Here is a question worth asking yourself right now: if the person who built your website stopped answering the phone tomorrow, could you still change your own opening hours?

For a surprising number of Australian small businesses, the honest answer is no. Not because anyone did anything malicious, but because nobody ever wrote down who holds what. Then the designer moves interstate, or gets a full time job, or the agency folds, and a business discovers it does not actually control its own front door.

This is not a technical problem. It is a paperwork problem, and you can sort it out in an afternoon.

The four things, and why they are separate

People say "my website" as though it is one object. It is four, and they are often held by four different parties. This is the root of nearly every horror story.

1. The domain name. Your address: yourbusiness.com.au. You rent it, usually yearly, from a registrar. This is the important one. Whoever controls the domain controls where your website and often your email actually point. Lose it and you lose both, and your Google rankings with them.

2. The hosting. The computer your website's files sit on. Rented monthly or yearly. Easier to replace than a domain, but you need to be able to get the files off it.

3. The website files themselves. The actual pages, images and code. On some platforms these are portable. On others they are effectively locked to the platform.

4. The accounts around it. Google Business Profile, analytics, the email accounts, any booking or payment tools. These get forgotten until you need them.

You want your business to own numbers 1, 2 and 4 outright. Number 3 depends on the platform, and it is worth knowing which situation you are in before you need to leave.

The fifteen minute audit

Do this now. You do not need anyone's help.

Check the domain first. Go to auda.org.au for a .com.au, or any public WHOIS lookup for a .com. Search your domain. Look at the registrant.

Your business name and ABN? Good. You own it.
Your web designer's name or their company? That is a problem to fix, calmly and now, not in an emergency.
A privacy shield? Common and not automatically bad, but you need to confirm underneath it.

For .com.au there is a detail worth knowing: Australian domains have eligibility rules tied to an ABN or business name. The registrant contact is the legal holder. If that is not you, you do not hold your address.

Then check you can actually log in. Not that you have a password written somewhere. Actually log in, today, to:

The domain registrar
The hosting account
The website editor or CMS
Google Business Profile

If any of those are "I'd have to ask him," you have found your answer.

Then check the email. This is the one that catches people out. If your email is you@yourbusiness.com.au and it is routed through the same domain, then whoever controls the domain can, deliberately or by accident, take down your email. Losing a website for a week is embarrassing. Losing every incoming email for a week is a genuine emergency.

Why it goes wrong

Almost never through malice. The usual causes are boring:

It was set up "temporarily" on the designer's account to get the job moving, and nobody circled back.
A mate or a relative did it. They meant well and used their own logins because it was easier. Now they have a new job in Brisbane and do not really want to talk about it.
The agency bundled it. Domain, hosting and support in one monthly fee, on their accounts. Convenient right up until you want to leave, at which point it is leverage.
The person genuinely disappeared. They got sick, or moved on, or the business folded. There is nobody to be angry at, and there is also nobody with the password.

The pattern is the same every time: nobody had a bad intention, and the business still ends up stuck.

What to do if you do not own it

If the relationship is fine, just ask. This is a completely normal request and any decent operator will action it without drama:

"Hey, I'm getting our business records in order. Can you transfer the domain to an account in the business's name and send me the logins for hosting and the site? Happy to keep working with you either way."

That last sentence matters. You are not firing them. You are separating ownership from service, which is exactly how it should have been from the start. Anyone who reacts badly to that request has told you something useful.

If they have gone quiet, you have options and it is rarely hopeless. Domain registrars have processes for recovering a domain when you can prove the business is the legitimate holder. It takes paperwork and patience. Start before it expires, not after, because an expired domain can be bought by anyone, and there is a small industry of people who watch for exactly that.

If they refuse, that tells you what the relationship actually is. Get help. But also know that in the worst case you can rebuild: a new domain is survivable, if painful. What is not survivable is doing nothing until it lapses.

How it should be set up

For the record, this is how we do it, and how we think anyone should:

The domain is registered to your business, with your ABN, in an account you control. We can manage it. We do not own it.
You have every login. Domain, hosting, CMS, analytics. In writing, at handover.
You can leave. If you want to go elsewhere in two years, you take your domain and your content and go. A studio should keep your business because the work is good, not because they are holding your address hostage.

That is not generosity, it is just the correct arrangement. Any leverage a web company holds over you is leverage they did not earn.

The short version

Spend fifteen minutes today. Look up your domain, try to log in to your four accounts, and check who your email actually depends on. If it all comes back in your name, close the tab and get on with your day. If it does not, you have found a problem while it is still cheap to fix.

The worst time to discover you do not own your website is the day you need to change something urgently.

Who Actually Owns Your Website? Domain, Hosting and Logins