How to Fire Your Web Design Agency Without Losing Your Site
TL;DR Before firing your web design agency, secure control of your domain, hosting, email, data and source-code repository. Move and test the website before ending the relationship so your business stays online and under your control.
I have been noticing a pattern with Website as a Service companies. Clients are happy to join because the offer sounds simple. They get a website, hosting, maintenance and support for one monthly payment. Then the website launches and some of them discover that they are mostly on their own. The monthly invoice continues, but the relationship they thought they were paying for slowly disappears.
The problem is not the Website as a Service model itself. Tomicz also provides websites as a managed monthly service. I believe it can be a better arrangement than paying a large amount upfront and hoping the agency will still answer six months later. But a recurring payment should create a recurring responsibility. If the client has to chase the agency for every answer, wait weeks for a small change or wonder who controls the website, the service is no longer working as promised.
I previously wrote about an acquaintance who was paying for a website and marketing without getting results. He calls agencies "programmers," and by the time we spoke, he was not disappointed with only one of them. He was convinced they were all the same and had become desperate. He now wants to leave his current programmer, but he feels like a hostage because he does not know what will happen to his website if he does.
His fear is legitimate. A programmer he worked with in the past became angry and deleted everything he had. This is the same basic reason large technology companies remove system access before announcing layoffs. When a business relationship ends, access becomes a risk. This article will explain what to ask your agency about ownership, how to move if you do not control the hosting or website, and how to choose a new agency that will help you leave without putting your business at risk.
When should you fire your web design agency?
One late reply or one missed deadline is not enough reason to fire an agency. The clearest warning sign is a pattern of dodgy behavior combined with a complete lack of transparency. You are paying someone every month, but you have no idea what they are doing, what has been completed or what will happen next.
That is where my acquaintance is now. His programmer avoids meetings and gives excuses that do not make sense. He might say that he is on another call, then remain unavailable for several hours. Being busy is normal, but repeatedly avoiding a client with excuses that do not add up is different. The client eventually stops believing anything the agency says.
The work itself gave him more reasons to worry. His paid advertising was producing a net loss. The website had no SEO work, and even the privacy policy was missing. He did not know about any of these problems until he reached out to me. That is what makes the lack of transparency particularly damaging. A business owner cannot question work they do not know is missing.
He has not fired the programmer yet. The website is still running on the programmer's private hosting, so ending the relationship feels dangerous. He is dissatisfied with the service but also dependent on the person providing it. At that point, the relationship is no longer held together by trust. It is held together by fear of what might happen if the client leaves.
Firing an agency can still be unfair or premature. If a client requests a major feature that was never discussed before the project began, the agency has the right to quote it separately or refuse it. A feature that makes the original agreement unprofitable is not automatically included because the client already paid for a website. The time to leave is when the agency avoids reasonable communication, hides what it is doing and repeatedly fails to deliver what was actually agreed.
Who owns your website, domain and hosting?
My acquaintance believes he owns everything because he paid for the website. In practice, the custom PHP code is running inside the programmer's private shared hosting account. The programmer also hosts his own agency website on the same account, so my acquaintance cannot simply receive the hosting login without gaining access to someone else's website.
Getting control of the website therefore requires more than asking for a password. An experienced developer has to remove the website code and database from the shared account, identify its configuration and dependencies, move everything to new hosting, and test that it still works. That takes experience, time and a separate budget. Even if the programmer cooperates, the business owner is already paying for a problem that should have been addressed in the original agreement.
This is the difference between believing you own a website and being able to take it with you. Ownership should cover the domain, website code, content, customer data and business email. Hosting is usually rented rather than owned, but the client should either control the hosting account or have a clear contractual right to move the website elsewhere.
The source-code repository is part of that ownership. It should not remain only inside the agency's GitHub, GitLab, Bitbucket or another version-control account. The repository should be transferred to an account or organization controlled by the client, including its commit history, branches, release tags and deployment configuration. A downloaded ZIP file provides the current code, but it does not provide the complete development history or the same control over future access.
The correct ownership arrangement depends on what the client purchased. If an agency builds a website for a fixed price and the client pays the agreed amount, the completed website should belong to the client. Any exceptions, such as licensed software, stock assets, commercial fonts or proprietary agency tools, should be disclosed before the contract is signed.
Website as a Service works differently because the initial development is recovered through recurring payments. With Tomicz, the first six months allow the development to pay for itself. After six completed payments, the client owns the client-specific website. The domain, business data and supplied content belong to the client from the beginning, while the contract explains what happens to hosting, email and the proprietary Tomicz CMS if the subscription ends.
The contract matters because paying an invoice does not automatically answer every ownership question. Under US copyright law, transferring a copy of a work does not automatically transfer the copyright contained in it. Copyright transfers generally need to be made in writing and signed by the owner of those rights. The US Copyright Office explains these ownership and transfer rules, although businesses should obtain legal advice for their specific contracts.
I would be concerned by contract language saying that the agency retains all rights indefinitely, that the client receives only a temporary license, or that the website disappears as soon as the subscription ends. The same applies when the agency registers the domain in its own name, excludes the source code from the handover, provides no customer-data export, or leaves transfer fees and timelines undefined.
The contract should state what the client owns, when ownership transfers, what remains licensed, and exactly what will be provided when the relationship ends. If those answers are missing, the client may be buying access to a website rather than buying the website itself.
What access do you need before firing your agency?
If I took over my acquaintance's website tomorrow, I would first confirm that he controls every login required to operate it. I would also check whether the previous programmer still has an administrator account, hosting login, FTP user, SSH key or another way back into the website. Backdoor access is real, and changing one visible password does not necessarily remove every path the previous agency used.
The domain registrar and hosting account are the two most important starting points. Control of the domain allows you to decide where the website and business email point. Control of the hosting allows you to access the website files, database, backups and server configuration. Losing either can turn a normal agency change into a recovery project.
Those two accounts do not always provide access to everything else. Business email may be managed through Google Workspace or Microsoft 365. Analytics, advertising accounts, Google Business Profile, payment services, source-code repositories and content management systems may each have separate owners and administrators. The client should receive an inventory of every service connected to the website, who owns it and which account controls it.
Receiving a password is therefore both enough and not enough. It may let the new developer enter the account, but it does not prove that the old agency has been removed. The new developer should review all users, recovery email addresses, active sessions, API keys, deployment tokens and server access. Passwords and technical credentials should then be changed, old accounts revoked and multi-factor authentication enabled where available. OWASP's guidance on secrets management recommends revoking credentials that are no longer required and rotating credentials that may have been exposed.
A complete backup should also be created before changing access. For a custom website, that normally means the website files, database, uploaded media and configuration required to run it elsewhere. The backup should be restored and tested on another server. A download that has never been tested is not yet proof that the website can be recovered.
There is one problem that technology cannot solve after the relationship ends. The previous agency may have downloaded customer data while it had legitimate access, and the client may never be able to prove whether a private copy still exists. That is why the original contract and the agency's reliability matter. The agreement should define how client data may be used, how long it may be retained and what must be deleted when the relationship ends.
Whether the client should secure access before announcing the decision depends on how the website is hosted. If the client owns the accounts, the transition can be planned and old access removed once the new agency is ready. If the website lives inside the agency's private shared hosting, removing access may not be possible until the agency provides the files and database.
The safest order is to identify every account, create and test a complete backup, prepare the replacement hosting, move the website, verify that the website and email work, and then remove the previous agency's access. The exact order may change, but the client should not begin a confrontation before knowing which parts of the business the agency can still control.
How do you switch web design agencies without downtime?
Website migration used to be a much larger process. Today, AI can help an experienced developer inspect unfamiliar code, identify dependencies and understand configuration faster. Depending on the website, a migration usually takes us between one and seven days.
The main challenge is discovering how the website data is organized. A simple website may keep its code, uploaded files and database on one server. A more complicated system may use several servers, external storage, scheduled tasks and third-party services. We have handled these migrations before, so we know what to look for before moving anything.
When Tomicz takes over a website, the client mainly needs to provide the available access information. We inspect the existing setup, identify what must be transferred and prepare the replacement hosting ourselves. This includes matching the required software versions, copying the website files and database, recreating configuration, checking DNS records and identifying external services connected to the website.
The original website should remain online during this process. We copy everything to the new hosting and run the migrated website through a temporary address or local configuration. This allows us to compare it with the existing production website while customers continue using the original version.
Testing is still manual where it matters. We open the important pages, test logins, submit forms and send messages to an agency-controlled email address to confirm they arrive. We also check uploaded files, database content, redirects, certificates and any integrations the website depends on. For websites where customer data changes frequently, the database may need one final synchronization immediately before the switch.
Only after the migrated website passes a thorough quality-assurance review do we point the original domain to the new hosting. Depending on how the domain is configured, that may mean changing its nameservers or updating the relevant DNS records. Because the original website remains available while those changes propagate, we have been able to complete migrations with no visible downtime.
Once the domain is serving the new website and everything has been verified again, the old hosting can be disconnected and the previous data removed according to the contract. The website never needs to disappear during the move. A migration becomes dangerous when someone shuts down the old website before the replacement has been copied, tested and made ready for real customers.
What if your agency refuses to transfer your website?
My acquaintance already knows how badly an agency dispute can end. A previous programmer became angry and deleted everything. The website, files and data were lost, and none of it was recovered. That experience is why his current situation feels less like changing a supplier and more like trying to leave without provoking the person who controls part of his business.
The first step should still be negotiation. Send a calm, official email requesting the website files, database, source-code repository, domain access and any other accounts covered by the contract. Keep the request specific and give the agency a reasonable deadline. Email creates a dated written record of what was requested and how the agency responded.
Do not begin with threats if the relationship can still be resolved professionally. The agency may cooperate once the handover requirements are clear. A hostile opening can make an already difficult migration harder, especially when the website still runs on infrastructure controlled by that agency.
If the agency refuses, the available legal options depend on the contract, the amount involved and the applicable jurisdiction. Small claims court may be an option in some cases, while others may require a lawyer and a formal demand. I do not provide legal advice, so this should be discussed with a qualified lawyer. The only general advice I can give is to have a strong contract prepared by a good lawyer before the project begins.
Hosting providers and domain registrars can sometimes help with account access or an unauthorized transfer, but they usually cannot decide a private ownership dispute between a client and an agency. ICANN itself says its authority is limited in disputes over who should control a domain and lists negotiation or court action among the possible routes for non-trademark disputes. ICANN explains those limitations here.
Recovery is not always worth the fight. If the website is small, rebuilding it may cost less than paying developers and lawyers to recover outdated or poorly written code. The new agency can preserve the useful content, rebuild the pages properly and move forward with infrastructure controlled by the client.
The existing domain should still be protected whenever possible. A domain that has been used for years has history, links, customer recognition and search authority. Rebuilding the website does not require replacing the domain. A new website can be placed on new hosting while the existing domain continues pointing customers to it.
A new domain should usually be the final option, not the first response to an agency dispute. Try to negotiate, document every request and recover the domain even if the old website itself is no longer worth saving. Code can be rebuilt. Recovering years of trust attached to a business domain is much harder.
How do you choose a web design agency you can trust?
After watching what happened to my acquaintance, I do not think choosing the next agency begins with finding the most impressive portfolio. The more important question is who will speak to you after the contract is signed. A polished sales process means very little if the person making the promises disappears as soon as the project reaches the development team.
I personally speak with every Tomicz lead. There is no salesperson between the client and me, and there is no handover from someone who sold the service to someone who has never heard the original conversation. I answer questions about the process, explain what we can and cannot do, and remain involved after the website launches. I wrote more about agency warning signs in Is My Digital Agency Scamming Me?.
Having a salesperson is a personal red flag for me, although the size of the agency matters. A large agency needs salespeople because the owner cannot speak with every prospect. A smaller web agency like Tomicz does not have the same excuse. When the only person a prospect can reach is trained to close the sale and earn a commission, the client should ask who will actually be responsible once the payment is made.
Tomicz will never have a sales team. That decision also limits how many clients we can accept, and I am comfortable with that. We are not trying to scale forever, chase an endless number of new clients or expand the team simply because growth is expected. We want fewer clients who remain satisfied for a long time.
Direct access still needs to be supported by a real process. Our contract defines ownership, the six-month minimum and what happens when the relationship ends. Clients own their domain, business data and supplied content from the beginning, and they own their client-specific website after six completed payments. Standard accepted changes are reviewed and made live by the next business day, while fixes, quick changes and larger projects have separate definitions.
A trustworthy agency should be able to explain these details before asking for payment. You should know who will answer your requests, how long responses and changes take, what is included, what costs extra, who controls each account and how you can leave. Trust should come from direct communication and written commitments, not from hoping the friendly person on the sales call will still remember you after launch.
Frequently asked questions
Do I own my website after a web design agency builds it?
That depends on the contract and payment arrangement. With a fixed-price project, the completed website should normally transfer to the client after full payment. With Website as a Service, ownership may transfer after an agreed period because the initial development cost is recovered through monthly payments.
What can I do if my web designer will not release my website?
Begin with a calm, documented email requesting the website files, database, source-code repository and account access covered by your contract. Try to negotiate before escalating the dispute. If the agency still refuses, speak with a qualified lawyer about the options available in your jurisdiction.
Should my business own its domain and hosting accounts?
Your business should control its domain from the beginning. You should also control the hosting account or have a written right to move the website to another provider. The agency should not be able to keep your business online identity simply because the relationship ended.
Will my website go offline when I switch agencies?
A properly planned migration should not require visible downtime. The new agency should copy the website to new hosting, test it through a temporary address, and keep the original website online until the domain points to the tested replacement.
Will changing web design agencies hurt my Google rankings?
Changing agencies does not automatically remove your rankings. The main risks come from replacing the domain, losing pages, changing URLs or launching a broken migration. Keeping the existing domain and thoroughly testing the migrated website reduces those risks.
Is it better to migrate my existing website or rebuild it?
It depends on the size and condition of the website. A small or poorly built website may cost less to rebuild than to recover and repair. A larger website with valuable functionality and data may be worth migrating, but the existing domain should be preserved whenever possible.
