How to Take Back Your Website and Domain from an Agency

How do you take back your website and domain from an agency?

To take back your website and domain from an agency means to move control of the site, the domain registration and every connected account into your own company's name. List who holds what, check the domain owner with WHOIS, send a written request, back everything up, then transfer the domain, email and accounts in the right order.

In practice, the process depends on two things: whether the agency cooperates and whose name the domain carries. We cannot promise an outcome for any step. That said, if you follow the right order, your site and email keep running while you work. The steps are the same for an agency, a web designer or a freelance developer.

1. First, build an inventory: domain, DNS (the records that point the domain to servers), hosting, site files, email and accounts.
2. Next, check the registrant, the registrar and the expiry date with WHOIS and official lookups.
3. Then tell the agency in writing what you need and by when.
4. Also, if you are the registrant, ask the registrar to unlock the domain and release the transfer code.
5. Because every change carries risk, back up the site files, the database and the mailboxes first.
6. After that, move DNS, hosting and email in order, and touch the MX record (the record that routes your email) last.
7. Finally, reset passwords, turn on two-step verification and downgrade the agency to a limited user.

The sections below follow the same order of priority we use in the field. Also, this guide is not legal advice, so talk to a lawyer about contract or ownership disputes.

What should you list before you take back your website and domain from an agency?

An inventory is a simple list that records, for every asset, where it lives, whose account holds it and which email address it uses. Do not guess, because invoices, card statements, old emails and the contract show you the real account.

Start here, because this is where most problems hide: search your inbox for domain, hosting, renewal and certificate. Renewal reminders also reveal the registrar, the account email and the expiry date. If those reminders go to the agency's address, note it, because you no longer receive the warnings.

For every asset, record the following:

• The asset and the service it lives in, for example the domain and its registrar.
• Account owner and login email, which tells you whether you or the agency holds it.
• Renewal date, plus the card or invoice that pays for it.
• Proof, such as an invoice, an email, a screenshot or a contract clause.
• Connected services, for example DNS, email, the SSL certificate, forms and payment plugins.

This list becomes the backbone of your request to the agency and of the new setup. It also gives you a permanent asset record for later.

Who should hold each asset, and how do you take it over?

The table shows the target state and the takeover route for each asset. However, platform menus change, so rely on each platform's official help page for the exact clicks.

How do you check who really owns the domain with WHOIS?

First, type your domain into our free WHOIS lookup. Then read the report: it shows the registrar, the creation and expiry dates, the last change and the status codes. If the expiry date is close, the matter gets urgent, because the renewal payment may come from the agency's account.

Status codes also help. For example, clientTransferProhibited means the registrar has locked the domain against transfers, and clientHold means the domain is on hold. In practice, a domain on hold means the site and email are already down.

Also, the registrant's details are often hidden or sit behind a privacy service. That is normal and not a problem by itself. However, to see whose name the domain really carries, you need someone who can open the registrar account, or the registrar's support team.

On the other hand, country-code domains can differ. For .tr domains, the registrar and date data do not come through RDAP (the standard lookup service for registration data) because the official record sits in TRABİS (the official registry system for .tr domains). Our tool then points you to the official lookup. If the expiry date has passed or is very close, also read our guide on getting an expired domain back.

In short, WHOIS does not give you access. It only shows who holds the registration and when it ends, so you send your first message to the right address.

What should your first move be, based on the WHOIS result?

The table lists the most common situations and the first move for each. So do not argue with the agency until you know which row describes you.

Often, the agency registered the domain with its own details. It usually did so for convenience, and bad intent is not required. Instead, write your first message to solve the problem, not to blame anyone.

What is the difference between the registrant, the registrar, DNS and hosting?

People mix up these four layers. However, each one lives in a different place, and an agency can hold one of them or all four.

• Registrant: the party that holds the rights to the domain; the official record carries this name.
• Registrar: the company that registers, renews and locks the domain and releases the transfer code.
• DNS provider: keeps the records that tell the domain which server and which email service to use.
• Hosting: the place where the site files and the database live.

For example, the domain may carry your name while the registrar account uses the agency's email. The domain may even sit with you while DNS and hosting stay with the agency. So the question "do we own the domain?" has no single answer. Instead, check all four layers one by one.

Also, when the registrar changes, DNS service may stay with the old company or stop. Therefore export your DNS records before the transfer.

What are the transfer lock and the EPP code, and must the registrar release them?

A transfer lock is a setting that protects the domain against unauthorized moves. An EPP code (also called an auth code) is the secret string that authorizes the move to a new registrar. Give the code only to the new registrar, because anyone who knows it can try to start a transfer.

ICANN's Transfer Policy covers generic extensions such as .com and .net. Specifically, it expects the registrar to give the code to the registered name holder and to remove the lock. If the registrar offers no self-service option, it must act within a set period after your request. So check the current period on that page.

The same policy says a registrar cannot refuse to remove the lock or release the code solely because of a payment dispute with that registrar. However, that protection runs between the registrant and the registrar. In other words, it does not settle a commercial dispute with your agency.

One more point: the policy sets a transfer lock after a registrant change. To avoid triggering it, request the registrar change before the registrant change, or use an opt-out if your registrar offers one. So agree on the sequence with your registrar in advance.

What if your domain is a .com.tr or another country-code domain?

Country-code domains follow their own registry's rules, not ICANN's generic policy. For .tr domains, the official record sits in TRABİS, so the registrant data, the registrar and the transfer rules come from TRABİS and the related regulations. Do not guess the steps. Instead, read the official pages.

The official TRABİS website publishes the domain lookup, the list of registrars, the regulations and the dispute resolution providers. Its FAQ pages also mention transfer and authorization codes. Read your registrar's instructions together with the TRABİS pages for the current steps.

Because the process can change, and a wrong step can put your domain at risk, we do not describe the TRABİS procedure here. Instead, confirm the documents and the application route with the official pages and your registrar.

For other country-code domains, such as .de or .uk, look for the registry's own transfer page. If there is a dispute, check the dispute resolution providers the registry lists. However, those routes have conditions and do not fit every contract disagreement, so discuss your case with a lawyer before you apply.

Which steps help you take back your website and domain from an agency that will not cooperate?

First, stay calm and keep everything in writing. If the agency does not respond or blocks you, follow this order, because each step strengthens the proof for the next.

1. First, collect the inventory and the evidence: contract, proposal, invoices, payment receipts and correspondence.
2. Next, send the agency a short, clear and polite written request that says what you need and by when.
3. When nothing comes back, send the same request through a second channel, for example a trackable letter.
4. Where your company is the registrant, apply to the registrar with the evidence.
5. For a .tr domain, follow the official TRABİS route and your registrar's instructions.
6. Finally, if the process stalls, consult a lawyer, because the ownership and handover clauses in your contract decide a lot.

Stay away from the following: logging into the agency's accounts without permission, guessing old passwords, forging documents, or paying strangers who promise to "recover" your domain. These actions are illegal. They also count as attempts to bypass the security systems of registrars, and they put your account at greater risk.

If the agency cites an unpaid invoice, that is a commercial dispute. In practice, a written settlement that covers payment and handover together is often the fastest route, but discuss it with your lawyer. We cannot guarantee the result of any route.

What if the agency does not answer at all?

The agency may have closed, the freelancer may have disappeared, or your messages may sit unanswered. In that case, your first job is to learn the registrant and the expiry date, because the biggest risk is that the registration expires and the domain drops.

1. Record the registrant, the registrar and the expiry date from WHOIS and the official lookup.
2. Then, if your company is the registrant, contact the registrar with company documents and invoice proof.
3. If the agency is the registrant, describe the situation to the registrar in writing and ask whether it has its own process for unreachable registrants.
4. At the same time, talk to a lawyer about your options.
5. Finally, if the expiry date is very close, plan what you will do if the domain drops.

A fallback plan may be rebuilding the site on a new domain. However, that affects your brand name, your search visibility and your email addresses, so treat it as a last resort. We cannot guarantee any outcome.

What belongs in your written request and your evidence file?

Keep the request short, but do not leave gaps. Ask for the following items in one email, as a list, and set a deadline.

• Updating the registrant details to your company and sending the transfer code.
• The registrar and DNS account details, or a full export of the DNS records.
• A full backup of the site files and the database from the hosting account.
• The admin login for the site, plus a list of plugin and theme licenses.
• A list of the business email accounts and a backup of their mail.
• Owner or admin roles in Search Console, Analytics, ad accounts, Business Profile and social accounts.
• Design and source files, and access to the code repository if one exists.

A short sample message could read like this.

Hello, we would like to take over the website and domain assets covered by our agreement. Please send the items on the attached list in writing by the date we have set. Keeping the site and email running during the handover matters to us, so we would like to agree on a transition plan together. Thank you.

Put the contract or proposal, the invoices and the payment receipts into the evidence file. Add the WHOIS screenshots and any messages where the agency says it bought the domain for you. Keep the dates. Also leave accusations and threats out of the message. A clear list and a fair deadline make the agency's job easier and will help your lawyer later.

How do you back up the site files and the database?

A backup has two parts: the site files and the database. If one is missing, the site will not run in its new home. Mailboxes need a separate backup, because mail often lives inside the hosting account.

If you can open the hosting panel and it is cPanel (a widely used hosting control panel), check the cPanel Backup Wizard documentation. It says you can make partial backups of the home directory, the MySQL databases and the email forwarders and filters. However, the same page says you cannot automatically restore a full backup file in cPanel, and your hosting provider has to do it. Your provider may also have switched the feature off.

If the site sits in the agency's own hosting account, for example a reseller account, the agency is the party to the hosting contract. So in most cases you only get the files and the database if the agency hands them over. Ask for these items: a file archive, a database dump, the PHP version, the scheduled tasks and a list of the plugins in use.

After you collect the backup, test a restore before you cancel the old hosting. Backups can also contain customer data, so ask your legal advisor about storage and deletion duties under the data protection rules that apply to you, such as GDPR or KVKK.

For the full method, read our website backup strategy guide. For the setup and the switch day on new hosting, use our hosting change checklist.

What can you do if the agency will not hand over the site or the site will not run elsewhere?

Some agencies build the site inside their own closed panel or a custom system. In that case, even a file backup may not run elsewhere. Be realistic here: the domain, the content, the images, the email and the accounts are your real assets. The design and the code, on the other hand, can be rebuilt, depending on your contract.

Think through the options in this order:

• Ask the agency for a system-independent export: content, images, the database and the source files.
• If the site runs on a hosted site builder or store platform, check the platform's official help for how ownership transfers.
• Check your contract to see who holds the rights and under which handover terms, and ask a lawyer if needed.
• If a move is impossible, take the domain and the content and rebuild the site on a new foundation.
• When you rebuild, keep the old URLs and plan the redirects, so your search visibility does not suffer.

The right path depends on the size of the site, your legal position and the urgency. Still, if the domain and the email are safe, you can handle the rest on a calm schedule.

How do you take over DNS without losing records?

DNS tells your domain which server, which email service and which verifications to use. Therefore, if the agency keeps DNS in its own account, export every record before you change nameservers. One missing record can cut off email or a verification.

With our DNS lookup tool, you can query A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records. The tool runs live queries and never changes a record. DKIM depends on a selector, so the tool does not find it by itself. Ask the agency or your email provider for the selector.

Export the records, rebuild them exactly at the new DNS service, and then change the nameservers. Also, lowering the TTL (the time records stay in caches) before the switch speeds up the change. Check your provider's documentation for the value to choose. If DNSSEC (a security layer that signs DNS answers) is on, follow your new DNS provider's DNSSEC instructions before you change nameservers. Otherwise the domain may stop resolving.

If DNS sits in a CDN (a content delivery network) or another service's account, ask for that account too. Otherwise the agency stays the party that can change your records, even when the domain is yours.

How does business email move without downtime?

Business email often lives in the hosting account that holds the site, or in a service account that the agency opened. Forgetting email during a site move is the most painful mistake we see. Email flow follows the MX records, so the order matters.

1. First, at the new provider (Google Workspace, Microsoft 365 or your hosting provider's email service), create the mailboxes and aliases.
2. Copy the old mail with the provider's official migration tool or with IMAP (a protocol that reads mail from a server).
3. Then switch the MX record to the new provider and watch both sides while it propagates.
4. Run a final sync, and after that set up clients such as Outlook and phones again.
5. Finally, update the SPF, DKIM and DMARC records (the email authentication records) for the new provider.

During propagation, some messages may still land in the old place. So keep the old mailboxes open until propagation ends, and do not close them before you copy the last difference. This guide covers only the handover. For methods, TTL and common mistakes, read our business email migration guide.

How do you take over Search Console, Analytics, ad and Business Profile accounts?

The rule is simple: your company's own Google account should own or administer each asset, and the agency should stay an authorized user. Do not break the order. First add yourself and confirm your access, then lower or remove the agency's role.

• Search Console: Verify the property with your own account first, then remove the old owner and the verification tokens. For the steps, see our guide on removing an old owner or user from Search Console.
• Analytics and Tag Manager: Give the admin role to your company's account, then adjust the agency's role.
• Ad accounts: Check who owns the account and whose payment profile pays, then reset access according to the platform's official help.
• Google Business Profile: According to Google's help page, only the primary owner can transfer primary ownership. If the agency is the primary owner, the agency does the transfer.
• Social media: Claim an admin role in each platform's business account.

If the agency will not give up primary ownership, follow the route on Google's request ownership page. On that route the current owner receives a notice and gets time to respond. However, we cannot guarantee the result.

How do you reset passwords and two-step verification after the handover?

When the handover ends, reset every password the agency knew. Change them anywhere you reused them. Also keep passwords in a shared password manager, and point recovery methods that use a personal phone number to addresses your company controls.

1. Reset the passwords for the registrar, DNS, hosting, the site admin panel and email accounts.
2. Turn on two-step verification for those accounts, and make the recovery email and phone company property.
3. Delete admin users you do not recognize, plus FTP and SSH accounts (file and command access to the server) and database users, and rotate access keys.
4. Then update plugins, themes and the site software.
5. Check email forwarding rules and any DNS records that do not belong to you.
6. After the agency finishes its tasks, remove its access or convert it to a limited user.

To keep security and updates on track afterwards, use our monthly website maintenance checklist. Finally, ask the agency to confirm in writing that it deleted the copies it holds.

Which mistakes do people make most often during a handover?

These mistakes repeat in the field. Most of them come from a broken order or a forgotten asset.

• Canceling the old hosting account or closing the agency's access before you take a backup.
• Changing nameservers without a DNS export, which cuts off email and verifications.
• Squeezing the registrant change and the registrar transfer into the same days and running into the waiting period.
• Forgetting email and switching the MX record before the mailboxes are ready.
• Calling the handover finished without deleting verification tokens and old admin users.
• Skipping the renewal date in your calendar and the routing of reminders to a shared address.

Haste is the common thread. So plan the work day by day, and confirm that each step works before the next one.

Should you take back your website and domain from an agency yourself or get help?

If the domain sits in a registrar account and the agency cooperates, you can often manage the process yourself. However, some situations save time when you get help: sites built on closed systems, many mailboxes, online stores and several domains.

• You can do it yourself when you have one domain, written cooperation, a common site system and few mailboxes.
• Get technical help when the site uses a closed system, runs a store or loses money during downtime.
• Get legal help when the agency is the registrant and refuses, or when the contract is unclear.

We are not a hosting or email provider. We set up, migrate and manage websites and business email on Google Workspace, Microsoft 365 or your hosting provider. Depending on your scope, you can request a quote for your website and business email.

What does an example scenario look like?

This is an example scenario, not a real client story. A small service business had its site built by a freelance developer a few years ago. The two parties part ways, and nobody knows who holds the domain.

1. The owner builds the inventory and learns from invoices that the domain sits in the developer's account.
2. WHOIS hides the registrant, but the registrar and the expiry date stay visible.
3. Next, the business sends a written request for the handover, the backup and the transfer code, with invoice proof attached.
4. Then the developer updates the registrant details, and the registrar asks for extra verification.
5. After that, the business takes a backup, exports the DNS records, sets up email at the new provider and switches MX last.
6. Finally, the owner resets passwords, closes old access and puts the renewal date in the calendar.

Everything goes smoothly in this example. In real life, the process may take longer depending on the agency's reaction, and legal help may become necessary.

Which rules stop this from happening again?

One principle solves most of this problem: open every account in your company's name, and add the agency as an authorized user. Then nothing disappears when the agency changes or the relationship ends.

• Put your company in as the registrant, and open the registrar account with a company email.
• Keep two-step verification for registrar, hosting and Google accounts under company control.
• Give the agency the permissions the job needs, not full admin rights.
• Write asset ownership, the handover period and the backup delivery into the contract.
• Review the access list at least once a year.
• Send renewal reminders to a shared email group, and turn on auto-renewal with a company payment method.

We covered what to look for in a contract in our guide on how to choose a web design agency. If you start with a new agency, write these rules down on day one.

Is the handover really finished? A final checklist

Use this list to close the handover. Do not cut ties with the agency until you can tick every item.

• WHOIS or the official lookup shows your company as the registrant.
• You manage the registrar account with a company email, and the renewal date sits in your calendar.
• DNS records are complete, and the MX and TXT records work.
• Your site opens on the new hosting, and you tested forms and the payment flow.
• The SSL certificate is valid, and you can verify it with our SSL checker.
• Email sending and receiving tests pass.
• Search Console, Analytics, ad accounts and Business Profile all list your company as owner.
• Every password is new, and two-step verification is on.
• The agency has lost its access or keeps only a limited role.
• Backups run on a schedule, and you tested a restore.
• You turned the transfer lock back on after the transfer finished.

When the list is complete, you really control your website, your domain and your email. The next step is to anchor this setup in the contract and in a regular maintenance routine.