Red flags that your current agency is holding your website hostage
Lock-in is accidental until you try to leave. Twelve signs that your website, domain or data is more theirs than yours, and the fix for each.
The short answer
A website is held hostage when the business cannot leave its supplier without losing the domain, the site, the data or the rankings. Almost nobody plans it. It accumulates from convenience: the agency registered the domain to help, hosted on their plan to get a better rate, kept the code where their tools were. Years later, the business discovers whose name is on everything on the day it wants to change something.
The signs are visible long before that day. Here are twelve, with the fix for each.
The twelve flags
| Flag | What it usually means | Fix |
|---|---|---|
| 1. You cannot log in to the domain registrar | The domain is in their name or their account | Transfer to a registrar account in your company’s name, now |
| 2. Hosting appears on their invoice as one line, and they will not say what happens to it if you leave | The problem is not who holds the account but whether you can get it | Ask in writing: which layers move to your name on request, and how long each takes |
| 3. You have never seen the code repository | It is under their organisation, or does not exist | Repository under your organisation, with them as collaborator |
| 4. Analytics is “their account” | You cannot see or export your own visitor data | Property owned by you; they get access |
| 5. Nobody can tell you where DNS is managed | It is wherever it was set up years ago | One provider, your account, exported records |
| 6. “That is a proprietary component” | The site depends on something only they can provide | Ask for a perpetual licence in writing, or replace it |
| 7. Changes must go through them, always | You have no admin access to your own site | Admin access in your name, documented |
| 8. Ownership questions get vague answers | The answer is not the one you want | Ask in writing, with a deadline |
| 9. No documentation exists | Knowledge is in their heads | Ask for a one-page “who owns what” and a technical handover document |
| 10. Cancelling means “we will need to discuss the site” | Leaving costs the site | Settle ownership before any cancellation conversation |
| 11. Backups are “handled” | You cannot restore without them | Your own backup copy, outside their systems |
| 12. Form data and customer records live in their tools | Your business records are in accounts you cannot access | Export, then move to services in your name |
The order to fix them
- The domain. Flag 1. Losing it takes everything offline. Transfer first, while goodwill exists.
- DNS and hosting. Flags 2 and 5. Accounts in your name; the agency invited in.
- Code and documentation. Flags 3, 6 and 9. Repository, licences, a handover document.
- Data. Flags 4, 11 and 12. Analytics, backups, form data and records in your name.
- Access and process. Flags 7 and 8. Admin access for you; answers in writing.
- Then, and only then, any conversation about the relationship. Flag 10, from a position where you own your assets.
What this means for you
Go through the twelve flags this week. Each one you recognise is a fix that is cheap now and expensive later. Start with the domain, work down the list, and keep the relationship conversation for after. Whether you stay with the agency or not, the outcome should be the same: a website, domain and data that are unambiguously yours.
Frequently asked questions
Our agency has always been helpful. Is this really a risk?
Helpful agencies are exactly how it happens. Nobody plans a hostage situation; it is the result of convenience accumulating for years. The question is not whether they are nice. It is what happens if they are acquired, close, lose the account manager, or disagree with you about an invoice. Ownership in your name protects both sides from that day.
What if they refuse to transfer the domain?
A registered domain has a registrant, and if that is your company you have rights to it through the registrar. If the agency registered it in their own name it is harder, and the first question is which extension. A .nl domain falls under SIDN's dispute regulations, which cover trade names as well as trade marks and start with thirty days of free mediation; .com and other gTLDs fall under the UDRP, which needs a trade mark right. The registrar decides none of this. Start with a written request and a deadline, because it is far cheaper than either route.
Do we have to leave the agency to fix this?
No. Most of the flags are fixed by moving accounts into your name and giving the agency access as a collaborator, which a good agency will do without complaint. If they resist, you have learned something important, and you can decide what to do with it from a position where you own your assets.
Sources
- ICANN: Registrar Transfer Dispute Resolution Policy (accessed 2026-09-14)
- ICANN: Uniform Domain Name Dispute Resolution Policy (accessed 2026-09-14)
- WIPO: Dispute Resolution Regulations for .nl Domain Names (accessed 2026-09-14)