Most business owners find out they do not own their website at the worst possible moment.
The designer stops answering emails. Or retires, or moves, or the relationship sours over an invoice. A renewal notice goes to an address nobody checks, and one Tuesday the site is gone — replaced by a parked-domain page, taking every email address on that domain with it.
It is almost never malicious. Someone built a site in 2016, registered the domain on their own account because it was faster than walking a client through it, and never got round to transferring it. Nobody wrote anything down. Seven years later the business has no idea which of eight accounts actually matters.
If your domain ends in .ca, Canadian registry rules give you more leverage than most people realise. We will get to those. First, the audit.
The five-minute version
If you read nothing else, check these three today.
- Look up your domain in a WHOIS tool. Whose name is in the Registrant field? If it is not your legal business name, that is the problem.
- Search your business on Google. If you see “Own this business?” rather than management options, somebody else controls your Google Business Profile.
- Try logging in to your hosting account. Not the CMS — the hosting account. If you have never seen it, you do not have it.
Two out of three failing is common. Three out of three is a bad afternoon, not a catastrophe. Everything below is recoverable.
The seven assets
Your online presence is seven separate things, each of which can be owned by a different person. Usually they are.
1. The domain name
The one that matters most, because it is the only one you cannot rebuild. Lose your hosting and you restore a backup. Lose your domain and you lose your web address, your email, and every backlink and ranking attached to it.
How to check. Run a WHOIS lookup on your domain. You are looking for the Registrant — the legal owner. Ignore the impressive-sounding job titles; Registrant is the only field with weight.
The trap. There is a second field, the Administrative Contact, and this is where most web designers sit. CIRA’s Registrant Agreement gives that contact remarkably broad powers. They are “irrevocably authorized by the Registrant to take any and all actions in connection with the Domain Name Registration(s) including, without limitation, renewing, transferring, modifying, or deleting it.”
That sounds alarming. Here is the sentence almost nobody quotes, from the same agreement:
“In the event of any dispute between the Registrant and the Registrant’s Administrative Contact, the Registrant shall prevail.”
If your business is the Registrant, you win the argument. Your designer’s convenience does not outrank your ownership.
A .ca detail that is genuinely useful. CIRA turns WHOIS privacy on by default for registrants who are individuals, and privacy is not available to corporations or unincorporated associations. That combination is a diagnostic, not an obstacle:
- If your company is properly the registrant, a WHOIS lookup shows your company name in the clear.
- If the lookup comes back redacted, the domain is registered to an individual. For a business domain, that individual is very often the person who built the site.
So “I cannot see who owns it” is itself close to an answer. If you need to reach a private registrant, CIRA publishes a contact form that routes a message to them without revealing their email.
One more risk worth knowing: if the registrant details on file are stale or do not show a genuine Canadian presence, CIRA can open a Registrant Information Validation review, which locks the domain against transfers and contact changes until it is resolved. Out-of-date ownership records are not just untidy — they can freeze the asset at the moment you need to move it.
2. DNS and nameservers
DNS is the switchboard pointing your domain at your website and your email. It usually lives at your registrar, but it can be delegated anywhere — Cloudflare, your host, a developer’s personal account.
How to check. Your WHOIS lookup lists the nameservers. If you do not recognise the company they point at, there is a third party in the chain you did not know about.
Why it matters. Whoever controls DNS can redirect your website and intercept your email, no matter who owns the domain. Before you move anything, export or screenshot your existing records — especially the MX records for email. Rebuilding those from memory after a rushed transfer is how a domain move becomes three days without email.
3. The hosting account
The server the site lives on, and the billing relationship attached to it.
How to check. Find the charge on a statement. Whose card is it? If your provider bills you a flat monthly fee that quietly includes hosting bought on their own account, you are a subtenant, not a tenant.
Ask for. Direct login to the hosting control panel, in your business’s name, on your business’s payment method. “I will handle that for you” is a fine service arrangement. It is not a substitute for holding the account.
4. Website files, database and CMS admin
On WordPress that means an Administrator account plus the files and database. On a custom or static site it means the source code.
How to check. Log in. Do you have an Administrator role, or an Editor role that only lets you change text? The difference is large.
Ask for. An admin account in your name, and a full backup — files and database — in a format you can store yourself. If the site was custom-built, ask who holds the code and what the licence says. A well-drafted contract assigns you ownership of the deliverable. Many say nothing at all, which is worth settling before you need the answer rather than after.
5. Google Business Profile
For a local business this is often worth more than the website. It holds your reviews, and years of reviews cannot be replaced.
How to check. Search your business name in a private window. If Google offers “Own this business?” or “Claim this business”, you do not have it.
How to get it back. Go to business.google.com, find your business, and choose Request access. The current owner is notified and has three days to approve or deny. If they do not respond, you may be offered the option to claim and verify it yourself. If they deny it, you can appeal.
If you are a service-area business — a trades company, a mobile clinic, anyone without a customer-facing storefront — the path is different and not obvious. Google directs service-area businesses to contact support and select transfer of ownership as the reason. Following the storefront instructions will waste a week.
Do not create a second listing because the first is locked. Duplicates get suspended, and a suspension is far worse than waiting out a request. Note too that once you do gain ownership there is roughly a seven-day settling period before you can do admin-level things such as removing other owners.
One thing that improves your odds: make the request from a Google account already verified in Search Console for your domain. It gives Google a corroborating signal that you are connected to the business.
6. Analytics and Search Console
Both are commonly created under a designer’s personal Gmail. Analytics history is not portable. If you lose the property you lose the historical data permanently — there is no export-and-restore that brings it back.
Ask for. Administrator on the GA4 property, and Owner verification (not merely “Full user”) in Search Console.
7. Email, social and ad accounts
Business email is usually tied to the domain, which makes a domain dispute an email dispute too. Beyond that: Meta Business Manager, Instagram, the LinkedIn company page, and any Google Ads account. Ads accounts are the sneakiest — an agency-owned account means your conversion history and audience lists walk out with the agency.
Three rights Canadian owners do not know they have
This is where .ca owners are in a stronger position than the American guides suggest.
1. Your registrar must hand over the transfer code, and there is a clock. Under CIRA’s rules, when a Registrant requests the authorization code, the Registrar of Record must provide it within five calendar days and remove any registrar locks. This is an obligation, not a favour. If a provider is slow-walking you, quoting it back tends to resolve things quickly — and if the five days pass, you can escalate to CIRA directly.
2. Nobody can contractually trap your domain. CIRA’s Registrar Agreement prohibits any agreement between registrar and registrant from containing terms that prevent the registrant changing registrars at any time. If you are told you cannot move your domain until a contract term expires, that term does not hold at the registry level.
3. Registrant beats Administrative Contact. Covered above, and the single most useful sentence in this article. In a dispute, the Registrant prevails.
A few practical notes while you are in there:
- A newly registered
.cacannot change registrars for 60 days. The same 60-day lock applies again after a transfer, so you cannot move twice in quick succession. Plan around both. - A registrar transfer and a registrant transfer are two different things. Moving your domain to a new registrar does not change whose name is on it — the registrant’s name and organisation cannot be altered as part of a registrar move. If your designer is the registrant, you need a separate registrant change. Doing only the registrar transfer is the most common way people believe they have fixed this and have not.
- Once the authorization code is entered, a
.caregistrar transfer typically completes in a couple of business days — faster than the.comprocess most guides describe.
How to ask without blowing up the relationship
Most of these situations are sloppiness, not hostage-taking. A calm, specific email resolves the large majority. Something like:
Hi [Name] — I am getting our business records in order and want to make sure everything is registered properly in the company’s name. Could you send me:
- Registrar login, or confirmation that [Business Name] is the Registrant on the domain
- Hosting account access
- WordPress admin login
- Owner access on the Google Business Profile ([your email])
- Admin on GA4 and Search Console
Happy to keep you running everything day to day — I just need the accounts in the business’s name for continuity. Thanks.
Note what that does. It frames the request as bookkeeping rather than accusation, and explicitly offers to keep the working relationship. That framing gets a yes far more often than a legal-sounding demand.
If you get silence or a refusal, escalate in order: the registrar’s support team, referencing the five-day obligation; then CIRA; then Google’s ownership request and appeal. Litigation is almost never proportionate here, and it is usually slower than rebuilding.
The clause to put in your next contract
Whatever happens with your current setup, do not repeat it. Any web agreement you sign from here should say, in plain language:
- [Your Business Name] is the Registrant of the domain, and all domain, hosting, analytics and Google Business Profile accounts are registered in the client’s name with the client’s billing details. The provider is granted access as a manager or administrator.
- On termination, the provider transfers all access within 10 business days and provides a complete backup of files and database.
- Ownership of the delivered website — design files, code and content — passes to the client on final payment.
Three bullets. They cost nothing to include and remove this entire category of problem.
Worth knowing if you are in Canada: there is no such thing as “work made for hire” here. Under the Copyright Act, a contractor who creates something owns the copyright in it unless there is a written, signed assignment saying otherwise. A verbal agreement or an invoice marked “paid in full” does not transfer copyright in your website. If your contract is silent, the default is not in your favour.
If you cannot get it back
Sometimes the trail is genuinely cold. The designer has died, the company dissolved, the email is gone. It happens more than you would think.
You are not stuck. An abandoned domain will eventually expire and become available. A Google Business Profile can be recovered through the appeal process with documentation. And a website can be rebuilt properly, on accounts you own, with a redirect strategy that preserves as much search equity as possible.
That last part is the piece people miss. Rebuilding without mapping old URLs to new ones is how a business rebuilds its site and loses its rankings in the same month. Whatever you do, get an inventory of your existing pages before anything comes down.
Questions people ask
How do I find out who owns my domain in Canada?
Run a WHOIS lookup and read the Registrant field, not the Administrative Contact. For .ca, privacy is automatic for individual registrants and unavailable to corporations — so a redacted result means the domain is held by a person rather than a company.
My web designer registered my domain. Is it legally mine? Not automatically. Whoever is listed as Registrant is the owner of record. If that is your designer, you need a registrant change — a registrar transfer alone will not move the name. If your business is already the Registrant and the designer is only Administrative Contact, CIRA’s rules put you in the stronger position.
Can a web company refuse to release my domain? CIRA requires your Registrar of Record to supply the authorization code within five calendar days of a Registrant request and to remove locks, and no registrar-registrant agreement may prevent a registrant changing registrars. A provider can be unhelpful in practice, but the registry rules are on the registrant’s side.
How long does it take to get my Google Business Profile back? The current owner has about three days to respond to a request. No response may open a path to claim it yourself. Service-area businesses use a separate support route. Expect one to three weeks in a contested case.
Will I lose my Google rankings if I move hosts or registrars? No. Changing registrar or host does not affect rankings as long as the domain stays the same and DNS is configured before you switch. Rankings suffer when URLs change without redirects — that is a migration problem, not a transfer problem.
Run the audit
Twenty minutes with the seven items above will tell you exactly where you stand. Most businesses find one or two gaps. Some find they own nothing at all.
If you do not like what you find — or you would rather someone else untangled it — that is a large part of what we do. We are based in the Comox Valley and work with businesses across Canada.
Two things we do on every project: put every account in your business’s name, and hand you the credentials in writing. Our own service agreement assigns ownership of the site to the client on final payment, in writing, because the Copyright Act means a handshake would not do it. You should never have to read an article like this about a site we built.
Get in touch if you want a second pair of eyes on it.
This covers registry policy and platform procedure, not legal advice. For a contract dispute with a former provider, talk to a lawyer.