Who owns your website? How to verify in 5 minutes

When you ask a director “who owns your website?”, the answer is almost always: “me, obviously.” When we verify, we often discover that the domain is in the provider’s name, the hosting on their credit card, the source code on their private GitHub, and the Google Analytics accounts linked to their email. The company has paid for years — but owns nothing.

This isn’t an abstract question. The day you want to change provider, redo your site, or simply react to an unexpected event (acquisition, departure, conflict), knowing who holds what determines your room for manoeuvre. Too late when you discover the situation — not too late if you verify now.

Here’s the method to map in five minutes the real ownership of each of the four assets that make up your website.

4 assets, 4 possible owners

A website isn’t one asset. It’s four separate assets, each potentially held by a different person:

1. The domain name — yourcompany.lu. Registered with a registrar.
2. The hosting — the server where the files and database live.
3. The source code — the HTML, CSS, scripts that make the site work.
4. The content and media — texts, images, videos.

Each of these has its own entry point, its own proof of ownership, and its own transfer procedure if needed. The misconception that penalises directors most: thinking “I paid so it’s mine” is enough. Legally and operationally, that’s almost never true without explicit documentation.

Check who holds your domain name (WHOIS)

It’s the most critical asset — without the domain you lose your emails, your ranking, your brand. And it’s the easiest to verify.

3-minute action: open the public ICANN WHOIS lookup (rel="noopener") or equivalent. Type your domain. Look at the “Registrant” field:

• You see your personal name or your company’s legal name → you’re the owner. Healthy situation.
• You see the name of the provider who made your site → you’re not the owner, you’re a tenant. Often legal but risky.
• You see “Privacy Protected” → the data is masked. Ask your provider for a WHOIS extract with privacy disabled to verify.

For .lu specifically, DNS.lu (rel="noopener") — the official Luxembourg registry — directly displays the holder of each .lu domain.

Who pays for hosting = who has access

The hosting is the server where your files and database live. Three questions to ask:

• Who pays the monthly bill? If your provider pays and re-invoices you, you’re not the account holder.
• Do you have credentials to log into the hosting? Not just for the CMS — for the hosting provider’s admin panel itself.
• Is the account in your name? Open the account with your host, go to “Profile” — verify the holder’s name matches your company.

If the account is in your provider’s name, request an NIC transfer (account ownership change) or create your own account and migrate the data. Without this step, you don’t own the infrastructure.

The full recovery procedure is detailed in reclaim your website when the agency stops responding — useful to read in parallel, even if you’re not (yet) in a ghosting situation.

The source code: where is it really?

The source code is the set of technical files that makes your website work. Three questions:

• Where is it stored? On a Git repository (GitHub, GitLab, Bitbucket)? On a hard drive at your provider’s? On the hosting server only?
• Who owns the intellectual property under the contract? In Luxembourg by default, code created by a provider stays their intellectual property. You have a right of use if you’ve paid — not a right to assign or modify, except in writing.
• Can you access it now, without asking permission? If the answer is no, you’re not the owner in operational terms.

2-minute action: ask your current provider for the Git link to the repository where your code lives. Request to be added as “Owner” of the repository (not just “Collaborator”). If they refuse or delay — it’s a strong signal worth investigating.

The ideal: the Git repository is on a GitHub (or GitLab) organisation owned by your company, and your provider is invited as a contributor — not the other way around.

Content and media: the grey zone

Content (texts, images, videos, professional photos) is the asset most neglected contractually. Questions to clarify:

• The site’s texts — who wrote them? If it’s your provider or a freelance writer they hired, you need an explicit rights assignment.
• Professional photos — who holds the rights? Did the photographer grant you a usage licence, or just sold files?
• Stock images (Unsplash, Pexels, Adobe Stock) — what’s the licence? An SME in Luxembourg ended up paying several thousand euros for using a stock image whose licence didn’t cover commercial use.
• Videos — same as photos. Explicit rights assignment or not.

2-minute action: on 3 random pages of your site, ask yourself: “If I change provider tomorrow and want to reuse these texts and images in the new site, do I have written authorisation?” If the answer isn’t a clear yes, there’s a topic to regularise.

The contract no one reads

Ownership of all these assets is ideally settled in the initial contract. Clauses to verify in your current contract (or to require for the next one):

• Domain name ownership — explicitly in the client’s name.
• Admin access — explicitly transferred to the client, on accounts in the client’s name.
• Assignment of source code rights — under condition of full payment.
• Assignment of content rights — for texts, visuals, videos.
• Reversibility — explicit clause: in case of termination, the provider delivers within X business days all the exports needed.

If you don’t have a written contract with your current provider — which we see regularly, especially for sites created more than 5 years ago — the situation is even more vague. Request a signed amendment that retroactively formalises ownership.

Take back control properly

If the audit reveals you’re not the owner of one or more assets, here’s the sequence to take back control without drama:

1. List precisely who owns what. Without judgement, just the factual observation.
2. Request a transfer of ownership from your current provider for each asset where it’s not the case. In writing, with a reasonable deadline (15-30 days).
3. For the domain — request the transfer code (auth code, EPP code). It’s legally your right if you’re the paying end client.
4. For hosting — request an NIC transfer or create your own account and migrate.
5. For the code — request a Git repository in your name with full history.
6. For content — sign a retroactive rights assignment amendment if needed.

If your current provider resists or delays, this is precisely the scenario covered by reclaim your website when the agency stops responding — legal recourse, escalation to the registrar, technical plan B.

One single contact from start to finish, not an intermediary who holds the keys instead of you. That’s the angle Slash.lu has defended from the start: ownership of your site must stay with you, from the initial contract.

---

Frequently asked questions

My provider is nice and trustworthy, why should I verify?

Because personal trust doesn’t cover unforeseen events. Illness, departure, acquisition of the agency, personal conflict, death — as many situations where trust no longer suffices, and documentation becomes the only recourse. Verifying ownership of your assets isn’t a sign of distrust toward your current provider. It’s operational hygiene practised in all mature companies.

If I paid for my site, I should automatically own it, right?

Legally, no. In Luxembourg and most European countries, code created by a provider stays their intellectual property unless explicitly stated otherwise. You have a right of use if you’ve paid for that use — not a right to assign or freely modify. It’s the same logic as a photographer: you buy the usage of a photo, not the ownership.

How to quickly verify the 4 assets in less than 10 minutes?

WHOIS for the domain (3 min), connection to hosting and verification of holder (3 min), request to your provider for the Git link (2 min by email), visual audit of texts and images (3 min for 3 pages). If any of the four isn’t clear, that’s what to dig into priority.

My provider refuses to give me the accesses. What to do?

Formal notice by registered mail with acknowledgement. If no response, recourse to the registrar for the domain (forced transfer procedure), new hosting account in parallel, and technical reconstruction if necessary. The procedure detail is in reclaim your website when the agency stops responding.

---

Going further

If your verification reveals you’re not fully the owner — and your current provider doesn’t cooperate: reclaim your website when the agency stops responding details the complete action plan.

---

What we do at Slash.lu

At the start of every project, we install the four assets in the client’s name: domain, hosting, code in a Git repository owned by the client, clear contract on content rights. The client can replace us tomorrow morning without losing anything. That’s the condition for us to work serenely together — not a trap we keep up our sleeve.

Let's talk about your situation. Book a call — no commitment, reply within 24h.

→ Explore our web design service for the details of our method.