“My web guy disappeared. Can I get my site back?” Usually you can get most of it back, but “the site” is really three things with three different owners: the domain name, the hosting account where the files live, and the site itself, meaning the design, the words, the photos and the code. Each has its own rules and its own fix. This article takes them in the order that matters, starting with the domain, because it carries your email and every link anyone has to you, and losing it costs the most.
Three things, three owners
| Piece | Who controls it | What decides it |
|---|---|---|
| The domain name (yourcompany.com) | The registered name holder, through the registrar | The registrar’s records and ICANN’s policies |
| The hosting | Whoever holds the hosting account | The host’s account terms |
| The design, text, photos and code | The author, unless the rights were transferred in writing or the work was made for hire | U.S. copyright law, title 17 |
ICANN’s statement of registrant responsibilities puts the domain squarely on the registrant: “sole responsibility for the registration and use of your domain name,” accurate contact details that are promptly updated, and replies to the registrar within 15 days. Whoever is named as registrant carries those duties, and holds the control that goes with them.
Step 1: find out who holds the domain
Start with ICANN’s free lookup tool at lookup.icann.org. ICANN’s registrant FAQ says you can always find the current registrar of your domain there. The tool reads RDAP, which ICANN has made the definitive source of registration information for generic top-level domains such as .com since 28 January 2025.
The owner’s name may not show. ICANN notes that one outcome of its data policy changes “was the restriction of access to most personal data,” and it sends anyone who needs the nonpublic details to the registrar or to its Registration Data Request Service. For your own domain, ask the registrar.
Here is the trap ICANN itself warns about. If you paid a developer to manage the domain, “they may have registered the domain name using their own contact details (even if you have paid them to register and manage the domain name),” and may be listed as the registrant of record. ICANN adds that you may need to show the registrar proof of your payment to the developer to prove you are the rightful holder. Before anything else, find the invoices and the card or bank records that show you paid for the domain.
Watch the expiration date
Under ICANN’s Expired Registration Recovery Policy, the registrar must send the registered name holder at least two notices before a generic domain expires, one about a month before and one about a week before, and another within five days after. If the agency is the registered holder, those reminders go to the agency.
Miss them and the domain stops working: for at least the last eight days that an expired registration can still be renewed, the registrar must interrupt its existing DNS resolution path, which is what points the name at your website and your email. After a registration is deleted, the registry must offer a 30-day Redemption Grace Period during which the registrant at expiration can ask for it back. If the person who holds your domain has vanished and the date is close, act now.
Step 2: put the domain in your name
If you can log in to the registrar account, change the registrant to your business and an email address you read. ICANN’s Transfer Policy requires the registrar to confirm a change of registrant with both the new and the prior registrant through a secure mechanism (section II.C.1). After the change, the registrar must lock the domain against moving to another registrar for 60 days (II.C.2). ICANN’s transfer FAQ says some registrars let you opt out of that lock, at their discretion, so if you also plan to change registrars, ask about the opt-out before you change the name.
If you cannot log in and the developer will not answer, go to the registrar’s support with your proof of payment and ask how it handles a registrant dispute. That is the case the invoices are for.
Step 3: move it to an account you control
To move a domain to a new registrar, ICANN says you start with the registrar you want to move to. You will need the domain’s Auth-Code, which ICANN describes as a code created by a registrar to help identify the domain name holder and prevent unauthorized transfers. If your registrar lets you generate the code and remove the transfer lock yourself in your account, do that; if it does not, it must give you the code and remove its transfer-prohibited status within five calendar days of your request (Transfer Policy, I.A.5.2).
The registrar you are leaving may deny a transfer only for the reasons the policy lists (I.A.3.7): evidence of fraud, a reasonable dispute over the identity of the registered name holder, nonpayment (for a previous registration period, or for the current one if the domain has not yet expired), an express objection from the authorized transfer contact, or a request within 60 days of the domain’s creation or of a previous transfer. It may not deny one (I.A.3.9) for nonpayment of a pending or future period, for no response from the registered name holder, for a registrar lock the holder had no reasonable chance to remove, or for general payment defaults between the registrar and its business partners where the registered name holder has paid for the registration. That last rule matters when an agency resold you the domain and stopped paying its own bills.
If a registrar refuses without a listed reason, ICANN’s FAQ says to submit a formal Transfer Complaint with ICANN. One thing to check first: on 7 June 2026 ICANN’s Board adopted the recommendations of its Transfer Policy review and directed that they be implemented. The rules above are the ones in force today; look at ICANN’s domain transfers page before you start, in case the revised policy has taken effect.
The hosting and the files
The domain only points somewhere. The website itself sits on a hosting account, and the questions there are practical ones:
If the agency built the site on its own platform, there may be nothing to export except the words and pictures. Ask that question before you sign, not on the way out.
The design and the words: copyright
Paying for a website does not by itself make you the owner of its design and text. Federal law says copyright “vests initially in the author or authors of the work” (17 U.S.C. § 201(a)). The exception is a work made for hire, where the employer or other person for whom the work was prepared is considered the author (§ 201(b)). Section 101 defines that narrowly: a work prepared by an employee within the scope of the job, or a work specially ordered or commissioned for one of nine listed uses, such as a contribution to a collective work or a compilation, and only “if the parties expressly agree in a written instrument signed by them.”
An outside agency is not your employee, and whether a website fits one of the nine uses is not something to rely on. The clean answer is a written transfer. Under § 204(a), a transfer of copyright ownership is not valid unless it is in writing and signed by the owner of the rights or that owner’s authorized agent. Have the agency assign to your business, in a signed document, the copyright in the custom design, code and text it made for you.
Themes, plugins, stock photos and fonts are usually someone else’s work used under a license. Ask for a list of each one and whose account the license sits in, so you know what moves with the site and what you would need to license yourself.
What to put in the next contract
- The domain is registered to your business, in a registrar account your business owns; the agency gets its own access, not your password.
- The hosting account is in your business’s name, or the agency promises a full export of files and database within a set number of days of your written request.
- On payment, the agency assigns to you in writing the copyright in the custom design, code and text, and lists every third-party item and whose license covers it.
- You hold owner-level logins to the registrar, the host, the site’s admin and the analytics account.
- On termination, for any reason, the agency hands everything over within a set number of days and supplies the Auth-Code on request.
- Renewal notices go to an address at your business that you read.
A 30-minute check this week
- Look up your domain at lookup.icann.org and note the registrar and the expiration date.
- Log in to that registrar. If you cannot, find out who can, today.
- Check that the registrant is your business and the contact email is one you read.
- Turn on auto-renew and check the card on file; ICANN’s registrant responsibilities include keeping payment details current when auto-renewal is on.
- Confirm your owner-level logins to the host and the site’s admin, and download a backup.
- Put the domain and website invoices in one folder.
Once you hold the keys, what goes on the site is the next question; The Website Pages a Contractor Needs covers the five that matter.
General information, not legal or tax advice. Rules change and vary by state; check with the agency named above or a professional for your situation.