Not always. A live website doesn't tell you who controls it. If a web designer or freelancer built your site, you're in control only if you hold four things: its address (the domain), the place it's stored (hosting), the website files (also called the source code), and the logins to the tools it connects to. In August 2026 a local restaurant came to us thinking it owned its site. It held none of the four.
If you run a small business in Singapore, here's how to check what you hold. We're Thornbury, a new web studio in Singapore. We've seen two cases like this, so that's all we can speak for. We're not lawyers, and this isn't legal advice. It's about who holds the logins, not what a court would say.
What are you actually buying from a web designer or freelancer?
Four things, and a seller can hand you the finished pages while keeping the rest.
| What it is | What that means | Who should hold it |
|---|---|---|
| Domain | The website's address, like yourshop.com.sg | Your business, named as the holder |
| Hosting | The computer your site is stored on, rented monthly or yearly | You, in an account billed to you |
| Website files | The original files a developer uses to rebuild or move your site, like the master copy of a document | You |
| Connected logins | The logins and codes ("keys") that link your site to tools like maps, bookings or email | You, in accounts in your name |
If any of these sits in someone else's name, your website depends on that person staying reachable and paying their bills.
The Internet Corporation for Assigned Names and Numbers (ICANN) helps coordinate domain names. It advises against putting a web designer or hosting company down as the holder of your domain, meaning the business it's registered to. That's in ICANN's guide for domain owners, published in 2018 (accessed 2026-10-02).
What went wrong for a local restaurant?
The seller held the restaurant's domain, hosting and connected logins. The restaurant held none of them. It came to us in August 2026. The site runs on WordPress, a website-building system, and the restaurant bought it online from an independent seller.
The site was online, so the owner took it for granted that it was theirs. But the site works, so why does it matter? It matters the day something changes. If the seller's account closes or the bills stop, the site goes down, and so does the address customers type. We don't know that will happen. When the site came to us, the restaurant had no way to stop it if it did.
What went wrong for a small tuition business?
A freelancer built this one. The files sat in the freelancer's own personal account on a code-sharing website (an online folder where programmers keep a project's files), and the business had no control over that account. The files were also set to public, which means anyone could look at them and download them.
When the site came to us, we copied the whole thing. So could anyone else. Think of it as leaving your shop's floor plans on a public noticeboard. You might not mind. Some owners would.
There was a second gap. Websites can send small settings, called security headers, that help a visitor's browser avoid easily preventable problems. None were switched on when we looked. That doesn't mean anyone got in. You can ask whoever built your site whether they're switched on.
We moved the site into a business account set up in the tuition business's own name, so it was theirs from day one. A business account belongs to the company, not to one person. It's theirs to run now.
How can you check what you hold?
With seven yes-or-no checks, each with a place to look. If you can't log in to something, count that as a no.
- Can you log in yourself to the account where your domain is kept, and does the email on that account belong to you? Where to look: search your inbox for "domain", or for names like GoDaddy, Namecheap or Cloudflare (companies that sell domains), or look for yearly charges on your card statement.
- Is your business, not your designer, named as the holder of that domain? Where to look: the contact details inside the domain account. Or search Google for "domain lookup", type in your address, and look for the registrant, which is the business the domain is registered to. Many domains show "privacy protected" instead. If yours does, use the domain account's contact details.
- Is the domain set to renew automatically, and do you know when it expires? Where to look: the settings page of the same domain account, often under "auto-renew".
- Is your hosting billed to you, and can you log in to it? Where to look: your card or bank statements for charges from a company that hosts websites, then that company's login page.
- Do you hold a recent full copy of your site, stored somewhere you control? Ask whoever built or hosts it to send one. Not sure if you're on WordPress? Add /wp-admin to the end of your address. A login page usually means yes. A WordPress site needs two parts to be restored: the files, and the database, which holds your posts, comments and links. WordPress's own documentation (accessed 2026-10-02) says you need both.
- Are the accounts your site uses for forms, email and visitor numbers in your name? Ask whoever built it to list every outside tool the site uses and whose account each one is under.
- If your site's files are kept on a code-sharing website, is the account yours, and are the files private unless you chose to make them public? Ask whoever built it where the files are kept.
If any answer is no, send whoever built your site a message like this, and keep their reply.
Hi, I'd like to make sure I hold everything for my website. Can you send me, by [date]: (1) the login for my domain, (2) the login for my hosting, (3) a full copy of my website's files and database, (4) a list of every outside account the site uses and whose name each is in, and (5) where the site's files are kept and whose account that is? Thank you.
If you can't reach them, start with checks 1 to 4, which don't need their help. If the domain is in their name, ask the company where it's kept what proof it needs to move the domain into yours. That can be slow, and we can't promise it works. If they won't help, ask someone independent, such as another web developer you trust, to look. If you'd like to talk it through, get in touch.
What does Thornbury Studio hand over at the end of a build?
All four things in this post, in your name. Thornbury Studio works inside your accounts on access you can remove at any time, and never opens a business-critical account in its own name. So nothing of yours can be held hostage, and nothing depends on anyone at the studio staying reachable.
What you leave with:
- The domain, hosting, website files and connected logins, all in accounts you created yourself.
- A live handover session of about two hours, with you there. It isn't finished until you've logged in to every account on your own.
- A written list of who holds each account, to keep.
- Free small changes after launch for three months or one month, depending on the rate you choose. Each one is delivered within 48 hours.
Its Services page puts it simply: "The site is yours outright, source included". Source means the website files.
Two behind-the-scenes tools do stay on the studio's own accounts, error alerts and a guard against floods of traffic, because nobody outside the studio logs into them. If you'd rather check first, ask any studio, Thornbury Studio included, for that list in writing before you sign.
