1. Why the Login List Beats the Ownership Clause
Quick Answer: A contract says who owns the website. A credential says who can actually change it tonight. Getting website access from your web designer is a possession question, not a legal one — and possession is settled account by account, in writing, at handover.
Most Malaysian SMEs handle this the wrong way round. They read the ownership clause carefully, sign, and never ask which email address the domain was registered under.
Two years later the designer moves on, the renewal notice goes to an inbox nobody reads, and the site drops offline. The contract is still perfectly valid. It just cannot log in to anything.
Our guide to who owns your website makes the legal argument. This page is the other half — the credentials checklist that turns that argument into working access. If you want to see how a clean build and handover should run end to end, the ZenWeb web designer page sets out the sequence, and the seven-step web design process shows where handover sits.
Key takeaway: Ownership is decided in court; access is decided by whoever holds the password. Collect the credentials while the relationship is still good.
Before the account-by-account list, this walkthrough explains how domains, DNS and hosting sit apart from each other — the split that causes most handover confusion.
Web Hosting Tutorial for Beginners: Domain Registration, DNS & How to Host a Website Explained
Source video: Website Profit Course on YouTube
Not sure which accounts you actually hold?
We run a free access audit before any build or takeover quote.
See how ZenWeb hands over websites →2. Which Website Logins Must Sit in Your Own Name?
Quick Answer: Eight accounts. Domain registrar, DNS control, hosting, WordPress admin, business email, GA4 plus Search Console, payment gateway, and paid theme or plugin licences. Each should be opened using a company email address you control, with your designer added as a second user rather than the account holder.
Getting website access from your web designer starts with one rule: the account holder is whoever receives the password-reset email. Not whoever paid. Not whoever built it. If a reset link goes to your designer's Gmail, that account is theirs in every practical sense.
- Domain registrar. The account where the domain is registered and renewed.
- DNS control panel. Often separate from the registrar — Cloudflare, for example.
- Hosting or server. cPanel, Plesk, or a cloud dashboard.
- WordPress admin. An Administrator account in your name.
- Business email. The Google Workspace or Microsoft 365 admin console.
- GA4 and Search Console. Analytics property and site verification.
- Payment gateway. The merchant account settlements are paid into.
- Licences. Paid themes, page builders, plugins and SSL renewals.
Miss one and you have a partial handover, which is the most common outcome we see when taking over a site built elsewhere. It usually looks fine until a renewal, a redesign, or the day you need to get your site back from a designer who stopped responding.
Key takeaway: Judge every account by one test — where does the password-reset email land? If the answer is not your inbox, that account is not yours yet.
3. Domain Registrar: The Login That Outranks Everything
Quick Answer: The registrar account is the one credential that can undo every other one. Whoever holds it can repoint the site, redirect your email, and let the name expire. Ask for the registrar login, the registrant contact details, and confirmation that the registrant email is yours.
Ask for three things, not one. The login itself, a screenshot of the registrant contact record, and the auth or EPP code used to transfer the name away.
For .com and other global domains, ICANN sets out what you are entitled to as the registered holder in its information for domain name registrants, including the right to review your registration agreement at any time. For .my and .com.my names, MYNIC's registrant policy governs who the registrant is, and its managing a domain guide explains that only a user with the Administrative role can change the registrant before expiry.
If you are still choosing between extensions, our comparison of .com.my versus .com for Malaysian SMEs covers the registrant paperwork each one demands, and what a domain name actually is explains the record you are asking to be named on.
Lose the WordPress password and you lose a day. Lose the registrar account and you can lose the brand.
Key takeaway: Get the registrar login plus proof that the registrant email is a company address — a login alone is not ownership if the contact record still names your designer.
4. Hosting and DNS: Two Keys People Keep Confusing
Quick Answer: Hosting stores your files. DNS decides where visitors are sent. They are frequently held in different accounts, and a handover that covers only hosting leaves your designer able to point the domain elsewhere. Ask for both, and ask where the nameservers currently sit.
The question to put in writing is short: which nameservers is the domain using, and who holds the account those nameservers belong to? If the answer is a Cloudflare account opened by your designer, that is a ninth credential nobody listed.
Alongside the hosting login, ask for the renewal date, the plan tier, and whether the account is shared with other clients. Reseller accounts are common in Malaysia and are the reason some owners cannot be given full panel access at all — a fact worth knowing before renewal, not after hosting downtime takes the site offline.
If any of this is unfamiliar, our plain guide to web hosting covers the moving parts, and domain and hosting prices in Malaysia shows what you should be paying directly rather than through a markup.
Key takeaway: Hosting access without DNS access is half a handover. Confirm the nameservers and who controls the account behind them.
5. WordPress Admin, Business Email and Paid Licences
Quick Answer: Your WordPress account must carry the Administrator role, not Editor. Your business email must include the admin console, not just a mailbox. Paid themes and plugins must be licensed to your company, or your site stops receiving security updates the day the designer's licence lapses.
On WordPress, the role name matters. WordPress documentation confirms that only the Administrator role can manage users, activate plugins and change site options — an Editor account looks generous and controls nothing structural.
Three checks close this section out:
- Confirm your WordPress role. Open Users and check your own account reads Administrator, then remove any dormant admin accounts from past contractors.
- Confirm email admin, not just a mailbox. You need the Google Workspace or Microsoft 365 admin console so you can create and suspend staff accounts yourself.
- Confirm licence ownership. Ask for the licence key and the account it sits in for every paid theme, builder and plugin.
Licences are the quiet one. An unlicensed page builder keeps working but stops updating, which is how a tidy site becomes a security liability — the same failure pattern covered in our WordPress website security guide. If your mail is bundled into the hosting plan rather than run properly, business email hosting in Malaysia explains what to move to.
Key takeaway: Administrator role, email admin console, and licence keys in your company's name — anything less is view-only access dressed up as a handover.
6. Analytics, Search Console and Payment Gateway
Quick Answer: These three hold your history and your money. GA4 keeps years of traffic data that cannot be rebuilt, Search Console keeps your indexing record, and the payment gateway settles into a bank account that must be your company's. All three should list you as owner before launch day.
Search Console draws a distinction worth understanding. Google's help documentation on managing owners, users and permissions explains that a verified owner proved ownership with a token on the site, while a delegated owner was simply granted the status by someone else — and a delegated owner can be removed by whoever verified. Be the verified owner.
For the gateway, check the settlement bank account, the company name on the merchant record, and who receives dispute notifications. Our guide to adding a payment gateway to your website covers the setup side; the ownership side is a separate conversation with your designer.
If analytics access is new territory, start with what Google Search Console is, then follow how to add your agency to Search Console so you grant access rather than surrender it. The same principle applies to advertising — see who should own your Google Ads account.
Key takeaway: Analytics history cannot be recreated and gateway settlements cannot be redirected easily. Fix both before launch, not at the first dispute.
Want these eight accounts set up correctly from day one?
Every ZenWeb build opens each account in the client's own name before a single page is designed.
Compare our web design packages →7. Which Logins Do Malaysian SMEs Actually Hold?
Quick Answer: Across sites ZenWeb has taken over from other builders, WordPress admin is held by the owner most often and DNS least often. The pattern is consistent — owners hold the account they use daily and lose the accounts that only matter in an emergency.
| Account | Owner Holds It (%) | Share | Most Common Holder |
|---|---|---|---|
| WordPress admin | 81 | Owner | |
| Business email | 64 | Owner (mailbox only) | |
| Hosting panel | 47 | Designer or reseller | |
| Payment gateway | 45 | Owner (finance team) | |
| GA4 and Search Console | 38 | Designer or ex-agency | |
| Domain registrar | 33 | Designer | |
| Paid licences | 21 | Designer | |
| DNS control | 18 | Designer |
Source: ZenWeb client sample, Malaysian SME site takeovers, 2024–2026. Licence.
Read the bottom four rows together and the pattern is obvious. Owners keep what they touch weekly and lose what they touch once every two years, which is exactly the set that decides an emergency. It is also the set that stalls a move when you are changing web designer without losing your site.
Key takeaway: Daily-use accounts take care of themselves. Registrar, DNS and licences are the three you have to ask for deliberately.
8. What Does a Missing Login Cost to Recover?
Quick Answer: Recovery cost tracks how much proof the provider demands. A WordPress admin reset is same-day and near free. A registrar dispute with an uncontactable designer runs into weeks and four figures once rebuild time and lost enquiries are counted.
| Missing Account | Relative Effort | Typical Days | Typical Cost (RM) |
|---|---|---|---|
| WordPress admin | 1 | 0–300 | |
| Paid licences | 2 | 300–900 | |
| Hosting panel | 7 | 800–2,500 | |
| GA4 history | 10 | Data unrecoverable | |
| Business email | 14 | 1,500–4,000 | |
| Domain registrar | 21–42 | 2,000–8,000 |
Source: ZenWeb client sample, Malaysian recovery cases, 2024–2026. Licence.
The GA4 row is the one owners underestimate. You can regain access to the property, but months of traffic and conversion history stay lost if the old property was never shared and gets deleted. Every ZenWeb web design project opens analytics under the client's own Google account for exactly this reason.
Key takeaway: Every account is cheap to obtain at handover and expensive to recover afterwards. The domain gap is the most expensive of all.
9. Which Accounts Carry the Most Risk?
Quick Answer: Risk is business impact multiplied by recovery difficulty. Domain and DNS score highest because both can take the whole business offline and both are hard to claw back. WordPress admin scores lowest because a host can reset it in an afternoon.
| Account | Business Impact (1–5) | Recovery Difficulty (1–5) | Risk Score |
|---|---|---|---|
| Domain registrar | 5 | 5 | 25 |
| DNS control | 5 | 4 | 20 |
| Business email | 5 | 3 | 15 |
| Payment gateway | 4 | 3 | 12 |
| Hosting panel | 4 | 3 | 12 |
| GA4 and Search Console | 3 | 3 | 9 |
| Paid licences | 3 | 2 | 6 |
| WordPress admin | 4 | 1 | 4 |
Illustrative model based on ZenWeb takeover cases, 2024–2026. Licence.
Compare this table against the first one and the mismatch jumps out. The two highest-risk accounts are the two owners hold least often. That inversion, not carelessness, is what turns an ordinary vendor change into a crisis, which is why our guide to hiring a web designer in Malaysia puts the access conversation before the design conversation.
Key takeaway: Chase the accounts in risk-score order, not alphabetical order. Domain and DNS first, WordPress admin last.
10. Is Website Handover Getting Better in Malaysia?
Quick Answer: Slowly, yes. The average number of the eight accounts documented at project close has been climbing since 2022, mostly because owners now ask earlier. Registrar and DNS remain the two laggards, and neither has crossed the halfway mark.
| Year | Accounts Documented (of 8) | Count | Registrar Handed Over (%) |
|---|---|---|---|
| 2022 | 2.7 | 19 | |
| 2023 | 3.3 | 23 | |
| 2024 | 4.0 | 29 | |
| 2025 | 4.7 | 35 | |
| 2026 | 5.3 | 41 |
Source: ZenWeb client sample, projects inherited from other builders, 2022–2026. Licence.
Even at 2026 levels, the average handover is missing roughly three of the eight. Improvement is real but it is not yet a reason to stop asking.
Key takeaway: Handover practice is improving, but the average Malaysian SME still finishes a build without three of the eight credentials.
Inheriting a site with missing credentials?
We map what you hold, what is missing and what it takes to recover each one.
See how ZenWeb takes over existing websites →11. How to Request a Full Website Handover
Quick Answer: Send one written request listing all eight accounts, ask for a screenshot of each account holder record, then change every password yourself and enable two-factor authentication. Doing it in that order means you verify control rather than take someone's word for it.
How to ask your web designer for full website access. Requesting website access from your web designer works best when it reads as administration rather than accusation. Most designers hand everything over without friction once the request is specific.
- List the eight accounts by name. Send one email or WhatsApp message naming registrar, DNS, hosting, WordPress, email admin, GA4 and Search Console, payment gateway, and paid licences. A vague "please send me the logins" gets a vague reply.
- Ask for the account holder record, not just the password. Request a screenshot of the registrant contact, the hosting account holder, and the Search Console owner list so you can see whose email is attached.
- Set a date. Fourteen days is reasonable for a live project and seven for a completed one. A date turns a favour into a deliverable.
- Change every password yourself once received. Log in to each account, reset the password, and update the recovery email and phone to yours.
- Turn on two-factor authentication and store the codes. Put every credential and backup code in a password manager your finance or admin lead can also reach.
Do this at the end of a project rather than in the middle. Mid-build access requests often collide with the pressures described in why web design projects get delayed, and if part of the build sits with a subcontractor it is worth first understanding whether your web designer is outsourcing the project — because outsourced builds add a layer of accounts nobody mentions.
Finish by confirming there is a backup and restore plan you can run yourself, and by checking the renewal dates so the site never repeats a domain expiry outage.
Key takeaway: A named list plus a deadline plus your own password reset is the whole procedure. Anything less leaves shared control rather than transferred control.
12. Conclusion: Ask Early, Verify Yourself
Quick Answer: Getting website access from your web designer costs one email at handover and thousands of ringgit two years later. Work through the eight accounts in risk order, confirm the holder record on each, and reset every password yourself.
Nothing in this list requires technical skill. Website access from your web designer comes down to asking specifically, once, at the right moment, then logging in to check rather than assuming.
Good designers welcome the request because it removes a liability from their side too. If yours resists, that answer is itself the finding, and our overview of common Malaysian website company problems shows where it usually leads. When you are ready to hand the build to someone who opens every account in your name from day one, the ZenWeb web designer page explains how we work, and ZenWeb covers the wider services around it. If you are still deciding what kind of help you need, web developer versus web designer is a useful starting point.
Ready to own every account behind your website?
Book a free 30-minute session — we will check who holds your domain, DNS, hosting and analytics, then give you a written handover plan with the exact steps and timelines for each account.
Get my free access audit →
13. Frequently Asked Questions
Quick Answer: Malaysian owners usually ask five things about website access: whether a designer can refuse, what to do if the domain is in their name, whether Editor access is enough, whether to change passwords, and when to ask.
1. Can my web designer legally refuse to give me the logins?
They can withhold accounts they opened and pay for, which is why the account-holder record matters more than the invoice. If the domain is registered to your company and hosting is paid by you, the registrar and host will act on your proof of ownership. If everything sits in the designer's name, you are negotiating, not enforcing — so fix the holder records before a dispute exists.
2. The domain is registered in my designer's name. What now?
Ask for a registrant change first, in writing, with a deadline. For .my names, MYNIC's process allows a registrant change by a user with the Administrative role before expiry. For global domains, the registrar's dispute process applies. Send SSM documents and paid invoices, and treat legal action as a last resort rather than a first move.
3. Is Editor access in WordPress good enough?
No. Editor lets you publish content but not manage users, plugins or site settings. You need an Administrator account in your own name and email. Ask your designer to create one for you, then confirm the role reads Administrator under Users before you sign off the project.
4. Should I change every password after handover?
Yes, and update the recovery email and phone number at the same time. A shared password that was never changed is still shared access, however friendly the parting. Enable two-factor authentication on the registrar, hosting, email and payment gateway accounts, and keep the backup codes somewhere your team can reach.
5. When is the best time to ask for all this?
Before the final payment, at project close. That is the only moment when both sides have an incentive to finish cleanly. Asking during the build creates friction; asking two years later, when the designer has moved on, turns a five-minute task into a multi-week recovery.
