Who owns your website domain, hosting and logins?

Your organization should hold its own domain, hosting account and website administrator login, in its own name, with contact emails it controls. You can check the domain in a few minutes with a public lookup; the rest takes a few questions to whoever set the site up. If any of it turns out to be in a former volunteer’s, staff member’s or web company’s name, move it now, while everyone is on good terms.

Why does it matter who holds the accounts?

Because whoever holds them controls the website. If the domain lapses, your site and your email stop working. If the hosting account is in someone else’s name, they decide what happens to it. And if nobody in the organization has an administrator login, you cannot change anything without asking.

None of this usually starts badly. A volunteer or web company sets things up quickly in their own name, meaning to transfer them later. Later rarely comes.

Step 1: look up your domain

Domain registration data is public, with limits.

For a .ca domain, use CIRA’s lookup (CIRA WHOIS). It always shows the registrar, the creation and expiry dates, and the status. For individuals, the registrant’s details are hidden automatically, and the result says the registration is privacy protected (CIRA, WHOIS privacy). If your organization’s domain shows as privacy protected in that way, that is a clue it may be registered to a person rather than the organization.
For a .com, .org or other generic domain, use ICANN’s lookup (ICANN Lookup). It shows the registrar and dates; personal details are often withheld, and ICANN points to the registrar for those (ICANN, RDAP).

Note the registrar and the expiry date. Then ask whoever manages it to confirm, from inside the registrar account, who the registrant and the administrative contact are.

Who is the “registrant”, and why does it matter?

The registrant is the legal holder of the domain registration. For .ca domains, CIRA also allows an administrative contact who can act for the registrant, including renewing, transferring or deleting the domain (CIRA, Registrant Agreement, s. 3.5). Both should be the organization, or people acting for it, with email addresses the organization controls. CIRA sends notices by email only, and keeping those addresses working is the registrant’s responsibility.

What happens if the domain expires?

It does not disappear immediately, but the window is shorter than people assume.

.ca domains: at expiry, CIRA renews the domain with the registrar for a year, and the registrar gives you a grace period of up to 45 days, depending on the registrar, during which your site and email may stop working. If it is still not renewed, the domain enters a 30-day redemption period, which CIRA describes as the final opportunity to renew. After that, it is released for anyone to register (CIRA, domain name life cycle).
Generic domains (.com, .org): the registrar must send reminders before and after expiry, and allow renewal for at least 8 days after it, with the site interrupted. Many registrars then offer a 30-day redemption period (ICANN, Expired Registration Recovery Policy).

Either way, if the reminders are going to someone who has left, you may not know until the website goes down.

Step 2: find out who holds the hosting

Ask two questions: whose name is the hosting account in, and whose card pays for it? The invoice usually answers both. If it is a web company’s account, ask whether your site can be moved to an account in your name, and what they need to do it.

Step 3: check the website logins

In WordPress, look at the Users screen for everyone with the Administrator role. The organization should have its own administrator account, held by a named person and not shared.
In Google Search Console, check who the owners are (Google, Search Console permissions).
In Google Analytics, check who the administrators are (Google, Analytics access).

What about the design and the code?

Holding the accounts is not quite the same as owning the work. Under Canada’s Copyright Act, the author of a work is its first owner, unless it was made by an employee in the course of their job, and a transfer of copyright must be in writing and signed (Copyright Act, section 13). A web company or volunteer who built your site may therefore own the copyright in parts of it unless your agreement says otherwise. Most web contracts deal with this; check yours, and ask a lawyer if it matters to you. This is general information, not legal advice.

How to move it all into your name

Domain: ask the current registrant to change the registrant to the organization through their registrar. For .ca, the organization must meet CIRA’s Canadian presence requirements (CIRA, general registration rules). Update the administrative contact and account email at the same time.
Hosting: move the account into the organization’s name, or move the site to a new account you hold.
Logins: create organization-held administrator accounts, then remove or reduce the old ones.
Write it down: registrar, host, expiry dates, who has administrator access, and who to call. Keep it with the board’s records.

If someone is leaving now, use our handover checklist.

Disclosure: when GMNI builds or takes over a site, the domain, hosting account and administrator access stay in the client’s name. See Managed Care.

If you would like help finding out who holds what, schedule a discussion.

Sources (checked 30 September 2026)