Hostage Hosting: When Your Web Designer Owns Your Domain

There is a business model in the web world that nobody advertises, but I ran into it so often that I gave it a name. I call it hostage hosting. The provider does not make its money by building good sites or by giving good service. It makes its money by holding something the client needs and charging them to keep it.

How it works

It usually starts innocently. A small business hires someone to build a website. To save the client the bother, the builder registers the domain, sets up the hosting and takes care of everything. The client is grateful. Everything is in the builder’s account, because that was easier at the time.

Years pass. The monthly bill keeps coming, sometimes growing. It now includes “maintenance”, “security monitoring”, “SEO package” or “premium support”. Nobody remembers asking for them, and nobody can say exactly what they do. When the client asks to stop paying for some of it, the answer is that the services come together. When the client asks to leave, things get slow and complicated.

None of this requires bad intentions at the start. It requires only that the client does not own the pieces, and that someone eventually notices that a client who cannot leave is a client who will pay.

The signs

If you are not sure whether this describes your situation, these are the questions I would ask:

• Can you log in to your domain registrar? Not the provider’s dashboard, the registrar itself, where the domain is registered.
• Is the domain registered in your name? Not your provider’s company name, yours or your business’s.
• Can you log in to the hosting account? Do you know which company hosts the site and do you have your own access?
• Do you have a full administrator account on the site?
• Can you name every service on your invoice and what it does?

If the answer to several of these is no, someone else holds your site.

Why the domain matters most

Of all the pieces, the domain is the one that matters most, because it is your address. Email, search rankings, links from other sites and every printed card point to it.

ICANN, the organisation that coordinates domain names, is clear that the registrant, the person or organisation listed as the holder, is the one who controls the domain. Its guidance for domain holders puts it plainly: “It is your right to transfer your domain name registration between registrars.” That protection is only useful to you if you are the registrant. If your provider registered the domain in their own name, the rules protect them, not you, and you need their cooperation to get it back.

Services nobody wants

The second half of the pattern is what is sold once the client is held. I have seen invoices with “SEO services” for sites that had not changed in two years, “security packages” on sites running outdated plugins with known problems, and “priority support” for clients who could not get an email answered.

The test I apply is simple. A service worth paying for can be described in one sentence that the client understands, and its result can be seen. If neither is true, it is probably there because it can be charged, not because it helps.

Getting your site back

If you recognise your situation, here is the order I usually follow with clients:

1. Ask for the domain to be moved into an account in your name. That can be a transfer to a registrar you choose, or a change of registrant at the current registrar, followed by a transfer. Be aware that, under ICANN’s rules, changing the registrant name can lock the domain against transfers to another registrar for 60 days, although some registrars let you opt out.
2. Ask for a complete backup. For a WordPress site that means all the files and an export of the database, not a PDF of the pages.
3. Ask for full administrator access to the site and to the hosting, if you are staying there for now.
4. Move the hosting to an account in your name once you have the backup.
5. Cancel the services you do not need once nothing depends on the old provider.

Most providers cooperate, especially when asked politely and in writing. A few drag their feet. In my experience, the request for the domain is the one to make first and to follow up on, because everything else is easier once your address is yours.

How I avoid becoming one

It would be easy for any web builder to slide into this, and I include myself. Holding the client’s accounts is convenient, and recurring income is pleasant. That is exactly why I made ownership a rule rather than a preference. Everything I build or certify starts with the domain and the hosting in the client’s name, and with the client holding a full administrator account. If they want to leave, they can, and that is the point.

It is also the first standard of the Web Architect Certified programme: a builder who leaves a client tied to them loses the certification.