How to regain access to your website from an agency: a list of keys

Many companies discover that they don’t hold the keys to their own website only when something breaks. The agency stopped replying, an employee left, and the domain is registered to someone else. Then the question “how to regain access to a website from an agency” becomes urgent, and every day costs customers.

In this guide I show which keys every business has online and who should hold them. You get a checklist, a ready message to the agency and a description of typical scams. This is general practical knowledge, not legal advice. I describe the situation as of 29 October 2026; check the details of the law and of platform rules in the sources.

Why missing keys are a real problem

A business website is not one file but several accounts: the domain, the server, the Google listing, analytics, Facebook and Instagram. Each of them could have been set up by someone else.

Typical scenarios look like this:

• the agency registered the domain to itself, because “it was faster that way”,
• the Google Business Profile was set up by a former employee on a private account,
• the Meta ad account is attached to the personal profile of someone who no longer works for you,
• the passwords are in one email or in one person’s head.

Step 1: check who is the domain registrant

A domain is the address where customers find you and where company email runs. Whoever holds the domain has the strongest bargaining chip. So check it first.

1. Go to dns.pl and look up your .pl domain in the WHOIS search. You will see the registrar and the dates, and if the registrant is a company, also its name. Data of private individuals is hidden.
2. Look through the documents from the end of the project: invoices, emails confirming registration, messages from the registrar.
3. Ask the agency or the person who set up the domain whom it is registered to. Ask for the answer by email.

Two terms are important. The registrant (in the .pl system, “abonent”) is the person or company that signed the contract for maintaining the domain and on whom it is recorded in the registry. Colloquially it is called the “domain owner”. The registrar is the company where you maintain and pay for the domain.

Ideally, the registrant is your company (with your NIP, Polish tax ID), and the account at the registrar is under your email address. The agency can have auxiliary access, but it is not the registrant.

Step 2: set up auto-renewal and secure the payment details

An expired domain is one of the most expensive small mistakes. The site disappears and email stops working. According to dns.pl, a .pl domain waits up to 30 days for renewal at the registrar after the end of the paid period, and then someone else can register it.

What to do right away:

• turn on auto-renewal in the registrar’s panel,
• check the card or payment details, so that the card’s expiry date doesn’t fall before the renewal,
• set reminders to two different email addresses, including one on a domain other than the company one,
• write the domain’s expiry date in your calendar 30 days before the deadline.

If the domain is with the agency, ask for confirmation of until when it is paid and who pays for the next renewals. I will sort out the domain, server and SSL certificate in the Domain and hosting service.

Step 3: a list of keys to check

The table shows what to check. In the last column there should be your company, not the contractor.

There is one rule: the account is yours, the contractor gets access. The reverse arrangement, where your company is “invited” to someone else’s account, means that you are not the one holding the keys.

Step 4: Google and Meta, the accounts that are easy to miss

These three places are usually set up “along the way”, and then nobody remembers them.

Google Business Profile

In the business profile settings open the “People and access” section. The primary owner should be your company’s account. The agency can be a manager who doesn’t add or remove users, and removing it after the cooperation ends is easy. There is only one primary owner, so add at least one more owner from your company.

Google Analytics 4 and Search Console

In GA4 (Admin → Access management, at the account and property level) make sure two people from your company have the administrator role. In Search Console (Settings → Users and permissions) check who is the owner. If only the contractor is, ask to be added as an owner or, if you have access to the domain’s DNS, verify ownership yourself. After the cooperation ends, also remove its verification tokens, because otherwise it can confirm ownership again. This way the results and the query data stay with you, even after you change agencies. If tracking of phone calls and forms needs improving, I can help in the Analytics and tags service.

Meta Business

In Meta Business Suite open the business portfolio settings (formerly Business Manager) and see who has full control and who owns the ad accounts and the Facebook page. A common mistake is a single person with full control who has left the company. Make sure there are two such people from your company and turn on two-factor authentication for them. I describe what to do when a stranger has already taken over the account in the guide on a hijacked company Facebook account.

I will set up and tidy your Google Business Profile in my Google Business Profile service.

Step 5: how to regain access to a website from an agency

If the keys are with the contractor, act calmly, factually and in writing.

1. Gather documents: the contract, invoices, payment confirmations, correspondence about the domain and hosting.
2. Send a request by email with a specific deadline. A ready text is below.
3. Ask for the handover of the domain registrant role, the hosting panel details, the administrator role in GA4, Search Console, Google Business Profile and Meta, and a copy of the site.
4. Change the passwords and add a second person immediately after receiving the access.
5. If the agency stays silent, check the contract clauses on the transfer of rights and the handover of the domain. In a dispute, consult a lawyer, because a lot depends on the wording of the contract.

A ready message to copy:

Hello, in connection with the end of our cooperation, I ask for the handover of access to my website and related accounts: the domain (change of registrant to my company), the hosting panel, Google Analytics 4, Search Console, the Google Business Profile and Meta Business, together with a copy of the site files and database. Please confirm and complete the handover by [date]. If you have any questions, please contact me by email.

I write about what to put in the contract so that the problem doesn’t come back in the guide on the website development contract.

Fake “domain renewal invoices”

Messages that look like a bill for renewing a domain, or a warning that it is about to expire, land in company inboxes. The sender is often unknown, the amount inflated, and the link leads to a payment or to a form asking for data. Such messages prey on the fact that nobody remembers who holds the domain.

How to defend yourself:

• don’t click links in an email with an invoice from an unknown company,
• log in to your registrar’s panel (type the address by hand) and check the expiry date,
• ask the person or agency that looks after the domain whether the message is theirs,
• don’t pay under pressure of a deadline “within 24 hours”.

I describe a related scam in the guide on a swapped bank account number on an invoice.

Step 6: a password manager and two people

The last key is the place where you keep the others. Passwords in emails and on scraps of paper are a risk, while a password manager with a company account keeps access details in one vault, divided among people.

What to set up:

• a shared company vault with logins for the domain, hosting, Google and Meta,
• two-factor authentication everywhere it is available,
• a second person with administrator rights on every important account,
• an emergency sheet with recovery codes in a locked place,
• a review of access every few months and after every employee or contractor leaves.

If you want to check whether the site itself is resistant to simple attacks, I will carry out a security audit. If you don’t want to keep track of updates and backups yourself, technical maintenance takes care of that.

Summary

The keys to a business online are the domain, hosting, Google and Meta, and all of them should be registered to your company, with two people holding access. Start by checking the domain registrant and turning on auto-renewal, because that is where a costly mistake is easiest to make.

If you don’t know who holds your access, or the agency won’t hand it over, write to me. I will help sort out the domain, hosting and accounts, and you can also test the site right away in the free Check your website tool.