The Short Answer
You only truly own your website if you control all four of these, in your own accounts:
- The source code — the actual files your site is built from, transferred to you in writing.
- The domain — registered in your name and email, never the developer's.
- The hosting — your own account, so you can take the live site anywhere.
- The CMS — where you edit content, with you as the administrator who can remove anyone.
If a developer controls even one of these, they can hold the others hostage. The fix is to ask one direct question before you hire anyone, and to get the answer in writing.
Here is the question almost nobody asks before paying for a website: if you and your developer parted ways tomorrow, could you take your site and walk? For a lot of business owners, the honest answer is no, and they only find out at the worst possible moment.
This is not a rare horror story. It happens every day, usually to the most trusting owners. The reason is a gap between what feels true (I paid for it, so it is mine) and what is legally true (by default, the person who created it owns it). Let us close that gap, because the fix is simple once you know what to look for.
About PandaCodeGen
PandaCodeGen builds custom Next.js websites that you own completely from day one. Your domain, hosting, and services sit in your own accounts. You get the full code. We are the agency you can fire without losing anything, which is exactly why our clients never have to. Fixed pricing from $1,500. 90+ PageSpeed in writing or a full refund.
The Uncomfortable Default: You Probably Do Not Own It
Under copyright law, the moment someone writes code, design, or content, they own it. Paying an invoice does not automatically transfer that ownership to you. Unless your contract specifically says the source code, design files, and assets become yours, the developer or agency that built your site legally owns them. That is the default, and most small business contracts are silent on it.
What does that mean in practice? If you try to leave, you may discover the agency owns the website, not you. Your site can be taken offline. You can lose access to your files. Or the agency can simply refuse and hold everything until you pay to get it back. None of that requires bad intentions on day one. It only requires a contract that never spelled ownership out.
Ownership Is Four Things, Not One
The biggest mistake is thinking of "my website" as a single object you either have or do not have. It is four separate things, each held in a different place, and you can be locked out of any one of them while holding the rest.
1. The source code
The actual files your site runs on. If you do not have these, a beautiful site can still leave you with nothing the day you switch developers, because you would have to rebuild from scratch. You want the full code, transferred to you in writing.
2. The domain name
Your web address. It is easier for a developer to add your domain to their own account than to set you up properly, and if it lives in their account, they control it. Register it in your own name and email. This is the single most common hostage point.
3. The hosting
Where the live site actually runs. If hosting sits on the agency's proprietary platform and you are only renting a spot, you cannot take your working site with you when you leave. Your own hosting account means you can move anytime.
4. The CMS (how you edit content)
Some builders lock you into paying them for every word change, or build on a proprietary system so you can take the content but not the site. You want to be the administrator of an open system, able to edit freely and remove anyone, including the agency.
What It Looks Like When You Do Not Own It
These are not hypotheticals. They are the patterns that show up again and again when owners go looking for help reclaiming a site.
"A successful business owner discovered she did not own her own domain. When she asked her former developer to transfer it back, he demanded a 5,000 dollar "ransom" to release it.
Documented case, web developer hostage situations · Verify source →
- ✓The domain trap: the developer registered your company domain under their own account, so they control it permanently. Getting it back can mean negotiating, paying, or hiring a lawyer.
- ✓The hosting trap: you are the only one without your hosting login, so you cannot update or move your own website without going through the developer.
- ✓The code trap: you have a live site you love, but no source files, so leaving means rebuilding the whole thing from zero.
- ✓The CMS trap: the site is built on a proprietary platform, so you can export your text but not the actual working website.
How PandaCodeGen Hands Over All Four
We built our handover process to be the opposite of every story above. The simplest way to say it: we are an agency you could fire at any moment without losing a thing. Here is exactly what that means for each of the four parts.
The code is yours. You get the full source code and you own it completely. You can take it anywhere. We also keep a private backup, not to hold anything over you, but so that if you ever delete your files or lose access, even years after we have stopped working together, you can ask and we will hand it right back. The backup is insurance for you, never leverage against you.
The domain is yours from day one. We always encourage owners to register the domain on their own account and email, or we help set one up in your name for exactly this purpose. You hold it. We just get access to manage it, access you can revoke whenever you want.
The hosting and services live in your accounts. Vercel for hosting, plus services like Sanity, Resend, and Supabase, set up under your own logins. Almost every business already has an email like info@yourbusiness.com that they own, and we set everything up on that, so the accounts are tied to your company, not to us. With one client we ran their email service through their own info@ address from day one, so they owned it immediately. The upside for you is privacy and control: your billing, your data, and your company details stay on your side. We get access to manage things, access you can revoke anytime, and nothing sensitive is locked inside our accounts. We can host on our account during the build if it is easier, then transfer everything to you whenever you ask, no friction.
You are the CMS administrator. We build on Sanity and make you the administrator, so you can remove us at any point. Sanity setup is a little technical, so we handle it, then hand you the keys. Edit your own content freely. Small in-house tweaks like a logo color change are handled free of charge. You are never charged to fix a typo.
On top of the four, two more things protect you. Everything is defined in a signed scope of work before any payment changes hands, so you know exactly what we are committing to deliver, and you have it in writing. And we sit down with whoever else is on your side, your marketing, finance, or operations people, so the result fits the business you actually run, not just the brief on paper.
"The test of a good web partner is not whether you would ever leave. It is whether you could. If the answer is yes, you never have to.
The One Question to Ask Before You Hire Anyone
You do not need to become a technical expert to protect yourself. You need one direct question, and you need the answer in writing:
"Will all source code, design files, the domain, and hosting credentials be in my own accounts and transferred to me on final payment, and will you put that in the contract?"A trustworthy builder answers yes without hesitation and happily writes it into the scope of work. If the answer is vague, or if they want the domain or hosting under their account "to make it easier," treat that as the warning sign it is. The whole point of ownership is that it survives the relationship ending. Get it in writing while everyone is still happy.
If you want to see how this looks in practice, our Panda Patches case study is a store we migrated off WordPress to a custom build the client fully owns, our Pricing & Guarantees reference lays out the fixed scope and refund mechanics, and the honest cost of a cheap web developer covers what corners usually get cut at the bottom of the market, ownership being one of the first.
Want a website you actually own?
Code, domain, hosting, and CMS in your accounts. In writing, before you pay anything. Tell me your platform and rough page count and I will give you a real fixed number.
The agency you could fire without losing anything.
That is the standard PandaCodeGen builds to. You own the code, the domain, the hosting, and the CMS, all in your name, all in writing. Drop your current site and what you want built and I will reply personally.