What 'You Own Everything' Must Mean in a Web Contract: Clause-by-Clause Template

"You own everything" in a web design contract must mean six named things: the domain registered to you, the hosting account in your name, an administrator login you control, a written assignment of copyright in the design, code and content, a list of third-party licenses you inherit, and a handover clause that works even if the vendor disappears. This article gives you clause-by-clause wording for each.

Why "you own everything" is not a contract term

The phrase appears on sales pages far more often than in signed agreements. In our September 2026 benchmark of 39 public Malaysian and Singaporean price lists, only 40% of Malaysian vendors and 17% of Singaporean vendors stated ownership at all, and most of those did it in a bullet point rather than a clause. A bullet point on a pricing page is not the document you will be holding when you want to move hosts or change designers. The full dataset is in our 2026 benchmark of MY and SG web design quotes.

Ownership also is not one thing. A website is a bundle: a domain name (a registration, not property), a hosting account (a service contract), software (mostly open-source, licensed to everyone), a theme and plugins (licensed, sometimes to the vendor rather than to you), original design and code (copyright), your text and photos (copyright, usually already yours), and a set of accounts that measure it. Each part is owned, licensed or controlled under different rules, so a single sentence cannot cover them. The clauses below do. They are drawn from the agreement we use for WordPress web design in Malaysia and for our Singapore builds, simplified so you can paste them into any vendor's contract as a counter-proposal.

If you are still deciding between buying a site and renting one, read website rental vs ownership in 2026 first; the clauses here only apply to a site you are buying.

Clause 1: the domain is registered to you, not to the vendor

The registrant of record must be you or your company, with your own email on the registrant contact, from day one. The vendor may be listed as technical contact and may manage DNS, but the registrar account, or at minimum the registrant identity, is yours. This is the single clause that decides whether you can ever leave.

Suggested wording: "The Client shall be the registrant of the Domain. Where the Vendor registers the Domain on the Client's behalf, it shall do so in the Client's legal name and using an email address controlled by the Client, and shall provide the registrar account credentials or transfer authorization code within five working days of registration. The Vendor acquires no interest in the Domain."

Both national registries treat the registrant as the party with rights over the name. MYNIC's guidance on managing a .my domain describes changing the registrant and moving a domain between accounts or registrars as actions taken by the domain holder through its own account, and SGNIC's .sg domain registration FAQ explains that a transfer to another registrar starts with the registrant obtaining a "domain transfer password" from the current registrar. If the vendor is the registrant, you are asking the vendor for permission to leave the vendor. Verify with a WHOIS lookup after registration; the registrant organization field should show your business name even where contact details are masked.

Clause 2: the hosting account is in your name

Hosting is a service, so "ownership" means the account holder is you, the billing goes to you, and the vendor's access is a delegated user that you can revoke. Reseller hosting, where a vendor buys one large plan and slices it across clients, is the most common way this clause is broken: your site sits inside someone else's account, and when they stop paying or stop trading, it goes dark.

Suggested wording: "The Website shall be hosted on an account held in the Client's name with a hosting provider of the Client's choosing or, where the Vendor procures hosting as part of a maintenance plan, on an account for which the Client holds the master login. The Vendor shall provide the Client with full server access (control panel, SFTP and database credentials) at launch and on request."

Under our Care Plans, hosting, domain and SSL are included in the yearly fee (from RM599 in Malaysia and S$488 in Singapore), and the clause above still applies: the account is yours, we hold a delegated login, and you receive the credentials at launch.

Clause 3: an administrator login you control

On WordPress, the Administrator role is the one that can install plugins, change themes, add or remove users and export the site; WordPress documents this in its roles and capabilities reference. An Editor login is not control. Neither is an Administrator login the vendor can delete because they hold the only other one and the hosting account.

Suggested wording: "At launch the Vendor shall create an Administrator-level user in the Client's name with an email address the Client controls, and shall not remove or downgrade that user. The Vendor's own access shall be a separate user that the Client may remove at any time without affecting the Website."

Ask for the same on every closed platform. Wix, Squarespace and Shopify all have an account owner; that owner should be you, and the vendor should be a collaborator or staff account. If a vendor insists the site must live inside their agency account "for support reasons", price that as rental.

Clause 4: copyright in the design, code and content is assigned to you

This is the clause most contracts skip, and the default law in Malaysia and Singapore points in opposite directions, which is why it needs writing down. In Singapore, the creator owns copyright in a commissioned work unless the contract says otherwise; IPOS states in its guidance on copyright ownership and commercialisation that ownership of commissioned works is "subject to contract" and that assignment is normally done by written agreement. In Malaysia, section 26(2) of the Copyright Act 1987 deems copyright in a commissioned work transferred to the commissioner "subject to agreement between the parties excluding or limiting such transfer"; the consolidated text is on WIPO Lex. So a Singapore client with a silent contract does not own the design, and a Malaysian client with a silent contract probably does, unless the vendor's terms quietly reverse it. Do not rely on either default.

Suggested wording: "Upon receipt of the final payment, the Vendor assigns to the Client all copyright and other intellectual property rights in the Deliverables, including the visual design, page layouts, custom code, custom theme or child theme, and any text, images or graphics created by the Vendor for the Client. The Client's own materials remain the Client's property at all times. The Vendor may retain a portfolio copy and may reuse general know-how, but not the Deliverables."

Two points to check. First, the trigger: assignment on final payment is normal and fair; assignment "on request" or "after the maintenance term" is not. Second, the carve-out for generic code: vendors reasonably keep the right to reuse their own boilerplate, so the clause should assign what was made for you and license what was made before you. Remember that assignment does not cover things the vendor never owned, which brings us to licenses.

Clause 5: third-party licenses are listed and transferable

Most of a modern site is not owned by anyone at the table. WordPress itself is GPL-licensed and free to everyone. Premium themes, page builders, form plugins, SEO plugins, fonts and stock photos are licensed, and the license terms decide whether you can keep using them after the vendor leaves. The common failure is an agency-level license: the vendor pays one yearly fee that covers unlimited client sites, your site is one of them, and the day you leave, your copy stops receiving updates, or worse, the license key is deactivated.

Suggested wording: "Schedule B lists every third-party theme, plugin, font, image and service used in the Website, the license under which each is supplied, whether the license is held by the Client or the Vendor, and the renewal cost. Where a license is held by the Vendor, the Vendor shall either transfer it to the Client at handover or confirm in writing that the Website will continue to function without it."

On our builds, Yoast Premium is included in the package price; from year two it is covered under a Care Plan or renewed by you directly. Either way it is in the schedule, not a surprise.

Clause 6: measurement and business accounts belong to you

Google Analytics 4, Google Search Console, Google Business Profile, Tag Manager, payment gateway accounts and transactional email accounts are where your data lives. If any of them were created under the vendor's Google account, the history leaves when the vendor does. This clause costs the vendor nothing and is refused surprisingly often.

Suggested wording: "All third-party accounts created for the Website (including analytics, search console, business profile, tag management, payment and email services) shall be created under the Client's own accounts, with the Client as owner or primary administrator. The Vendor shall be added as a user with the minimum permission needed and may be removed by the Client at any time."

Google Business Profile deserves special attention because it drives calls and directions for local businesses and because ownership transfers of a profile are slow and occasionally fail. Insist it is created or claimed with your account as primary owner from the start.

Clause 7: the handover pack and the exit that does not need the vendor

A good ownership clause is tested by one question: if the vendor stopped answering email tomorrow, could you move the site to a new host and a new developer without them? That requires a handover pack delivered at launch, not on exit, because on exit the vendor may not be cooperating. The pack should contain the registrar login or auth code, hosting control panel login, SFTP and database credentials, WordPress administrator login, a full site backup (files plus database) in a standard format, the license schedule from clause 5, and access confirmations for the accounts in clause 6.

Suggested wording: "On the Launch Date the Vendor shall deliver the Handover Pack listed in Schedule C and shall thereafter provide an updated full backup on request within five working days. The Client may terminate any ongoing maintenance service on thirty days' notice; on termination the Vendor shall remove its own access and shall not alter, disable or withhold any part of the Website, the Domain or the Handover Pack, whether or not any dispute exists."

The last sentence is the important one. Vendors sometimes hold sites hostage in fee disputes; the contract should say the site is not the lever. Their remedy is to sue for the fee, not to switch off your business.

Our own process delivers this pack on day 10 of a Starter build, alongside training, and our 30-, 60- or 90-day free maintenance window runs from that date; the timeline is described in how our fixed-price website method works.

Clause 8: what the vendor still owes after ownership passes

Ownership passing to you does not end the vendor's obligations; it changes them. A fair contract states a defect-fixing period after launch (30 days is common; we give 30 to 90 depending on package), what counts as a defect versus a change request, and what maintenance costs after the free period. It should also state that ownership is not conditional on buying maintenance. A clause that says "ownership transfers on completion of the 12-month maintenance term" is a rental agreement with a purchase option, and should be priced as one.

Suggested wording: "The assignment in clause 4 and the deliveries in clause 7 are not conditional on the Client purchasing any maintenance, hosting or other ongoing service from the Vendor."

A pre-signing check in ten minutes

Take the vendor's contract and find each of the eight clauses above. For each one, write down which page and paragraph covers it, or write "missing". Then ask the vendor to add the missing ones using the wording here; a vendor who genuinely intends you to own the site will not object to any of it, because none of it costs them anything they were not already promising. A vendor who resists clause 1, 4 or 7 has told you what "you own everything" meant to them. The Malaysian version of this exercise, with the Bahasa Malaysia terms and the SSM and MYNIC checks, is in our website ownership checklist for Malaysia.

1. Domain registrant is me, registered with my email.
2. Hosting account holder is me; vendor is a delegated user.
3. I have an Administrator (or account owner) login the vendor cannot remove.
4. Copyright in design, code and vendor-created content is assigned to me on final payment.
5. Every third-party license is listed with holder and renewal cost.
6. GA4, Search Console, Business Profile, payments and email are under my accounts.
7. Handover pack delivered at launch; no withholding in a dispute.
8. Ownership is not conditional on buying maintenance.

If you would rather start from a contract that already contains all eight, our fixed-price packages in Malaysia and Singapore include 100% ownership of the site, domain and hosting credentials at launch, and we will send you the agreement before you pay a deposit.

Frequently asked questions