Nobody asks this question while things are going well. It comes up at exactly one moment: when you want to change who looks after your site, and discover you cannot.
"Your website" is not one thing. It is at least five, and they can each be owned by a different party. Here is how to find out where you actually stand.
1. The domain name
The most important one, and the most commonly mishandled. Your domain should be registered to you or your company, with the account in your name and the billing on your card.
A very common arrangement is that an agency registered it "for you" and holds it in their own account. Usually that is convenience rather than malice. It still means the address your customers, your email and your printed vans all point at is controlled by someone else.
How to check: log in to the registrar yourself. If you cannot, because you have never had a login, that is your answer.
2. The hosting account
Same principle. If hosting is resold to you as part of a monthly fee, you may have no account of your own and no way to take a copy of the site. Ask whether you have direct access, and whether you can get a full backup on request.
3. The code
This is where contracts matter and most small businesses never look. In UK law, if you commission work from a contractor, copyright in what they produce does not automatically pass to you. Absent an agreement saying otherwise, the developer can retain it and grant you a licence to use it.
That licence might be perfectly fine. It might also be conditional on continuing to pay them. The point is to know which, in writing, before you need to know.
What to ask for: a written statement that copyright in the bespoke code and design assigns to you on final payment. Reasonable developers say yes without blinking. This is not legal advice, and for anything substantial it is worth having a solicitor read the contract.
4. The content
Text you wrote is yours. Photographs are more complicated: a photographer usually retains copyright and licenses specific use, and stock images are licensed to whoever bought them, which may be the agency rather than you. If you move away and the licences do not move with you, images have to be replaced.
5. The accounts around it
Analytics, Google Business Profile, the search console, email, any booking or payment tooling. These are frequently created under a developer's account because it was quicker at the time. Losing the analytics history is survivable. Losing control of your Google Business Profile, which is what drives your local search visibility, is not a small problem.
The lock-in that is not about ownership at all
You can own every line of code and still be stuck. If a site is built on a proprietary platform, or a page builder with a stack of paid plugins, then "owning" it means owning something that only runs where it was built and only works while the licences are paid.
This is why I build on open standards and hand over plain, documented code. Not out of principle for its own sake, but because a client who can leave and chooses to stay is a better relationship than one who cannot leave.
A short checklist
Whether you are commissioning a build or auditing what you have:
- Is the domain registered to you, in an account you can log in to?
- Can you get a complete backup of the site on request?
- Does the contract assign copyright in bespoke work to you on final payment?
- Are there recurring licences, and does the site still function if they lapse?
- Are your analytics and Google Business Profile under your own account?
- If you parted ways tomorrow, what exactly would you walk away with?
That last question is the one worth asking out loud. The answer tells you everything, and how someone responds to being asked tells you a bit more.
For what it is worth, my own position is on the about page: you own every line of what I make, and I build on open standards so you are never locked in - to me included.