You paid for a website. You’d assume that means you own it — the domain, the hosting, the code, all of it. But a surprising number of small business owners find out the hard way that they can’t touch their own site without going through the person who built it, and that person has gone quiet, started charging surprise fees, or is flatly refusing to hand anything over.
Table of Contents
This happens often enough that it has a name in small-business circles: your website being “held hostage.” This guide walks through the concrete warning signs, why it happens, and the steps to take back control — whether you’re mid-project or years into working with a freelancer who’s gone dark.
Quick Answer
The clearest sign is access: if you can’t log into your own domain registrar account, hosting account, and website admin (like WordPress) with credentials only you control, your designer — not you — owns the keys to your site. Other red flags include refusing to hand over an EPP/auth code for domain transfer, vague or missing contracts, and demanding extra payment just to release logins you should already have.
The Warning Signs to Watch For
You don’t have your own registrar login. If your domain (the .com itself) was registered under the designer’s personal or agency account instead of one in your name, they legally control it — not you. Ask them directly: “Whose name is the domain registered to, and can I log into the registrar account myself?” A straight answer with a working login is a good sign; deflection is not.
You’ve never seen a hosting account with your name on it. Some designers set up hosting under their own reseller account and put your site on it as an “add-on domain.” That’s convenient for them but means your site can vanish the moment they stop paying their own hosting bill or decide to cut you off.
You don’t have admin access to the CMS. If your site runs on WordPress, Shopify, Squarespace, or similar, you should have an admin-level login of your own — not just a “contributor” account that can edit text but can’t install plugins, change themes, or export your content.
They refuse to provide the domain transfer authorization code. Under ICANN rules, registrars are required to give this code (often called an EPP or auth code) to the legitimate account holder on request. If your designer stalls, makes excuses, or says it’s “not possible,” that’s a strong signal something is being withheld deliberately rather than for a technical reason.
New fees appear when you ask to leave. Some contracts bury clauses requiring a minimum hosting term or a penalty fee for switching providers. If you’re suddenly quoted a “transfer fee,” “release fee,” or told you owe back payments you didn’t know about before you can get your logins, treat it as a hostage tactic and get everything in writing before paying anything.
There’s no written contract at all. Verbal agreements or a single invoice with no scope of work make it much harder to prove what you’re owed, who owns what, and what the designer actually agreed to deliver. A vague or nonexistent contract is often present in these situations because it leaves ownership ambiguous.
How to Get Your Website Back
Start with a calm, written request. Email (not just call or text) asking specifically for: the domain registrar login or transfer/EPP code, hosting account access, and CMS admin credentials. Putting it in writing creates a paper trail if you need to escalate later.
Don’t rely on a public WHOIS lookup to prove who owns the domain. A WHOIS (or newer RDAP-based) lookup will tell you which registrar the domain sits with and its registration or renewal dates, which is useful for figuring out where to direct a dispute. But under current ICANN privacy policy, registrant contact details are redacted from public lookups by default, so you’ll typically see something like “REDACTED FOR PRIVACY” instead of a name — it will not confirm whether the domain is registered to you or your designer. To actually establish ownership, contact the registrar directly and go through their account-recovery or ownership-verification process, backed up with your invoices and business records.
Contact the registrar directly if the designer won’t cooperate. If you can show you’re the business owner and the domain should be yours (invoices, business registration, email correspondence about the site), most registrars have a process for disputing ownership or at least flagging the account.
Consider a formal demand letter. If a written request doesn’t work, a brief letter from a small-business attorney (or even a well-documented message citing your contract, or lack of one, and applicable consumer protection language) is often enough to prompt a response, since most freelancers want to avoid a legal escalation more than they want the leverage.
As a last resort, be ready to rebuild. If the designer is truly unreachable or unwilling, it’s sometimes faster and cheaper to register a fresh domain, rebuild the site, and treat the old one as a loss — especially if the site was small or outdated anyway. This is a worst case, but knowing it’s an option removes some of the leverage a bad actor is counting on.
Tips to Avoid This in the Future
Register your own domain, in your own name, on your own registrar account, before a designer ever touches your project. Give them access as a “manager” or secondary user if needed, never as the primary owner.
Use hosting billed directly to you, not a reseller account under the designer’s business. If they recommend a host, sign up for the account yourself and grant them access.
Get a written contract before work starts. It should state plainly who owns the final code, design files, and content, and that all logins and credentials will be provided to you as the site is built, not withheld until final payment or after.
Keep a running password document. Every time an account is created for your site (registrar, host, CMS, email service, analytics), record the login yourself instead of relying on the designer to keep it for you.
Common mistake: assuming payment equals ownership. Paying an invoice doesn’t automatically transfer copyright or account ownership; without it spelled out in a contract, U.S. copyright law generally treats the creator, not the paying client, as the default owner of custom code and design work.
Explore more: more web development guides.
Freelance web designer holding a website hostage FAQs
Can a web designer legally keep my domain name?
Only if it was registered in their name, not yours. If you can show you’re the intended owner and paid for it, most registrars have a dispute process, and ICANN rules require registrars to release a legitimate owner’s transfer authorization code on request.
Is it normal for a freelancer to keep the login to my WordPress site?
It’s common during a build, but you should still be given your own admin-level account once the site launches. Being permanently locked out of your own CMS is a red flag, not standard practice.
What is an EPP or auth code and why does it matter?
It’s the unique code required to transfer a domain to a new registrar. Without it, you can’t move your domain even if you own it outright, which is why designers who withhold it can effectively hold a site hostage.
Does a WHOIS lookup show who really owns my domain?
No, not directly. Under current ICANN privacy rules, registrant names and contact details are redacted from public WHOIS/RDAP lookups by default, so the results typically show only the registrar and registration dates, not a confirmed owner. Establishing true ownership generally requires contacting the registrar directly.
Do I own the code and design if I paid for the website?
Not automatically. In the U.S., the creator owns the copyright by default unless a written contract explicitly assigns ownership to you (often called a “work made for hire” or assignment clause). Always get this in writing before the project starts.
Build It With GTStudios
Need help with your website, app, or small-business tech? GTStudios builds web, apps, and software for small businesses. See how GTStudios can help.
Want dev news in your inbox? Subscribe to the free newsletter.
Photo by Tim Gouw on Unsplash.