Locked Out of Your Own Website: The Small Business Hostage Crisis Nobody's Regulating

When the agency stopped answering emails, Sarah — who runs a specialist bakery business in Yorkshire — assumed it was a blip. Three months later, she'd discovered something worse than bad service: she couldn't get into her own website. No admin login. No access to the hosting account. The domain, it turned out, had been registered under the agency's name from day one.

'I paid £6,000 for that site,' she says. 'And legally, as far as I could establish, I didn't own any of it.'

She's not alone. Talk to small business owners long enough and a pattern emerges: companies that treated their website as an asset, only to find it was effectively rented property with the landlord holding every key.

How the Lockout Happens

Very few agencies set out to trap clients. The lockout usually happens through a combination of convenience and drift:

• The agency registers the domain because it's quicker, and never transfers it.
• Hosting sits in the agency's master account, with client sites as sub-accounts.
• Admin credentials live with the developer who built the site — and who left the company two years ago.
• The contract is silent on ownership, or worse, explicitly assigns design and content rights to the agency until 'final payment', a definition nobody tested.

Then the relationship ends — the agency folds, is acquired, or simply stops trading — and the business owner discovers that reclaiming their own digital identity requires something they don't have: proof of ownership.

The Legal Grey Zone

UK law doesn't make this easy. Domain ownership is determined by registrant records, not invoices. Copyright in commissioned work sits with the creator unless it's explicitly assigned in writing — meaning a business may own the content they wrote but not the design that presents it. And when an agency enters insolvency, digital assets can end up in the hands of administrators who have no idea (and no obligation to care) which website belongs to which bakery in Yorkshire.

The practical consequences are brutal. Some owners have had to rebuild from scratch. Others have watched their domain lapse and get snapped up by resellers. A few have paid a 'release fee' to a former agency simply to regain access to their own brand.

Three Owners Who Fought Back

The stories vary, but the playbook for recovery is similar. One owner of a Midlands plumbing firm spent four months and several strongly worded letters — backed by a solicitor's letterhead — to get his domain transferred. A Bristol florist, whose agency had dissolved, went through the insolvency practitioner and, failing that, rebuilt her site from archived pages and re-registered a variation of her domain. A third, an accountancy practice in Glasgow, discovered mid-dispute that their contract assigned 'all intellectual property' to the agency. They settled. It was cheaper than fighting.

The lesson from all three: prevention costs nothing. Recovery costs everything.

The Due Diligence Checklist

Before you sign any web contract — new build, redesign, or ongoing retainer — run through this list. If any answer is wrong or unclear, stop.

1. Who is the named registrant on the domain? It should be you, or the contract should guarantee transfer on completion.
2. Where does hosting live? Ask for your own hosting account, or at minimum documented access and a full backup.
3. Do you get admin credentials, not just a CMS login? Admin, not editor.
4. Who owns the design and content IP? Get it in writing: full assignment to you on final payment.
5. What happens if the agency folds? Ask the question directly. A good agency will have an answer; a bad one will change the subject.
6. Can you export your data? Confirm you can take content, customer records and media with you if you leave.
7. Is there a source-code or access escrow? For bigger builds, this is standard and reasonable.

Own the Keys

A website is often a small business's most valuable marketing asset — sometimes its most valuable asset, full stop. Treat it like the premises. You wouldn't sign a lease where the landlord held your stock and your customer list.

Ask the awkward questions before you sign, not after the emails stop getting answered. The best time to secure your digital keys is the day the project starts. The second-best time is today.