptionist, and with her, every patient thread, every lab email, and the address printed on 2,000 appointment cards. There's no invoice for that, just a long, bad month.

Not owning your domain is a monthly bill you can't see until you try to leave.

What to say to your web person

Most of these conversations go fine if you're plain and unembarrassed. You're not accusing anyone; you're asking for what's yours. Send this by email so there's a record:

"Hi [name], I'm doing some housekeeping on the business accounts and want to make sure everything is in the business's name. Could you please: (1) transfer the domain [yourbusiness.com] to my registrar account, or send me the unlock and transfer code so I can do it; (2) add [your email] as an owner on the hosting account; and (3) confirm the business email accounts are under my control. You'll keep whatever access you need to do the work. Thanks, and let me know if there's a cost for any of this."

If they say "it's easier if I keep it": "I understand, and I still want it in my name. You'll have all the access you need." If they say "there's a fee": "Please send me the amount in writing and I'll decide." If they don't answer in a week, send it again with "second request" in the subject, and start the transfer from your side; registrars have a process for that when the listed registrant is you.

If the listed registrant isn't you and the person won't cooperate, that's the point where a good studio can walk you through your options. It's rarely hopeless, but it's slow, which is why doing this before there's a problem matters.

Common mistakes

• Letting the web person register the domain "to save time." It saves ten minutes and costs you the address. Fix: register it yourself first, then give them access.
• Auto-renew off, or on an expired card. The domain lapses quietly, the site vanishes, and someone else buys the name. Fix: auto-renew on, a card that won't expire this year, and the renewal email going to an address you read.
• Registering with a staff member's or relative's email. They leave, and the reset emails go with them. Fix: the owner's email on every account, always.
• Business email on a personal Gmail. Fix: you@yourbusiness.com under an account the business owns, with forwarding from the old one.
• Passwords in one head. Fix: a password manager, shared properly, with a recovery code in the safe.
• Not asking until there's a fight. Everyone's cooperative before the relationship sours. Fix: send the housekeeping email today, while things are fine.

Your ownership checklist

• lookup.icann.org shows a registrar where I have a login.
• The registrar account is under my email, my card, auto-renew on, two-factor on.
• I can log in to the hosting as an owner and could download the site today.
• Business email is on my domain, in an account I own.
• Every login is in a password manager under my email.
• A recovery code is printed and in the safe.
• My web person has the access they need and no more.
• I have the handoff in writing: what I own, what they manage.

The free website checklist has these lines with room to write, next to the other things a site needs to get right.

Questions owners ask

My web guy says it's normal for him to hold the domain. Is it? It's common. It isn't good. Plenty of honest people do it out of habit, and they'll transfer it the moment you ask. If someone won't, that's the answer to a different question.

Will my site go down during a domain transfer? Normally no. The transfer moves the account the domain is managed from; the settings that point it at your site come along. Ask whoever's helping to confirm the DNS settings are copied over before the transfer, and check the site the day it completes.

Do I really need email on my domain? Everyone knows my Gmail. You need it for the reasons above: it belongs to the business, it survives staff changes, and it looks like a business. Keep the Gmail forwarding for a while so nobody's lost.

What do you own if you build my site? Nothing. The domain is registered in your account, the hosting and email are yours, and we give you the logins in writing at launch. The monthly plan covers keeping the site accurate, not holding it hostage. After the first twelve months you can cancel and everything stays with you.

I found out the domain is in a former partner's name. Now what? Ask them first, politely, with the email above. If that fails, contact the registrar's support with proof the business is yours (formation papers, the site content, invoices). It's slow but it's a known process, and it's exactly the situation the five-minute audit is meant to catch before it happens.