Who Owns Your Domain and Law Firm Website Accounts

Does Your Firm Actually Control Its Own Website?

Ask a partner who owns the firm’s website and the answer is usually “we do.” Ask who can sign in to the domain registrar and the room often goes quiet. Law firm website ownership is not one thing. Instead, it is a set of separate accounts, and each one can sit in a different person’s name.

That gap rarely matters until something goes wrong. A vendor closes, a staff member leaves or a renewal notice goes to an old inbox. Then the firm learns that its domain, email and search history depend on a login it does not hold.

These points are for partners who work with an outside web vendor. It explains what each account does, who should own it and how to record access. It also gives you an access inventory and a safe handoff checklist you can use this month.

Key Takeaways

• Your website runs on at least six separate accounts, and each needs its own owner.
• The firm, not a vendor or one employee, should be the registered owner of the domain.
• DNS controls email as well as the website, so a DNS mistake can stop client mail.
• Give vendors named user access instead of sharing the firm’s main login.
• Keep passwords in a firm password manager, never in email or chat.
• Treat form submissions, the CMS and analytics as places where client information can sit.

Which Accounts Make Up Law Firm Website Ownership?

Most partners picture the website as one product the vendor “hosts.” In practice, several services work together. Some are paid annually, some are free and some are tied to a personal Google account. Therefore, the first step is to name each layer.

What Does the Domain Registrar Control?

The registrar is the company where the firm’s domain name is registered. Common examples include GoDaddy, Namecheap, Squarespace Domains and Cloudflare Registrar. The registrar account holds the right to renew, transfer and point the domain.

The most important field is the registrant, which names the legal holder of the domain. If a past designer registered the domain in their own name, that person may hold it, even if the firm paid every bill. ICANN’s information for domain name registrants explains the rights and duties that come with that role.

Check three things in the registrar account:

• Registrant name: the firm’s legal name, not a person or vendor.
• Contact email: a firm-controlled address, such as a shared admin mailbox.
• Renewal settings: auto-renew on, with a current firm payment card.

What Does DNS Do, and Why Does It Affect Email?

DNS is the directory that tells the internet where to send traffic for your domain. Often the registrar also runs DNS, but many vendors move DNS to Cloudflare or to their hosting company. As a result, DNS may live in a third account that nobody at the firm has seen.

DNS records point the website to a server. However, they also route email through MX records and protect it through SPF, DKIM and DMARC records. A vendor who edits DNS during a site move can break firm email by accident. So whoever holds DNS access holds a key to client communication, not just the website.

What Is Hosting, and Who Pays for It?

Hosting is the server where the website files and database live. A firm might use WP Engine, Kinsta, SiteGround or a vendor’s own reseller plan. Under a reseller plan, the firm pays the vendor, and the vendor holds the hosting account.

Reseller hosting is common and is not wrong by itself. Even so, the firm should know where the site lives and how to get a full backup. Ask whether the contract lets the firm move the site and its database if the relationship ends.

What Does the CMS Login Cover?

The CMS is the system you use to edit pages, such as WordPress, Squarespace, Wix or a custom platform. For many firms, it is WordPress with an administrator account the vendor created at launch.

The CMS often stores more than pages. For example, contact form plugins can save every submission in the database. Those entries may include a prospect’s name, phone number and a description of their legal problem. That makes CMS access a confidentiality issue as well as a marketing one.

Where Do Analytics, Search Console and Google Business Profile Fit?

These three Google tools sit outside the website itself, so they are easy to overlook in a handoff:

• Google Analytics 4: records how visitors use the site. Ownership sits at the account and property level.
• Google Search Console: shows how the site appears in Google Search. It needs a verified owner.
• Google Business Profile: controls your listing in Google Maps and local results.

Each tool lets you add owners and users. Google explains the roles in its help pages on Search Console owners and users, Analytics users and user groups and Business Profile owners and managers. In each one, a firm account should be the primary owner, and the vendor should be a user or manager.

Search Console also depends on site verification, which often uses a DNS record or a file on the server. Google’s page on verifying site ownership lists the methods. If a vendor verified the site and later removes that record, access can lapse.

What Counts as an Agency Login?

Agency logins are accounts the vendor uses to run the work. Examples include a project portal, a form service such as Gravity Forms or Jotform, a call-tracking tool, a chat widget and a paid ads account. Some carry licenses in the vendor’s name.

These tools can hold call recordings, chat transcripts and intake details. For that reason, list them as carefully as the domain. Then ask which ones the firm would need to keep if the vendor left.

What Does Law Firm Website Ownership Look Like in Practice?

Good ownership has a simple pattern. The firm holds the top-level account for every layer. Meanwhile, the vendor works through its own named login with the access it needs, and no more.

Consider a common setup that goes wrong. A designer registers the domain on a personal account in 2016 and builds the site. Years later, the firm switches vendors. The new vendor cannot move DNS, and the old designer no longer answers email. Because the domain is in the designer’s name, the firm now faces a slow recovery process with the registrar.

Now consider the same firm with good ownership. The domain sits in the firm’s registrar account, under the firm’s legal name. The old vendor had a named user login, so the firm removes it in five minutes. The new vendor gets its own login the same day.

Why Should the Firm Use a Shared Admin Mailbox?

Many accounts are tied to the email address that created them. If that address belongs to one associate or office manager, access leaves when they do.

Instead, create a firm-controlled admin address, such as webadmin@ your domain. Two partners or a partner and the firm administrator should be able to reach it. Then use it as the owner email for the registrar, hosting and Google tools.

What Is the Difference Between Owner Access and User Access?

Owner access lets someone add and remove other people, change billing and transfer or delete the account. User access lets someone do the work, such as editing pages or reading reports.

A vendor rarely needs owner rights. For example, in Search Console a full user can review data and request indexing without being able to remove the firm. In GA4, an editor role often covers what an agency needs. Grant the lowest role that still lets the vendor do the job.

How Do You Build a Law Firm Website Ownership Inventory?

An access inventory is a single record of every account, who owns it and who can sign in. It takes an afternoon to build the first time. After that, an annual review keeps it current. If you are planning a redesign, build it before the project starts, as covered in our guide to law firm website planning.

Start with your invoices and renewal emails, since each bill points to an account. Then ask your vendor for a list of every service they set up for the firm. Compare the two lists and resolve any gaps.

What Should the Access Inventory Table Include?

Use one row per account. Keep the inventory itself free of passwords, because the password manager holds those.

Account	Example providers	Firm should hold	Vendor should hold	Check
Domain registrar	GoDaddy, Namecheap, Cloudflare	Owner account, registrant in firm name	Usually none, or delegated access	Registrant name, renewal date, auto-renew
DNS	Registrar, Cloudflare, host	Owner account	Named user if they manage records	MX, SPF, DKIM and DMARC records listed
Hosting	WP Engine, Kinsta, reseller plan	Owner account or written right to a full copy	Named user	Backup location, plan renewal
CMS	WordPress, Squarespace, Wix	Administrator on a firm account	Named editor or admin user	User list, stored form entries
Google Analytics 4	Google	Account administrator	Editor or viewer	Owner email, data retention setting
Search Console	Google	Verified owner	Full or restricted user	Verification method
Google Business Profile	Google	Primary owner	Manager	Owner email, listing details
Forms, chat and call tracking	Gravity Forms, Jotform, CallRail	Account in firm name where possible	Named user	Where submissions and recordings are stored
SSL certificate	Host, Let’s Encrypt, Cloudflare	Visibility of renewal	Setup and renewal	Expiration date

Add columns for the renewal date, the annual cost and the date someone last confirmed access. Also add a notes field for contract terms, such as who owns the theme or design files.

Who at the Firm Should Keep the Inventory?

Assign one person, such as the firm administrator, to keep it current. Then name a partner as the backup who can approve changes. Store the inventory in the firm’s document system, not in a vendor’s project portal.

How Should You Protect Logins and Client Data?

Website accounts can expose confidential information. ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized access to client information. Rule 5.3 covers duties for nonlawyer assistants, which can include outside vendors. These are model rules, so check your state’s version.

Why Not Send Passwords by Email?

Email is searchable, forwarded and kept for years. A password sent in a message stays in both mailboxes and every backup. If either account is later compromised, the attacker gets the website too.

Instead, use a business password manager such as 1Password, Bitwarden or Keeper. Share each login through a vault with the people who need it. When someone leaves, you remove them from the vault and change the affected passwords.

Why Give Each Person a Named Account?

Shared logins hide who did what. If three vendor staff use one “admin” account, the firm cannot tell who changed a page or exported form data. Named accounts create a record and let you remove one person without affecting others.

Turn on two-factor authentication for every owner account. Where possible, use an authenticator app rather than text messages. Also make sure the second factor is tied to a firm device or shared account, not one person’s phone.

Where Can Client Information Hide on a Website?

Partners often assume the website holds only marketing copy. However, several places can store details a prospect shares:

• Form entries: many WordPress form plugins save each submission in the database.
• Email notifications: form alerts may go to a vendor inbox as well as the firm’s.
• Chat transcripts: live chat tools often keep full conversations.
• Call tracking: some services record calls and store transcripts.
• Analytics: a poorly set up form can pass names or emails into page URLs, which analytics then records.

Review each one with your vendor. Turn off stored form entries if the firm does not need them, or set a deletion schedule. Make sure form alerts go only to firm addresses. Also confirm that no personal details appear in tracked URLs.

What Belongs on a Safe Handoff Checklist?

A handoff happens when a vendor leaves, a new one starts or an employee who held access moves on. The goal is to move control without losing data or breaking email. Work through the list in order, and record each step in the inventory.

What Should You Do Before the Handoff?

• Confirm the firm can sign in to the registrar, DNS, hosting and each Google tool as owner.
• Export a full site backup, including files and the database, and store it in firm storage.
• Export GA4 and Search Console reports you rely on, in case access lapses.
• Screenshot or export every DNS record, including email records.
• Note the domain’s expiration date, and avoid a transfer within a few days of renewal.
• Review the contract for who owns the design, theme, photos and written content.

How Do You Move Accounts Safely?

• Add the new vendor as a named user before you remove the old one.
• Change the registrant and owner emails to the firm’s admin mailbox if they are not already.
• If you are moving the domain to a new registrar, follow the registrar’s steps for the authorization code. ICANN’s Transfer Policy sets the rules registrars follow.
• Move DNS only after you have copied every record, then test email right away.
• Check that Search Console verification still works after any DNS or hosting change.

What Should You Do After the Handoff?

• Remove the old vendor’s user accounts from every tool on the inventory.
• Change any password the old vendor ever knew, starting with owner accounts.
• Revoke API keys and plugin licenses tied to the old vendor.
• Confirm form alerts, chat and call tracking now reach only firm addresses.
• Send a test form, a test email and a test call, then confirm each arrives.
• Update the inventory with new users, dates and renewal details.

What Should a Vendor Contract Say About Ownership?

The contract is where law firm website ownership becomes enforceable. Many web agreements are silent on accounts, so add clear terms before work starts.

Which Ownership Terms Are Worth Asking For?

Ask for written terms that cover these points:

• The firm is the registrant of the domain and the owner of the Google accounts.
• The vendor will provide a full site backup on request and at the end of the contract.
• Content, photos and design files the firm paid for belong to the firm, subject to stock and font licenses.
• The vendor will return or delete firm and client data when the work ends.
• The vendor will use named accounts and will not share firm logins among staff.

Some vendors license a custom theme or platform rather than transferring it. That can be reasonable, but the firm should know before it signs. If the site cannot leave the vendor’s platform, plan for a rebuild cost if you ever switch.

How Do Advertising Rules Connect to Account Control?

ABA Model Rule 7.1 bars false or misleading statements about a lawyer’s services. The firm remains responsible for what its website and Business Profile say, even when a vendor writes the copy. If you cannot sign in, you cannot correct a problem quickly. So account control also supports compliance with your state’s advertising rules.

How Often Should a Firm Review Website Access?

Law firm website ownership needs upkeep, so review the inventory at least once a year. Also review it whenever a partner, administrator or vendor changes. A short review covers four questions:

• Can the firm still sign in as owner to every account?
• Does every user still need access, and at the right level?
• Are renewal dates, payment cards and contact emails current?
• Has any new tool been added, such as a chat widget or scheduling app?

Put the review on the firm calendar next to other annual tasks, such as malpractice insurance renewal. It takes less than an hour once the inventory exists.

Common Questions

What if our vendor refuses to hand over access?

Start with the contract and your payment records, since they show what the firm bought. Then contact the registrar about the domain, because registrars have processes for disputes. Keep the request in writing and avoid threats that could slow the process.

Is it a problem if our domain is in an employee’s name?

It is a risk, even if that person is trusted. Ask them to change the registrant to the firm while the relationship is good. Then move the account to the firm’s admin mailbox.

Should partners hold the passwords themselves?

Not personally. Instead, the firm should hold them in a business password manager. At least two people should be able to reach owner accounts, so no single absence locks the firm out.

Do small firms really need an inventory?

Yes, and it is often shorter. A solo or two-lawyer firm may have only six or seven rows. Even so, those rows control the firm’s email, search listing and website.

Next Steps

Pick one account this week and confirm the firm is the owner, starting with the domain registrar. Then build the rest of the inventory from your invoices and your vendor’s list. If you would like help reviewing your setup, reach out to the Lawgility team.

References and Review Date

Reviewed October 25, 2026.

• ICANN, Information for Domain Name Registrants
• ICANN, Transfer Policy
• Search Console Help, Managing owners, users, and permissions
• Search Console Help, Verify your site ownership
• Analytics Help, Add, edit, and delete Analytics users and user groups
• Google Business Profile Help, Manage your Business Profile owners and managers
• ABA Model Rules of Professional Conduct 1.6, 5.3 and 7.1 (model rules; your state’s version controls)