Who owns your website: domain, code and hosting

Three separate things, and they can have three different owners. You can check today, in ten minutes, without asking anyone.

By João Borges, founder of Firmitas

Blog

Your site is three separate properties The site's name, the code and content, and the hosting with the accounts: three independent properties that can be in different hands. The domain is the only one of the three that cannot be replaced, which is why it is the first to check. “My website” is three things. Separate, and they can have three different owners. NOT REPLACEABLE 1 The domain The name. Rented, with an owner. 2 The code The pages, the text, the photographs. 3 The hosting Where it is stored and who has the key. The other two can be replaced. So the domain is checked first.
One of the three cannot be replaced. That is why you check it first.

Somebody wants to change an address in the footer of the company website, or change supplier, or simply work out why the site stopped loading on a Tuesday morning. And they find they cannot do any of it on their own.

The site belongs to the company in the sense that it speaks for the company and the company paid for it. In no other sense. This is almost never fraud: it is accumulated convenience. There is a way out of it, and the way out is far cheaper before than after.

Your site is three separate properties

«My website» is, in practice, three independent properties, and each one can be in different hands.

The domain is the name. It is rented, not bought: it renews in fixed periods and it has a registered owner. It is also the only one of the three that cannot be replaced. Losing the domain means losing the address that the business cards point at, and the email signatures, and the Google listings, and every other place where somebody once wrote the address down.

The code and the content are the site itself: the pages, the text, the photographs, the stylesheet. That can be replaced, with work and with money, but it can be replaced.

The hosting and the accounts are where all of it is stored and who holds the key. That can be replaced too, as long as there is access to the domain to point the name somewhere else.

That is the order of importance, and it is the order worth checking in.

The public lookup only answers half of it

For a .pt domain, the national registry is run by Associação DNS.PT and it has a public lookup. Type your domain, aminhaempresa.pt or whatever it is, into the public lookup for .pt domains and read what comes back.

What comes back is the domain name, the registration and expiry dates, the technical status and the registrar, which is the company the domain was registered through. The owner’s personal details appear only where the owner has consented to publication. So a missing name proves nothing on its own. The wrong name, though, proves plenty.

On a .com or a .net, the equivalent lookup returns the owner fields hidden in most cases, for data protection reasons. It still serves to show the dates and the registrar, but it does not answer the ownership question.

Hence the three checks below, which work with any domain and depend on nobody:

  1. See who gets the renewal notice. The domain renews every year or every two years. Whoever receives that email controls the domain in practice. If your company has never received one, it is not your company.
  2. Ask to log in to the account, today, with a company email. The account the domain is registered in. You do not need to change a thing: either you get in, or you already have your answer.
  3. Check what the recovery email on the account is. This is the detail that decides everything when somebody resigns, moves on or stops replying. If the password reset lands in a mailbox the company has no access to, the account is not the company’s.
What the public lookup answers, and what it does not The public .pt registry directory shows the domain name, the registration and expiry dates, the technical status and the registrar. The owner appears only where they have consented to publication, so that line does not answer on its own. Three checks follow that always work: who gets the renewal notice, who can log in to the account, and what the account's recovery email is. The public .pt registry lookup The fields it returns for any .pt domain. Domain name aminhaempresa.pt Registration and expiry dates shown Technical status shown Registrar shown Owner only if the owner consented A missing name proves nothing on its own. The wrong name does prove it. On a .com or a .net the owner is usually hidden. Three checks that always work Whatever the domain, and without waiting for anyone. 1 Who gets the renewal notice Whoever gets it controls the domain in practice. If you never have, it is not your company. 2 Who can log in to the account Ask to log in today, with a company email. You need not change a thing. 3 What the recovery email is If recovery lands in a mailbox outside the company, the account is not the company's.
The public lookup gives half the answer. The three checks give the other half.

How the site was built decides what you can take

Here the answer depends on the build, and there are three cases.

  • A system installed on hosting, WordPress and the like: the site is a set of files plus a database, and both can be copied. Ask for access to the hosting panel, or for a complete backup handed over to you.
  • Custom code: what exists is a repository of files. It should sit in a company account, or have been handed over. Ask for it.
  • A closed platform, the kind where you drag blocks onto a page: the site is not transferable, and no contract clause changes that.

In the third case the text and the photographs are yours and can be copied out by hand; the build stays on the platform and disappears the day you stop paying. This is not an argument against those platforms: for some businesses they are the right choice. It is something to know before, not after.

How the site was built decides what you can take Three columns with the same shape. With a system installed on hosting and with custom code, the site goes with you: it is files, a database or a repository. On a closed platform the build stays on the platform and only the text and the photographs can be copied out by hand. How it was built decides what you can take Three ways to build, and one has no way back. Portable With access to the panel. Installed system WordPress and similar. Files plus a database. They can be copied. Ask for panel access or a complete copy. Portable It is in a repository. Custom code A repository of files. It should sit in a company account, or have been handed over. Ask for it. Not portable Stays on the platform. Closed platform You drag blocks onto a page. The text and photographs are yours, copied out by hand. The build stays there. No contract clause makes what stays on the platform transferable. Not a flaw: it is something to know before, not after. Commissioned photographs carry their own licence, with limits on use and term.
Two of these builds go with you. The third stays where it is.

The photographs deserve a note of their own. If they were commissioned from a photographer, there is a licence with limits on use and on term. It is worth knowing what they are before carrying the images over to a new site.

Four sentences settle it in writing

If all four are in the quote or the contract, the matter is settled:

  1. The domain is registered in the name of the client company, which is the registered owner.
  2. The registry, hosting and analytics accounts are opened with a client company email and stay accessible to the company.
  3. At the end of the work, the client receives a complete copy of the site: files, the database if there is one, and images at original size.
  4. If the client asks to change supplier, the studio helps with the handover and does not hold it up.

They are four sentences nobody who works properly minds signing. A serious quote names them without being asked, and the reaction of whoever wrote it, when you do ask, tells you more than the quote does.

If the owner is not your company

Do not panic and do not make threats. In the overwhelming majority of cases, the right request settles it.

Ask in writing, politely and without drama, for three concrete things:

  1. Transfer of ownership of the domain to the company.
  2. A complete copy of the files and of the database.
  3. Access to the accounts.

Give a fair deadline and keep the reply.

If there is no reply, the technical route still exists, and this is where the order of importance matters again. With control of the domain, a new site can go live at the same address and the company loses nothing structural: it loses the work done, not the identity. Without control of the domain, the conversation becomes a legal one. That is why the domain is the first item on this list and not the last.

The request, and the door that decides the rest First the written request: ownership of the domain, a copy of the files and access to the accounts, with a fair deadline. If there is no reply, everything turns on one question: do you control the domain? With it, a new site goes live at the same address. Without it, the conversation becomes a legal one. If the answer is no No panic and no threats. In most cases, the right request settles it. Ask in writing, for three concrete things Ownership of the domain A copy of the files Access to the accounts Give a fair deadline. Keep the reply. IF THERE IS NO REPLY Do you control the domain? With control of the domain Nothing structural is lost. A new site goes live at the same address. You lose the work done, not the identity. Without control of the domain The conversation moves ground. The conversation becomes a legal one. That is why the domain is the first item, and not the last.
After the request, everything turns on a single question.

In most cases it is accumulated convenience

It is worth saying this fairly. Registering the domain in the studio’s own account, on day one, saves half an hour and an exchange of emails. Multiply that by a few years and a studio ends up with dozens of client domains in a single account, without ever having decided that was what it wanted.

There is also a second category, smaller, where the convenience is deliberate and serves to stop anyone leaving. From the outside there is no way to tell one from the other, and there is no need to: the questions are the same and the answers are settled the same way.

If you would like somebody to look with you at what you have today and tell you plainly what is in whose name, book a 15 minute call. It is a short conversation and, most of the time, it ends with good news.

Sources

  • Public lookup for .pt domains, at Associação DNS.PT: pt.pt/pt/whois.
  • What the directory shows: «Política de WHOIS sob o domínio de topo .PT» (the WHOIS policy for the .PT top-level domain): pt.pt (PDF). The owner’s personal data is published only where consent has been given.

Consulted on 9 August 2026. This article does not describe the ownership transfer procedure step by step: see the .PT registration rules in force.

Talk to us

Want to know what we would do with your site?

Book a 15-min call