Three logins determine whether you control your website: the domain registrar, the hosting account, and the site admin — and most owners of small business sites hold none of them. Getting them is a routine request, and it’s far easier before a dispute than during one.
The moment it happens
Do you have a single password to your own website? The question usually gets asked when something needs doing and the developer isn’t replying. Until then it never comes up, because the site works and access has never been necessary.
That’s the trap: access matters only at the moment you can’t get it.
The three logins, and what each controls
| Login | What it controls | If you don’t have it |
|---|---|---|
| Domain registrar | Your business name online; renewals; where the site points | Someone else can move, renew or hold your name |
| Hosting account | The space the site lives in; backups; email | You can’t restore, move, or fix an outage |
| Site admin (CMS) | Text, prices, photos, pages | Every edit needs someone else |
Ranked by consequence, the domain matters most. A hosting problem is recoverable if you hold the domain and a backup. A lost domain takes your email address and your search presence with it.
There’s often a fourth: your business email, if it runs on the domain. Ask about that too.
Find out what you actually have
Ten minutes:
- Domain: search “whois” plus your domain. Read the registrant name and email. If it isn’t yours, you don’t control the domain regardless of who paid.
- Hosting: do you know the provider’s name? Can you log in? If renewal invoices come from a company you’ve never dealt with directly, the account isn’t yours.
- Admin: try the login. Many owners were given credentials at handover, never used them, and don’t remember having them.
- Email: if your business email is on your domain, find out whose account administers it.
Write down what you have and what’s missing. That list is the request.
Asking for it, without making it a dispute
Frame it as housekeeping, because that’s what it is. Vendors deal with this request routinely and most comply without comment:
Could you share the following for our records: registrar name and domain login (or the authorisation/EPP code so I can move it to my account), hosting provider and login, site admin login, and a copy of the site files. Happy to create the accounts my side if that’s easier.
Two things make it work. Offering to create accounts yourself removes the “it’s on my card” obstacle. And requesting it as records-keeping, rather than as a prelude to leaving, avoids triggering the defensive response.
Expect one legitimate complication: domains are often locked for 60 days after registration or a previous transfer. A refusal citing a lock may be genuine.
If the request is refused or ignored
- Go to the providers directly. Registrars and hosting companies have account-recovery and ownership-claim processes. Evidence that the business name is yours — GST registration, invoices, trademark, the payment you made — carries weight.
- Ask for a backup instead, if access is stuck. A copy of the site files plus your own domain is enough to rebuild elsewhere quickly.
- Weigh the value of the fight. If the site is small and the vendor unresponsive, registering a clean domain and rebuilding sometimes costs less than a month of chasing. That’s a real option, not a defeat.
What to do this week
- Run the WHOIS check and note the registrant email.
- Try your admin login, if you were ever given one.
- Identify your hosting provider by name.
- Send the housekeeping request above, offering to create accounts yourself.
- Download or request a copy of the site files, whatever else happens.
If you want it done the certain way
If access is stuck somewhere, send us the domain and whatever you have — we’ll tell you honestly what’s recoverable, what to ask the registrar, and whether rebuilding is the cheaper route. On our builds, all three logins are in your name from the start and handed over in writing. WhatsApp us; we reply in about five minutes between 9am and 7pm.
Related reading
- Whose name is your domain registered in?
- The website handover checklist
- Domain vs hosting vs website: what you’re paying for
- Can a developer take your website offline?
FAQ
What logins should I have for my own website?
Three: the domain registrar account, the hosting account, and the site admin login — plus whatever administers your business email if it runs on your domain. The domain is the most important of them.
My developer won’t give me the website login. What can I do?
Ask the registrar and hosting provider directly; both have ownership-claim processes and will consider evidence that the business and payments are yours. Also request a copy of the site files, which lets you rebuild elsewhere if needed.
Is it normal for a web developer to keep the passwords?
It’s common, usually for convenience rather than bad intent. It’s still worth correcting — accounts in your name mean an unpaid invoice becomes a billing dispute rather than an outage.
