A hotel near Malpe decided to change the person who looked after its website. Nothing dramatic had happened. The original developer had moved to Bengaluru, replies had slowed from hours to weeks, and the owner wanted somebody closer who would pick up the phone.
He expected it to be a simple handover. It was not. The domain name was registered in the developer's own name, with the developer's email on it. The hosting was an account the developer had opened and paid for. The Google listing, the one with four years of reviews on it, had the developer as its owner, and the hotel as a manager.
None of this was done maliciously. It was done in 2019, at a time when the hotel had no email address to register anything with, and the developer did what was quickest. Nobody wrote anything down. Six years later it meant that the business did not control its own name, its own website or its own reviews.
This article is a check you can do yourself in about ten minutes, and what to do about whatever you find.
The six things, in order of how badly it hurts
The domain name. This is the serious one. Everything else can be rebuilt. Your domain is your address, your email, and every link anyone has ever made to you. Lose it and you lose all three at once.
The hosting account. Where the website files and often the email actually sit. Less serious than the domain, because a site can be moved, but awkward if you cannot get a copy of the files.
The Google Business Profile. The listing with your map pin, your photos, your opening hours and your reviews. For a hotel, a clinic or a restaurant this is frequently worth more than the website.
Search Console and Analytics. Your visitor history. Losing access does not break anything today, but it erases what you know about your own customers.
The WhatsApp Business number. If enquiries come to a number that belongs to somebody else's phone or somebody else's Meta account, your customer conversations are not yours.
The website code and the content. The photographs, the text, the design. Worth having, and the one where the legal position is least likely to be in your favour.
The ten-minute check
Do this now, before you read any further. You only need a browser.
1. Look up your domain. Search for a WHOIS or RDAP lookup and enter your domain name. You are looking for the registrant organisation and the registrant email. If it shows your business name, good. If it shows a person who does not work for you, that is your answer. If it shows a privacy service, which is common and not sinister, move to the next check instead.
2. Find out who gets the renewal reminder. This one cuts through privacy screening. Domains send renewal notices roughly a month before expiry. If those emails have never arrived at any address you control, you are not the contact on the record, whatever the public listing says. Ask your developer to forward you the last one.
3. Open your Google Business Profile and look at the people. Search for your business name while signed in to the Google account you use. If you can edit the listing, find the users or managers section. Every profile has exactly one primary owner. Check whether it is you.
4. Check Search Console. If you have never seen it, that is itself the result. If you have, look at the list of verified owners.
5. Check the hosting account email. Whose address is on the account, and whose card renews it?
6. Check whose phone the enquiries land on. If customers message a WhatsApp number shown on your website, find out which SIM that number belongs to and who pays the bill. A business that advertises a number registered to a former employee or an agency is renting its own customer relationships. The same question applies to any Facebook or Instagram page carrying your name: open the page settings and look at who is listed with full control.
Most businesses doing this for the first time find two or three of the six sitting with somebody else. That is normal, and in the great majority of cases it is a leftover from a day when it was simply the fastest way to get the site live.
Why the domain is the one that matters
Here is the sequence that does real damage, and it does not require anybody to act in bad faith.
The renewal notice goes to an address nobody checks any more, perhaps because the developer changed jobs or the mailbox filled up. The domain expires. Your website goes dark and, if your email runs on the same domain, every address at your business stops working the same morning. Enquiries do not bounce in a way anybody notices. They simply stop.
After the expiry there is a grace period in which you can usually still recover it, often at a penalty. After that the name is released, and anybody may take it. Short, obvious names that have been online for years are exactly the ones that get taken.
The hotel in Malpe did not reach this point. But it was one forgotten mailbox away from it, for six years, and had no idea.
Getting them back
Start by assuming goodwill, because you will usually be right. Most developers hand these over the same week they are asked. Many have been meaning to for years.
Send a plain message. You are tidying up your records and you would like the domain, the hosting and the Google listing moved into the business's own accounts. Make a business email address first, something at your own domain or a free one in the business name, so there is somewhere obvious for everything to go.
The domain
Moving a domain to your own registrar account needs two things from whoever holds it: the domain unlocked, and an authorisation code, sometimes called an EPP code or auth code. With those, the transfer is a form you fill in at the registrar of your choice.
Two things to expect. Transfers are generally blocked for sixty days after a domain is first registered, after a previous transfer, and after the registered owner is changed. And the approval email goes to the address on the record, which may still be the developer's, so this normally needs their cooperation even when they are willing.
The Google Business Profile
If you have a manager role, ask the primary owner to transfer ownership to you. It takes them under a minute.
If nobody will respond, Google has a request ownership process. You ask through the listing, and the current owner is given a short window to reply, which Google's help page currently puts at three days. Check that page for the current figure before you rely on it, as this process changes. If the request is ignored or refused, there is an appeal route with proof that the business is yours. Keep whatever you have that ties the business to you, such as registration documents, a utility bill at the address, or the lease.
This one takes the longest and is worth starting first.
Hosting, and the files
Hosting is usually the easiest, because you do not have to win it. You can simply move. Ask for a copy of the website files and the database, open your own account somewhere, and have the site put up there. Ask for a copy even if you plan to redesign, because your photographs and your text are inside it.
If the software side of this is also stuck, we have written separately about getting your data out when a vendor has stopped replying, which covers the same problem for billing and accounting systems.
If somebody simply refuses
This is rare, and it is usually about an unpaid invoice rather than the domain itself. Settle the bill if it is genuinely owed. A disputed invoice and a held domain are two separate arguments, and you want them separated.
If the name is your registered business name or a trademark you hold, and somebody is holding it against you, there is a formal dispute process. For .in domains that is INDRP, run through NIXI. For .com and similar it is UDRP. Both cost money and take time, which is exactly why the ten-minute check above is worth doing while everybody is still on good terms.
What to put in writing next time
You do not need a contract drafted by a lawyer. You need six lines in the email where you accept a quotation. Copy these:
- The domain will be registered in the business's name, using the business's email address.
- The hosting account will be opened in the business's name, and we will hold the login.
- The business will be primary owner of the Google Business Profile. You will be added as a manager.
- The business will be a verified owner in Search Console and an administrator in Analytics.
- On request, you will provide a copy of the website files, the database and the source content within seven days.
- On the final payment, the design and content produced for us become ours to use and to modify.
Any developer worth working with will agree to all six without a pause, because none of them cost anything and all of them are normal. If somebody argues about them, you have learned something useful for roughly the price of the email.
That last line matters more than it looks. Without it, the default position on copyright usually leaves the design with whoever made it, which means a future developer cannot safely change your own website.
Do the check anyway
Nothing here assumes your developer is dishonest. The hotel's developer was not. He was busy, he had moved away, and in 2019 he did the fastest thing available to a client who had no email address.
But a business that does not hold its own domain is relying on somebody else's filing habits and somebody else's inbox staying in use. That is a thin thing to rest your email, your website and four years of reviews on.
Ten minutes. Six checks. If they all come back in your name, you have lost ten minutes and gained a thing worth knowing.
If they do not, and you would like help getting them back or moving somewhere you control, we do this for businesses around Udupi, Mangaluru and the towns between, including moving sites and email to hosting you own and recovering a Google listing. You can talk to us here.
