Website Design and Hosting: Who Should Own What?
Understand website design and hosting, account ownership, renewals, backups, security, support, and the handoff if you change providers.
The question
Should a small business let its web designer host its website?
Short answer: It can, if managed hosting is convenient and the agreement is clear. The business should remain the domain registrant, know which accounts and services run the site, have appropriate administrative access, understand renewals and backups, and receive a workable transfer path if the relationship ends.
The business should control its domain, billing and recovery access, while a web designer may manage hosting when responsibilities, backups, support, and handoff terms are explicit. Website design creates the pages, content, interactions, and technical setup; hosting is the infrastructure that serves those pages to visitors.
SimpleLaunch can build and manage the website while keeping domain ownership, account access, renewal responsibilities, backups, and handoff terms explicit.
Any of those arrangements can work. The important question is not whether the designer pays the hosting bill. It is whether the business understands who controls the domain, hosting project, DNS, content, analytics, third-party services, backups, and transfer process. Convenience is useful; invisible dependency is not.
Should your web designer host your website?
Yes, a web designer or agency can manage hosting when that responsibility is defined. Managed hosting may spare a small team from deployment settings, certificates, monitoring, platform support, and routine infrastructure work. It can also give the person maintaining the site direct access when something breaks.
The arrangement becomes risky when “hosting included” is the only explanation. Before launch, the business should know:
- Which company actually provides the infrastructure.
- Whether the hosting account or project is owned by the business or the provider.
- Which services are included beyond basic hosting.
- Who receives renewal, outage, security, and billing notices.
- What access the business receives during the engagement.
- What can be exported or transferred if the agreement ends.
- How long a transfer normally takes and whether a fee applies.
The business should remain the registrant of its domain name. ICANN explains that the registrant enters the registration agreement and manages the domain through the registrar. A designer can be granted technical access without being listed as the owner of the business's address on the web.
What are the separate pieces behind a business website?
A business website depends on separate domain-registration, DNS, hosting, content, analytics, and lead-handling accounts. Separating those accounts on paper makes ownership and support easier to understand.
- Domain registration: Controls the right to use the domain name and renew or transfer it. The business should be the registrant and keep current contact information.
- DNS: Connects the domain to the website, email, verification records, and other services. Incorrect DNS changes can interrupt more than the website.
- Hosting project: Stores or builds the site and serves it to visitors. Access may belong to the business, the provider, or both, depending on the platform and contract.
- Source, content, and media: Includes code, page copy, uploaded images, and other materials. Ownership, licenses, and export formats should be written down.
- Analytics and search accounts: Includes Google Analytics, Search Console, tag management, and related measurement. These should use business-controlled accounts with role-based access for vendors.
- Forms, calendars, email, and other applications: These services may collect inquiries or keep customer information. The business should know where the data goes and who can access it.
Do not use one shared password for all of these systems. Use named users where the platform allows it, grant only the access each person needs, and remove access when responsibilities change.
When does bundled website design and hosting make sense?
Bundled hosting makes sense when the business wants one accountable provider and the service removes real operational work. The provider may handle deployment, certificates, platform configuration, uptime monitoring, backups, and technical support while the business focuses on content and inquiries.
A good managed arrangement has clear boundaries. It states what is monitored, what counts as a support request, how quickly urgent issues are handled, how content changes are billed, and which third-party charges are passed through. It also explains whether maintenance covers only hosting infrastructure or includes the website application itself.
Bundling is especially practical when the website uses a platform that is difficult to separate from its hosting. The tradeoff is platform dependency. Before accepting it, ask what remains usable if the subscription ends and whether the content, media, redirects, and domain settings can move elsewhere.
When is client-owned hosting the better fit?
Client-owned hosting is usually the cleaner fit when the business has internal technical staff, several vendors, formal procurement requirements, or a website that must outlast any one agency relationship. The business opens the hosting account, controls billing and recovery, and invites the designer with the required role.
A client-controlled account structure does not mean the owner must operate the infrastructure personally. A provider can still manage the site inside a client-controlled account. Client control reduces the chance that an expired relationship, unavailable freelancer, or billing dispute also removes access to a critical business asset.
Direct ownership is not automatically possible on every platform. Some managed systems keep the hosting project inside a provider account or do not export a complete working site. If that is the chosen model, the limitation should be accepted deliberately and the exit plan should state what the business will receive.
What should a web design and hosting agreement state?
The written scope should make the operating model understandable to someone who did not build the site. At minimum, confirm:
- The hosting provider, platform, plan, and billing owner.
- What the initial design fee and recurring charge each include.
- Domain registrant, registrar, renewal contact, and recovery method.
- DNS ownership and who may approve a change.
- Administrative access for the website, hosting, analytics, and connected services.
- What is backed up, how often, how long copies are retained, and whether restoration is tested.
- Responsibility for platform, plugin, dependency, and security updates.
- Monitoring, incident communication, and support response expectations.
- Ownership or licensing of code, copy, photography, fonts, themes, and paid applications.
- Export formats, transfer assistance, notice periods, and any offboarding fee.
- What happens to the website and data after cancellation.
Avoid vague promises such as “unlimited hosting” or “full maintenance” without definitions. A modest static marketing site and a database-backed application do not need the same infrastructure or maintenance. The agreement should match the actual website.
Which security and backup controls matter most?
Start with account security. CISA recommends multifactor authentication for business accounts and prioritizing administrative access. Turn it on for the registrar, DNS, hosting, email, analytics, and any application that receives leads. Store recovery codes securely and make sure the business has more than one current recovery contact where appropriate.
Backups need a purpose and a restore path. The NIST National Cybersecurity Center of Excellence advises managed service providers to conduct, maintain, and test backup files so operations can resume after data loss. Ask whether the backup includes only files, or also databases, configuration, redirects, environment settings, and uploaded media.
A backup controlled by the same compromised account may not be enough. For a site whose content changes regularly, keep a retrievable copy outside the live project or confirm that the provider's retention and recovery controls meet the business need. Then test a restore before an emergency makes the answer expensive.
Can you change hosting without losing search visibility?
Changing hosts does not require changing the public URLs. Google treats this as an infrastructure move and recommends preparing and testing the new host, updating DNS, monitoring old and new traffic, and keeping the old infrastructure running until traffic has moved.
If the hosting change is part of a rebuild, use the website redesign checklist to preserve search, lead, measurement, accessibility, and account requirements alongside the infrastructure move.
For an established website, the handoff should preserve:
- The same domain and page URLs whenever possible.
- Page content, metadata, canonical tags, structured data, and redirects.
- Search Console verification and analytics tags.
- Forms, downloads, images, and booking routes.
- Crawl access after temporary staging restrictions are removed.
- A current sitemap and working error pages.
Test the copy on a temporary hostname before changing DNS. After launch, open the important pages in a browser, submit the forms, check multiple DNS locations, and monitor Search Console and server responses. Do not shut down the old host merely because the new homepage loads once.
What should the business receive at handoff?
A handoff should leave the next qualified person able to operate the site. The exact package depends on the stack, but it may include account invitations, source files or repository access, content and media exports, DNS documentation, environment-variable inventory without exposed secrets, analytics ownership, renewal dates, deployment instructions, and a list of third-party services.
Credentials should move through a secure password manager or account invitation, not a document attached to email. Rotate shared secrets that a departing provider no longer needs. Confirm that contact forms, booking links, and notifications still reach business-controlled destinations after access changes.
If the platform cannot provide a portable site, the handoff should say so plainly. The business can then keep the subscription, rebuild elsewhere, or choose a more portable option before the limitation becomes urgent.
Website design and hosting checklist
Before signing or renewing, confirm:
- The business is the domain registrant and can access the registrar.
- Hosting, DNS, analytics, and application ownership are documented.
- Recurring costs and renewal dates are visible.
- MFA, named users, and recovery contacts are configured.
- Backup scope, retention, and restoration have been checked.
- Support and maintenance have specific boundaries.
- The website's code, content, media, licenses, and export rights are understood.
- Search verification, redirects, and measurement will survive a hosting change.
- Offboarding produces a usable handoff within a defined process.
The best model is the one that combines practical support with durable business control. A designer can manage hosting without owning the relationship forever, and a client-owned account can still be professionally managed.
SimpleLaunch builds and launches service-business websites with the hosting, search, testing, and handoff responsibilities made explicit. Review the related guide to choosing an AI builder or professional designer, see what happens in a website design consultation, or book a 20-minute website review.