How to Own Your Website After Development

A website is one of the few business assets a Nigerian company can pay for in full and still not possess. The site works, customers visit it, and yet the domain sits in someone else's registrar account, the hosting is on a reseller package nobody can split, and the only person who can edit the homepage stopped answering calls two months ago.

Ownership is not a document you receive at the end. It is a set of accounts created correctly at the beginning and a short verification you carry out before you release the last payment. This guide covers what to hold, how to check you hold it, and what to do if someone else currently does.

What "owning your website" actually means

Ownership has three layers, and a business needs all three. Holding one or two is the source of most disputes.

• Legal ownership. The copyright in the custom design, any custom code, the photographs you commissioned and the text written for you. This is decided by your contract, not by the fact that you paid an invoice.
• Account control. Who holds the domain registrar account, the hosting account, the CMS administrator login, the analytics property and any third-party services. Control follows whoever created the account.
• Practical ability. Whether you can actually change the site, move it to another host or hand it to a different developer without depending on the original provider.

A business can own the copyright and still be locked out. It can hold the CMS password and still lose the domain. Treat the three layers as a checklist rather than a single question.

The website ownership inventory

Work through this table for your own site. It takes about an hour and tells you exactly where you stand.

Anything in that table you cannot log into yourself is a gap, regardless of what your agreement says.

What you can own and what you only licence

Not every part of a website can belong to you, and a good provider will explain the difference rather than blur it.

You can own:

• The custom design created for your brand
• Custom code written specifically for your site
• Your content: text, photographs you commissioned, your logo
• Your data: customer enquiries, orders, subscriber lists
• Your domain name, in the sense of holding the registration

You licence rather than own:

• A purchased theme or template, used under its licence terms
• Plugins and extensions, usually per-site licences with annual renewals
• Stock photographs and icons, under the licence purchased
• Fonts, under their own licences
• Proprietary page builders and SaaS platforms, where the site exists only while you subscribe
• Open-source components such as WordPress itself, free to use under their licences

Two practical implications. First, ask for a written list of licensed components with renewal dates and costs, because a lapsed plugin licence can break a feature or leave a security hole. Second, understand the platform: a site built on a proprietary builder tied to a provider's subscription is rented, not owned, and moving usually means rebuilding. That may be an acceptable trade-off, but it should be a decision rather than a discovery.

How to verify what you control today

Domain

Log in to the registrar account yourself. If you do not know which registrar holds your domain, run a public WHOIS lookup — it shows the registrar and often the registrant organisation, though privacy settings may mask some details. Confirm three things: your business is the registrant, the administrative contact is an email address you control, and you know the renewal date. For .ng and .com.ng domains, registration runs through NiRA-accredited registrars, and the registrant details matter just as much as with a .com.

Hosting and files

Log in to the hosting control panel. You should be able to see your files, your databases and your email accounts if they run there. If your site is on a reseller package under someone else's master account, you do not control the hosting, and you should move to your own account. Indicatively, shared hosting for a business site runs ₦20,000–₦120,000 per year, with VPS or cloud hosting for heavier applications from about ₦150,000 upwards — indicative 2026 ranges that vary by provider and exchange rate.

CMS and administrator accounts

Log in to the website admin area with an account in your own name that has full administrator rights. Test it properly: can you create another user? Can you edit a page and publish it? An "editor" account that cannot manage users or install updates is not administrative control.

Google and analytics accounts

Analytics, Search Console and Google Business Profile should all sit under a Google account owned by your business — ideally a company account rather than a staff member's personal address. Check that you hold the owner or administrator role, not merely view access. This matters when staff leave as much as when developers do.

Owning the code, design files and content

Code. Custom code should be assigned to your business by contract, effective on final payment, and should live in a repository under your company's account with the developer added as a collaborator. For a template-based WordPress site there may be very little custom code, and what exists is usually a child theme and configuration — still worth having, because it is what a future developer will need.

Design files. Working design files are not always included by default. If you want them, say so in the contract before the project starts. They are useful for future redesigns, print materials and brand consistency, and a provider may charge for them separately.

Content. Text written for you and photographs you commissioned should be yours, with the copyright assigned in writing where a third party created them. For purchased stock images, you hold a licence and should keep the receipt showing its terms.

Data. Enquiry records, customer accounts, order history and mailing lists are your business data. Ensure you can export them in a usable format, and that any processing by a developer or a third-party service is covered by your obligations under the Nigeria Data Protection Act 2023. Check the Nigeria Data Protection Commission's current guidance, and take professional advice where your situation is complex; this article is not legal advice.

If a previous developer holds everything: the transfer process

Most recoveries succeed, and the calm route works better than the confrontational one.

1. Map what you have and what you lack. Use the inventory table above. Be precise: "we can log into the CMS but not the hosting or the registrar."
2. Gather your evidence. The proposal, invoices, payment records and any message where the domain or hosting was discussed. Ownership arguments are settled by records.
3. Make a polite written request. Ask for transfer of the registrar account and hosting, the administrator credentials, and a full backup. Give a reasonable deadline and keep it professional; most providers cooperate, and many simply never thought about it.
4. Handle the domain transfer properly. Between registrars this usually involves unlocking the domain, obtaining an authorisation code and initiating the transfer at the new registrar, with an approval email to the administrative contact. Within the same registrar it may be a simpler account push. Note that recently registered or recently transferred domains may be subject to transfer restrictions.
5. Migrate the hosting. A new host or developer can copy the site files and database to your new account, then update the DNS. Confirm email records are preserved if your business email uses the same domain.
6. Take a full backup first, before anything changes, and store it somewhere you control.
7. Escalate if necessary. Contact the registrar or host about their dispute process, and take legal advice where the brand or the sums justify it. Report suspected fraud to the Nigeria Police Force or the EFCC where appropriate.
8. Plan a fallback. If a domain genuinely cannot be recovered, a new domain plus a rebuild is painful but survivable. Begin that planning in parallel rather than waiting indefinitely.

The handover pack and your acceptance test

For a new build, make this the condition for your final payment. Do not accept a promise to send it later.

• Registrar account access, with your business as registrant
• Hosting account login in your business name, with billing under your control
• Website administrator account in your name, with full rights
• Database and file backup you have downloaded and stored yourself
• List of themes, plugins, licences and subscriptions, with renewal dates and costs
• Email account administration, if email uses your domain
• Google Analytics and Search Console access under your own Google account
• Repository access for any custom code
• Design source files, where the contract provides for them
• Written IP assignment covering the custom design, code and commissioned content
• Documentation: how to update content, where services are configured, who to contact
• A recorded or live walkthrough of routine content updates
• Confirmation of the warranty period and how to report a defect

The acceptance test takes thirty minutes: log into each account yourself while the developer is still engaged, change something small in the CMS and publish it, download a backup, submit a test enquiry through the contact form and confirm it arrives, and open the site on your phone. Anything that does not work is far easier to fix before the final payment than after it.

Keeping ownership after handover

Ownership is lost as often through neglect as through bad actors.

• Diarise renewals. Domain, hosting, SSL and plugin licences. An expired domain can be lost to someone else, and recovery is uncertain.
• Use a company email as account owner, not a staff member's personal address. People leave.
• Keep a credentials record in a password manager or a secure store, with a director holding recovery access.
• Maintain an access register: who has admin rights to what, reviewed twice a year.
• Keep your own backups. Host backups are useful; a copy you control is better. Download one quarterly at minimum.
• Remove old users. Former developers, agencies and staff should be removed when engagements end.
• Enable two-factor authentication on the registrar, hosting and Google accounts.
• Keep the site updated. Outdated CMS software and plugins are the most common route to a compromised Nigerian business website.

Example (hypothetical): a school recovers its website

Example (hypothetical). A private secondary school in Ibadan has had the same website for six years, built and managed by a former parent who is now unreachable. Admissions enquiries come through the site, and the domain appears on every prospectus and signboard.

The bursar works through the inventory and finds: a CMS login that works, no hosting access, and a WHOIS lookup showing the domain registered to the developer's personal name with an email nobody recognises, renewing in four months.

What the school does:

• Downloads everything accessible from the CMS immediately — pages, images, admissions content — as a working copy.
• Engages a local developer for an indicative ₦120,000 to take a full backup through the CMS and document the site structure.
• Sends a written request to the developer's last known email and phone number, and reaches a relative who passes on the message. The developer responds within a week and agrees to transfer.
• Opens a new registrar account in the school's name and a new hosting account, then completes the domain transfer using the authorisation code.
• Migrates the site, confirms the DNS and email records, and tests the admissions enquiry form.
• Removes the old administrator account, enables two-factor authentication, diarises the renewal dates and records the credentials with the principal and the bursar.

Total cost: under ₦300,000 including a year of hosting and the developer's time. Had the domain lapsed first, the school's recognised web address could have been lost entirely, and reprinting materials would have cost considerably more.

What changes for Nigerian businesses

• Domain ownership is the recurring failure. A large share of Nigerian SMEs do not know who holds their domain until they need to move. Check now, while relationships are good.
• Reseller hosting is widespread. Many providers host client sites under one master account. It is convenient until you want to leave. Ask directly whether you will have your own account.
• Personal email as account owner. Sites registered to a former staff member's Gmail address are common and become a problem when that person leaves. Use a company address you control.
• .ng domains via NiRA-accredited registrars. The registrant details work the same way as for international extensions, and are just as easy to record incorrectly.
• Word-of-mouth providers. Many first websites are built by a friend, a relative or a parent at the school. Goodwill is not a handover process, and asking for account access is not an accusation.
• Renewals and the exchange rate. Some hosting and licence renewals are priced in US dollars, so naira costs move. Budget annually rather than assuming last year's figure.
• Google Business Profile matters locally. For Nigerian businesses that rely on local search, losing control of the profile is as damaging as losing the website. Claim and verify it under your own account.

Mistakes to avoid

• Assuming payment equals ownership. Ownership comes from the contract and the accounts, not the invoice.
• Letting the developer register the domain in their name. The single most consequential error in Nigerian SME web projects.
• Accepting an editor account and calling it admin access. Test whether you can manage users and publish changes.
• Releasing the final payment on a promise of logins. Verify first.
• Having no backup of your own. If your only copy sits with your provider, you have no fallback.
• Ignoring licence renewals. Lapsed plugin and theme licences break features and create security gaps.
• Keeping former developers' access indefinitely. Remove users when engagements end.
• Waiting for a dispute to ask about ownership. Requests made calmly, in advance, are almost always granted.

Conclusion

Owning a website is less about paperwork than about accounts. Create the domain, hosting, CMS and Google accounts in your business's name from the start, put an intellectual property assignment in the contract, then verify everything yourself with a thirty-minute acceptance test before the final payment. If a previous provider holds your assets today, work through the inventory, request a transfer politely in writing, and migrate to accounts you control. The whole exercise costs little and protects an asset your customers use to find and judge your business.

If you would like your current website reviewed for ownership and access gaps, or a new build set up with the domain, hosting and handover in your own name from day one, Linestech can walk you through what a clean ownership position looks like.

Frequently asked questions

How do I find out who owns my domain name?

Run a public WHOIS lookup for your domain. It shows the registrar and usually the registrant organisation and administrative contact, although privacy protection can mask personal details. If the registrant is not your business, contact your provider and ask for the registrar account details and a transfer. Do this proactively, not when you are already in dispute.

Can I move my website to another developer?

Yes, provided you control the domain, the hosting and an administrator account. A new developer can take over an existing site or migrate it to new hosting. The exception is a site built on a proprietary platform tied to the original provider's subscription, where moving usually means rebuilding — which is why it is worth asking about the platform before you commission a site.

Does paying for a website mean I own the design?

Not automatically. Ownership of the custom design and any custom code depends on what the contract says. Without a written assignment, the creator may retain copyright and you may hold only a licence to use the work. Ask for an express IP assignment effective on final payment, and have a Nigerian lawyer review agreements of significant value.

What should I do if my developer stops responding?

Secure what you can reach: change passwords on accounts you control, download a full backup, and note your renewal dates. Then establish what you lack using the ownership inventory, send a written request to the last known contact details, and approach the registrar or host about their processes. Engage another developer to assess the site so you know your options.

Do I own my website content and customer data?

Your text, commissioned photographs, logo, enquiry records and customer lists are your business assets, and you should be able to export them at any time. Purchased stock images are licensed rather than owned, so keep the licence records. Customer personal data also carries obligations under the Nigeria Data Protection Act 2023, which sit with your business.

Is it a problem if my site is built on WordPress?

No — WordPress is open-source software you can host anywhere, which is generally good for portability. What matters is where it is hosted, whether you hold the administrator account, which premium themes and plugins are licensed and to whom, and whether anyone has locked you into a proprietary page builder that requires an ongoing licence to edit the site.

How often should I take my own backup?

At least quarterly for a site that changes little, and monthly or more often for an active site or an online store. Keep at least one copy outside your hosting account — cloud storage or an external drive — so a hosting problem or a lapsed account does not take your only copy with it.

Sources and further reading

Figures, platform rules and regulations change. These are the primary references behind this article and the places to check before you act on it.

• Nigeria Data Protection Commission (NDPC)
• Nigeria Internet Registration Association (NiRA)
• Google Business Profile Help
• Cloudflare Learning Center
• GitHub documentation
• OWASP Top 10