Who Controls Your Domain and Hosting? An Account Ownership Checklist
Guides / Account ownership and recovery
Documentation checked: October 5, 2026. HRL combines official documentation with a practical account checklist. This is not a hands-on recovery test or a determination of legal ownership.
Being able to edit your homepage does not prove that you control the accounts keeping it online. The domain, hosting subscription, DNS and WordPress dashboard may have different account holders. If a developer set everything up, establish who can renew, recover and move each service before the relationship changes.
Separate registration, billing and working access
“I own the website” is too broad to serve as an account record. Record the named subscriber or registrant, the payer, the people with administrative access and the recovery contact separately. An invoice can help locate a subscription; it does not establish every person’s account permissions or settle a dispute over ownership.
| Service | Control to establish | Practical evidence |
|---|---|---|
| Domain registrar | Registration account and authorized management | Registrar, registration details, renewal date and supported account access |
| Hosting | Subscription, billing and support authority | Account holder, plan, invoices and who can request a move or restore |
| DNS or CDN | Authority to manage the correct domain | Account, domain identifier and effective member permissions |
| WordPress | Content and site administration | Individual user accounts and their effective capabilities |
| Email and backups | Recovery and continued service | Responsible account, renewal bill and accessible backup location |
Check the domain at its registrar
ICANN’s domain transfer FAQ explains how to identify a registrar through ICANN Lookup and distinguishes changing registrars from changing the registrant. Public registration information may be limited; review the actual account records with the registrar rather than treating a public lookup as complete proof.
Ask the authorized account holder to confirm registration details, renewal settings and who can request the relevant changes. If a registrar transfer is planned, follow that registrar’s process and check applicable locks before setting a deadline. A hosting move, domain transfer and registration change are different tasks. Our domain transfer versus DNS guide explains the operational distinction.
Verify permissions in each system
WordPress documents roles and capabilities for tasks within the site. Administrator access to a single WordPress site does not itself establish access to its hosting billing account or domain registrar. Custom roles and Multisite can also change what a user can do.
Where supported, use individual delegated accounts instead of sharing a contractor’s login. Cloudflare’s members and permissions documentation provides one example of this model. Check the actual service’s permissions: access to one client’s domain need not grant authority over an agency’s entire portfolio.
Understand an agency-managed arrangement
A site can legitimately run inside an agency’s hosting subscription. HRL recommends documenting which service the business is purchasing, who handles renewals, what access is included and what happens when maintenance ends. Ask for the exit procedure and deliverables in writing.
For example, a business may manage WordPress content while an agency manages servers and backups. The missing item is not necessarily a hosting password; it may be an agreed export, migration or restore procedure. Review the export versus backup guide before assuming a downloadable file can recreate the complete site.
Confirm recovery without creating a lockout
Check that the responsible person can reach the recovery email and locate the approved recovery method. Cloudflare’s two-factor documentation explains storing backup codes securely and notes that regenerating them invalidates the old set. Follow your provider’s procedure; do not reset everyone’s credentials just to check whether a record exists.
Keep passwords, recovery codes and transfer codes in a secure vault, separate from a circulating service register. Record where authorized people can find them. If access is already missing, use the hosting account recovery checklist.
Use the domain renewal checklist to verify the payer, renewal setting and completed registration. If expiration has already interrupted service, follow the expired-domain recovery checklist alongside account recovery.
Close the gaps in an agency handover
In a hypothetical agency arrangement, the business controls WordPress editing while the agency holds hosting. Record whether the business can request a restore, obtain exports and continue service when maintenance ends. Identify the domain registrant and separate renewal payer as well. These answers establish an operating handover; a shared administrator password does not resolve subscription authority or the exit procedure.
Finish with a clear control record
For every service, record the responsible business contact, verified access date, remaining gap and next action. Use the broader website handover checklist for project delivery. This page’s acceptance test is narrower: can the authorized people manage renewals, obtain support and follow the agreed recovery or exit procedure?