The Digital Crown Jewel Most Businesses Ignore
Imagine discovering that the person holding the keys to your business domain has vanished.
Your website is still online—for now. Your branded email still works—for now. Your business cards, social profiles and invoices all point to the same address.
But nobody inside the business knows:
- Who registered the domain
- Which account controls it
- When it renews
- Where the recovery email goes
- Who can change the DNS
- Whether the domain is even registered in the business’s name
That is not a minor admin problem.
Your domain controls the online address customers use to find you. It can also control your website, business email, subdomains, verification records and other essential services.
A Facebook Page can help customers discover you. But your branded domain is the address you can build your business around.
Facebook is rented distribution. Your domain is portable business infrastructure.
That does not mean a domain is permanent or risk-free. It must be renewed, protected and properly controlled.
But unlike a Facebook Page, a correctly managed domain can usually move with your business when you change hosting companies, website platforms, agencies or technical suppliers.
Let’s break down how to protect this often-overlooked business asset.
First, Know What You’re Actually Controlling
Many business owners treat the domain, website and hosting as one thing.
They are not.
Think of your online presence as a physical business site:
- Your domain is the street address.
- DNS is the signposting system directing visitors and email.
- Your hosting is the building where the website lives.
- Your website is the content, design, database and tools inside the building.
- Your email provider handles your business mailboxes.
These parts can work together while being controlled by different companies or accounts.
For example:
- Your domain might be registered with one provider.
- Your DNS might be managed somewhere else.
- Your WordPress website might be hosted by Empire Base.
- Your business email might use another provider.
- Your designer might have access to update the website.
That arrangement can work perfectly well—provided your business controls the important accounts.
WordPress also explains that your domain and hosting are separate. You can change hosts while keeping the same domain, which means you do not necessarily need to rebuild your entire online identity just because your hosting arrangement changes. (WordPress.org)
That is one reason a domain is more powerful than a Facebook Page address.
Your domain can sit above the technology and continue pointing to the system you choose.
Who Holds the Keys to Your Digital Kingdom?
The most important question is not:
“Who built our website?”
It is:
“Who controls the domain registration, registrar account, recovery details and DNS?”
These may be different people.
The registered name holder
The registered name holder—often called the registrant—is the person or organisation recorded as having authority over the domain registration.
For a business, that should normally be the business itself.
Not:
- A former employee
- A freelance designer
- An agency owner
- A founder’s personal account
- A contractor’s private email address
- Someone’s spouse or friend who helped set everything up
A supplier can manage the domain for you. That does not mean the supplier should be the asset holder.
A useful rule is:
Your agency can receive access. Your agency should not become the owner of your business address.
The registrar account
The registrar is the company that manages your domain registration.
The registrar account usually controls:
- Renewal
- Registration details
- Transfer locks
- Transfer codes
- Nameservers
- DNS settings
- Recovery options
- Payment details
Someone can be the recorded registrant but still lose practical control if another person controls the registrar login, recovery email or two-factor authentication.
That is why formal ownership and operational control both matter.
DNS control
DNS tells the internet where to send people.
It can direct:
- Your website visitors
- Your business email
- Verification systems
- Subdomains
- Application connections
- Security services
If someone changes your DNS, they may not need to steal the domain itself. They could simply redirect your website or interfere with your email.
That is why DNS access deserves the same care as the domain account.
Public Domain Records Are Not the Whole Story
You may have heard people say:
“Just check WHOIS to see who owns the domain.”
That advice is now incomplete.
For many generic domains, such as .com, .net and .org, RDAP is now the modern registration-data lookup system. It provides structured information through the web, whereas traditional WHOIS was an older text-based system.
You can use ICANN Lookup to inspect available registration data for many generic domains.
But there is an important catch.
Public domain records may hide personal information for privacy reasons. You may see:
- Redacted contact details
- A privacy service
- A registrar name
- Nameservers
- Creation and expiry dates
- Transfer status codes
You may not see the actual person’s name, email address or physical address.
That does not automatically mean:
- Nobody owns the domain
- The privacy service owns it
- The domain is abandoned
- Your business has no rights to it
Privacy redaction changes what the public can see. It does not necessarily change who holds the underlying registration.
So treat a public lookup as an audit clue—not the final proof of business control.
The stronger evidence is inside the registrar account:
- Who can log in?
- Which email receives recovery messages?
- Who controls two-factor authentication?
- Whose payment method is attached?
- What company information is recorded?
- Who can change the DNS?
- Can the business renew or transfer the domain without asking an outside supplier?
That is where the real battle is fought.
The Quiet Ways Businesses Lose Their Domains
Most domain disasters do not begin with a dramatic cyberattack.
They begin with a small shortcut.
An agency registers the domain
A designer offers to register the domain as part of a website package. Years later, the business discovers that the designer’s agency account still controls everything.
The agency may be honest and helpful. But if the relationship ends badly—or the agency closes—the business can face a long recovery process.
A personal email becomes the recovery email
Someone registers the domain with an old personal email address.
That person changes jobs, loses access to the mailbox or forgets the password. Suddenly, renewal and recovery messages go nowhere.
The payment card expires
Auto-renewal is enabled, but the card belongs to a former employee or an old business account.
The domain may expire before anyone notices.
The domain is registered in the wrong name
The business paid for the domain, but the registration details name an individual rather than the organisation.
Payment records may help prove the business’s connection, but it is far safer to establish the correct registrant information at the start.
Nobody knows the underlying registrar
A web agency or reseller may provide a neat dashboard without making the underlying registrar obvious.
That can make it harder to understand where the domain is actually registered or how to recover it.
DNS is treated as somebody else’s problem
The business owns the domain but nobody documents where the DNS is managed.
Then a website migration, email change or security update causes confusion. Someone changes nameservers without backing up the existing records, and suddenly the website or email stops working.
The cure is not technical wizardry.
It is clear ownership, documented access and sensible records.
Domain Expiry: The Trapdoor Beneath the Drawbridge
A domain can expire.
That sounds obvious, but many businesses misunderstand what happens next.
There is no universal rule saying:
“You always have 30 days to recover your domain after it expires.”
The timing depends on:
- The domain extension
- The registrar
- Whether the domain has been deleted
- Whether it enters a redemption period
- Whether the registrar auctions or parks it
- The registrar’s published recovery terms
- Whether the domain is a generic extension or country-code extension
For many generic domains, ICANN requires a 30-day Redemption Grace Period after the registrar deletes the domain from the registry. That is not necessarily 30 days from the first missed renewal date. (ICANN Expired Registration Recovery Policy)
Before deletion, the registrar may:
- Park the domain
- Suspend the website
- Disable email
- Add restoration charges
- Begin an auction process
- Apply its own post-expiry timeline
Country-code domains, such as .uk and .au, can follow different registry rules.
So the safe approach is simple:
- Turn on auto-renewal.
- Keep a valid payment method.
- Use an off-domain recovery email.
- Record renewal dates outside the registrar account.
- Set independent reminders.
- Check the domain is still renewing correctly.
Auto-renewal is a safety net—not a complete renewal strategy.
If your domain is yourbusiness.com, do not use only admin@yourbusiness.com as its recovery address. If the domain fails, that email address may fail with it.
A recovery email outside the domain can be the difference between a quick fix and a business crisis.
Domain Transfers: Moving the Address Without Moving the Whole Business
One of the domain’s biggest advantages is portability.
You can often change registrars while keeping:
- The same domain name
- The same website
- The same business email
- The same branding
- The same customer-facing address
A registrar transfer is not automatically the same thing as moving your hosting.
You can change the registrar while leaving the website and DNS where they are—but you should still plan carefully.
For many generic domains, current transfer rules may prevent a transfer during periods such as:
- The first 60 days after registration
- The first 60 days after a previous transfer
- A recent change of registrant
- A dispute or legal restriction
- A redemption period
The exact rules can vary by extension and registrar. Check the current ICANN Transfer Policy before starting.
A typical transfer may involve:
- Confirming who the registrant is.
- Checking the domain expiry date.
- Checking whether a transfer lock is active.
- Backing up DNS records.
- Confirming access to the registrar account.
- Generating an AuthInfo or transfer code.
- Starting the transfer with the new registrar.
- Watching for approval emails.
- Checking the website and email after completion.
- Re-enabling the transfer lock.
Do not casually change the registrant name or email immediately before a transfer. Some changes can create temporary transfer restrictions.
Also, do not assume that the transfer code is harmless. Treat it like a temporary password. Do not leave it sitting in a shared project-management document forever.
Your Domain Audit: A Simple Business Check
You do not need to become a domain expert.
You simply need to answer four questions:
What is registered, where is it registered, in whose name, and who can control it?
Use this checklist.
| Audit area | Healthy position | Warning sign |
|---|---|---|
| Registrar | Business knows who it is | “Our designer handles that” |
| Registrant | Business or intended organisation | Former employee or agency |
| Registrar account | Business-controlled login | Personal account |
| Recovery email | Monitored off-domain address | Email on the domain itself |
| MFA | Enabled and controlled by the business | Password only |
| Payment | Current and monitored | Former employee’s card |
| Auto-renewal | Enabled and checked | Nobody knows |
| Expiry date | Recorded independently | Only inside one account |
| DNS provider | Documented | Nobody knows |
| Nameservers | Backed up | No record exists |
| Transfer lock | Enabled when not transferring | Permanently unlocked |
| Admin access | Limited and reviewed | Too many unknown users |
If you discover a problem, do not immediately change everything at once.
First:
- Record the current settings.
- Confirm who has access.
- Back up the DNS records.
- Check the expiry date.
- Make sure business email will continue working.
- Plan the transfer or account change carefully.
- Test the website and email afterwards.
A rushed domain change can create the very outage you were trying to prevent.
How to Register Your Domain Properly
If you are registering a new domain, use a business-controlled process from the start.
Step 1: Create the account in the business’s control
Use a company-managed email address or a secure business identity—not a supplier’s personal account.
Step 2: Record the correct organisation
Use the intended company or legal business information accurately.
Step 3: Enable strong authentication
Use multi-factor authentication or a passkey where available.
Step 4: Add an external recovery email
Do not rely only on an email address that depends on the domain working.
Step 5: Turn on renewal protection
Enable auto-renewal and keep payment details current.
Step 6: Document DNS
Record the nameservers and important DNS records, including:
- Website records
- Mail records
- SPF
- DKIM
- DMARC
- Verification records
- Any application connections
Step 7: Delegate access carefully
A web developer may need access to point the domain towards your website.
That does not mean they need to own the domain account.
Give people the tools they need. Do not give away the crown jewels.
Your Domain Versus Your Facebook Page
| Question | Business domain | Facebook Page |
|---|---|---|
| Can the underlying provider be changed? | Usually, subject to domain rules | The Page remains within Meta |
| Can it support branded email? | Yes | No equivalent independent email address |
| Can it point to different hosts? | Yes | No |
| Can it support different website platforms? | Yes | No |
| Does it require renewal? | Yes | No domain renewal, but account and Page access still matter |
| Can an agency help manage it? | Yes, with delegated access | Yes, within Meta’s access system |
| Can it be moved to another provider? | Usually, under transfer rules | Not like a domain |
| Main strategic strength | Portable identity and infrastructure | Audience reach and interaction |
| Main strategic risk | Expiry, account loss or DNS problems | Platform dependency and access restrictions |
A Facebook Page may bring valuable attention.
Your domain gives that attention a stable destination.
That is why the strongest structure is not Facebook versus your domain.
It is:
Facebook for discovery. Your domain for authority, conversion and continuity.
Where WordPress Fits Into the Picture
Once your domain is secure, you need somewhere to build your website.
Empire Base favours WordPress because it gives small businesses room to grow. WordPress can start as a simple service website and later support:
- Blogs
- Case studies
- Booking systems
- WooCommerce shops
- Memberships
- Online courses
- CRM connections
- Advanced forms
- Custom integrations
The domain remains the address.
WordPress is the flexible building beneath it.
And your hosting provider is responsible for keeping that building available, secure and properly supported.
If you are still deciding how to build your first site, read how to build a small business website without the tech overwhelm.
For a deeper explanation of the platform itself, read why WordPress is a smart website foundation for small businesses.
Empire Base Can Help You Build Beneath the Address
Your domain should remain your business asset.
Empire Base can provide the hosting foundation beneath it.
Shared hosting
Empire Base shared hosting offers an affordable starting point for smaller websites and early-stage businesses, with plans beginning at £3.49 per month.
The plans increase in storage, bandwidth and processing resources as your business grows.
Explore Empire Base Shared Hosting
Managed WordPress hosting
Managed WordPress hosting is designed for businesses that want more technical care included.
Depending on the plan, it includes:
- VPS resources
- WordPress hosting
- Server maintenance and security
- Speed optimisation
- CDN setup
- Daily backups
- Malware and vulnerability scanning
- Firewall protection
- Uptime monitoring
- Performance checks
- Monthly reporting
- Supplied blog publishing
Plans currently begin at £59 per month or US$77 per month, with different resources and content-publishing allowances available as your needs grow.
The storage ranges depend on the selected location and data centre. Applicable VAT may be added at checkout.
Explore Managed WordPress Hosting
Your Domain Security Battleplan
Here is the short version:
- Register the domain in a business-controlled account.
- Make the business the intended registrant.
- Use an off-domain recovery email.
- Enable multi-factor authentication.
- Keep renewal payment details current.
- Record the expiry date independently.
- Document your DNS provider and records.
- Keep transfer locks enabled when not transferring.
- Store transfer codes securely.
- Review admin access regularly.
- Remove former suppliers and employees.
- Back up your website separately.
- Keep important creative files outside Facebook.
- Make sure more than one trusted person can recover the account.
This may sound like admin.
But when your domain controls your website, email and customer-facing identity, it is business protection.
The Final Word: Own the Address
A Facebook Page can help you reach people.
It can build a community, showcase your work and generate enquiries.
But it exists inside Meta’s system.
Your domain is different. Properly registered and maintained, it gives you a portable identity that can survive changes to your host, website platform, agency or technical setup.
That is why your domain deserves more attention than it usually gets.
It is not just the thing at the end of your email address.
It is the address of your business empire.
Secure the domain. Build the website. Rent the reach—but own the foundation.
Ready to strengthen your digital foundation?
- Explore Shared Hosting
- Explore Managed WordPress Hosting
- Return to the Facebook vs Website strategic battleplan
This article provides general information, not legal, domain-dispute or technical recovery advice for a specific situation. Domain rules vary by extension, registrar and jurisdiction. Check the current registry and registrar guidance before making a transfer or recovery decision.
