Who Owns Your Domain? A Small Business Account Audit

The owner of a small plumbing company decides to switch web designers. The new designer asks a simple question: who has the login for the domain? Nobody knows. The previous designer registered it years ago, on their own registrar account, with their own email address as the contact. They have since closed the business and stopped answering email. The website still works today, but the renewal notices go to an inbox nobody reads, and the day the card on that account expires, the company's website, email and every link printed on its trucks stop working at once.

This is one of the most common and least discussed risks in small business marketing. It is not a hacking problem. It is a paperwork problem, and it tends to surface at the worst possible moment: during a vendor change, a dispute, a sale of the business, or the week an employee who set everything up leaves.

Why this happens to careful people

Nobody sets out to hand their domain to a contractor. It happens because the person doing the setup is the one with the credit card out and the browser open. A designer registers the domain on their reseller account because it is faster. An office manager creates the Google Business Profile with a personal Gmail because that is what they were logged into. An ad agency builds the Meta ad account inside its own Business Manager because that is how its tooling works. Each decision is reasonable in the moment. Together they leave the business renting its own identity from people it does not employ.

The fix is not complicated, but it is tedious, which is why it rarely gets done until something breaks. The rest of this guide is the afternoon of work that prevents that.

The seven accounts that matter

Most small businesses have more accounts than this, but these are the ones where losing access causes real damage, roughly in order of how bad the damage is.

1. Domain registrar. Whoever controls the registrar account controls the domain. Everything else depends on it: the website, email, and the ability to prove ownership to Google and Meta.
2. DNS. Often at the registrar, sometimes at a separate provider like a CDN. DNS decides where the website and email actually go. Someone with DNS access but not registrar access can still take the site offline or redirect mail.
3. Business email. Google Workspace, Microsoft 365, or the host's mail. Password resets for every other account land here, so whoever administers email effectively administers everything.
4. Web hosting. The server or platform where the site files live, plus backups. Losing hosting access without a copy of the site means rebuilding from scratch.
5. Google Business Profile. Your map listing, reviews and photos. Ownership is separate from the website and is frequently held by a former employee's personal account.
6. Analytics and Search Console. Years of history about where customers come from. Not fatal to lose, but painful, and Search Console verification is what lets you fix indexing problems.
7. Ad and social accounts. Meta Business portfolio, Google Ads, and the pages and profiles attached to them. Ad accounts hold spend history, audiences and pixel data that cannot be moved to a new account.

How to check each one without a login

You do not need access to start the audit. You need to find out who has it.

• Registrar: run a WHOIS or RDAP lookup on your domain. Most registrant details are now privacy-masked, but the lookup still shows which registrar holds the domain and when it expires. If the registrar is one you have never heard of, that tells you it was registered on someone else's account.
• DNS: the same lookup shows the nameservers. They tell you which company answers for your domain, which is where you need a login.
• Email: check which admin console your mailbox belongs to. If you cannot name the person who is a super admin, that is the first gap to close.
• Google Business Profile: sign in with the account you believe owns it and open the profile's people and access settings. If you only see a manager role, someone else is the primary owner.
• Meta: open Business Settings and look at who owns the ad account and the page. An ad account owned by an agency's business portfolio and shared with yours is theirs, not yours.
• Google Ads and Analytics: check the account access page for admin users, and look for addresses at domains that are not yours.

What ownership should look like

The target state is boring, and that is the point. Every account is owned by the business, not a person, and every vendor is a guest who can be removed in one click.

• Registrar, DNS and hosting accounts are opened in the business's name, with a shared role address such as an admin mailbox on your own domain, not a personal inbox.
• At least two people inside the company hold owner or super-admin access on every critical account, so one departure never locks you out.
• Agencies and freelancers are added as users or partners on your accounts. They do not create accounts on your behalf inside their own.
• Two-factor authentication is on everywhere, with backup codes stored in a company password manager rather than on one person's phone.
• Auto-renew is on for the domain, attached to a company card, and the renewal contact is an address that someone actually reads.

Taking back an account someone else holds

If the audit turns up an account in someone else's hands, the order of operations matters. Start with the registrar, because a domain is the one asset that can be genuinely lost if it expires and someone else registers it.

If the previous vendor is reachable, ask them to transfer it. For a domain that usually means unlocking it and giving you the transfer authorization code so you can move it to a registrar account you own. Registrars generally block transfers for a period after a recent registration or transfer, so plan for that delay rather than being surprised by it. For Google Business Profile, the current owner can transfer primary ownership to you directly. For Meta, the agency can transfer the ad account or page to your business portfolio.

If they are not reachable, each platform has a recovery path, and all of them run on evidence. Registrars accept disputes from the registrant of record with supporting documents. Google Business Profile has an ownership request flow that notifies the current owner and escalates if they do not respond. Meta has a process for claiming pages tied to a business you can prove you run. Gather the documents before you start: business registration, invoices showing you paid for the domain or the ads, and anything that ties the account to your company.

The right time to fix account ownership is the week nothing is wrong. Every recovery flow is slower and more stressful when the site is already down.

Build the register and keep it current

Once the audit is done, write it down in one place: each account, the platform, who owns it, who else has access, where the recovery codes are stored, and when it renews. A shared spreadsheet is enough. Review it whenever someone joins or leaves, whenever you hire or fire a vendor, and at least once a year alongside the domain renewal.

The register is also the first thing a new agency or marketing hire should see. It turns a week of access requests into an afternoon, and it makes clear from day one that your accounts belong to you.

Where to start today

If you do only one thing this week, look up your domain's registrar and expiry date and confirm you can log into that registrar account yourself. If you cannot, everything else in your marketing is sitting on a foundation you do not control. If you would rather have someone walk through the full audit with you, get in touch with NetWebMedia and we will map what you own and what you are renting.

← Back to all articles