Leaving your web agency without losing your site: code, access, domain name

It is the pain point that comes up most often in our discovery calls: about a dozen of the 38 brands and businesses that contacted us over a year describe it in one form or another. An e-commerce manager tells us her team has no access to the agency's code repository, and that the shop contains blocks nobody in-house knows how to use. An interior architect refuses to pay every time she wants to change a photo. A law firm partner asks it straight out: what happens if the old agency won't give us the code?

The exit itself rarely comes out of the blue. A developer replies less and less and leaves a checkout flow unfinished. A maintenance freelancer doubles his hours without fixing the problem. A provider sends a first quote, then nothing. That is when the brand discovers it doesn't know where its domain name is registered, or who holds the logins to its shop.

None of this is serious if you go about it in the right order. This guide covers what to recover, how to check it yourself, and how we take over a site that has passed through several hands. If you would rather find out whether your current agency is holding you back, the five-question test is in this guide on traditional agencies.

Not necessarily you. Under French law, software is a work protected by copyright just like a book (article L112-2 of the Intellectual Property Code), and a website's code is part of it. Any assignment of those rights must be written and detailed: each right assigned is mentioned separately, with its scope, purpose, territory and duration (article L131-3). A paid invoice is not enough: without an assignment clause, the provider remains the rights holder of what it created, and in practice you only have a right to use the site, as this legal guide from Captain Contrat points out.

So the first step is to reread the signed quote, the contract and the provider's terms and conditions. Look for the words "assignment", "intellectual property", "source code" and "reversibility". If the clause exists, it gives you grounds to demand the code. If it doesn't, the conversation becomes a negotiation, and it is better to start it before you cancel, while the relationship is still friendly.

On Shopify, things are simpler than elsewhere as long as the shop account is in your name: the theme lives in your shop, and the owner can duplicate it or download a copy from the admin. That copy does not include products, pages or images, which stay in the shop and are exported separately. On a site coded and hosted by the agency, however, with no access to the server or the code repository, you depend on its goodwill.

The rule we apply on every takeover: cancel nothing until every access has been recovered and tested. Once the contract is over, every request becomes slower and tenser. The table below follows the order in which we take inventory with our clients, from most to least blocking.

Make the request in writing, all at once, with the full list and a reply date. A dated email beats a phone call: it records what was asked for and what was handed over.

The domain name is the most important piece: it is what brings customers to your site and email to your inbox. Start by checking who the registrant is, with a WHOIS lookup or with Afnic for a .fr. If it is registered in the agency's name, the agency has to approve the change: according to Afnic, a request to transfer a .fr to a new holder goes through the registrar and requires the current holder's approval. For cases where that standard procedure cannot apply, Afnic provides a dedicated form, the Afnic Operation Request, described for instance in OVHcloud's documentation.

If the domain is already in your name but managed from the agency's account, you simply transfer it to a registrar where you have your own account. You need the transfer code for that (called AuthInfo or authorization code). For a .com, ICANN's Transfer Policy requires the registrar to provide this code and remove the transfer lock within five calendar days of the registrant's request. The same policy allows a transfer to be denied within 60 days of the domain's creation or a previous transfer, and ICANN notes that a change of registrant can also block transfers for 60 days.

The trap to avoid: changing the name servers without copying the DNS zone. Your email, the verification of your tools and sometimes your shop depend on records the agency created. Copy every record before touching anything, and recreate them identically at the new registrar.

A Shopify store has only one owner at a time, and only that owner can transfer ownership. When an agency creates the shop from its partner account, Shopify expects it to transfer ownership to the client at launch. Most of the time, that happens. Sometimes it doesn't: the account stayed on the email address of an agency employee, or of a freelancer who has since moved on.

To check, open the admin, then Settings, then Users. The store owner is shown there. If it's you, the essentials are covered: you can remove former collaborators' access, duplicate the theme and export products, customers and orders. If it isn't you, ask for the transfer before anything else.

Then comes the clean-up. At a fashion brand that had been through two providers, the team had no access to the agency's code repository and didn't know how to use several blocks in the theme. That is typically where we start with a full copy, then a section-by-section read: what is used, what no longer is, which app does what and who pays for it. Apps installed and forgotten are common, and each one adds a subscription and weight to the pages. What we code directly into the theme is detailed in this guide on Shopify without paid apps.

In Search Console, add yourself as an owner with a company email address, then remove the old provider. Google specifies that you must also delete their verification tokens (file, tag or DNS record): otherwise the removed owner can verify the property again. Do the same in Analytics, Merchant Center and Tag Manager.

For forms, check where contact requests actually arrive. A law firm told us it discovered requests sent from its site four to six months later, because nobody was handling them. Send yourself a test message from every form on the site.

For customer files, you are the controller of your customer files; the agency that hosts or handles them acts on your behalf. The GDPR provides that at the end of the service, this processor deletes all personal data or returns it to you, at your choice (article 28(3)(g), text published by the CNIL; official version on EUR-Lex). Ask for the full export first, then for written confirmation that the copies have been deleted.

We regularly take over shops and sites touched by one, two or three teams before us. The method is always the same, and it starts before a single line of code is written.

Changing provider loses you nothing on its own: Google doesn't know who wrote your code. Rankings suffer when the change comes with page addresses modified without redirects, deleted pages, or a domain that stops responding for a few days. A coffee brand that contacted us to rebuild its site was worried about precisely that: losing all its search rankings in the process.

If you keep the same site and the same domain, and only the people change, the risk is low. If the takeover comes with a redesign or a platform change, the method is the same as for a migration: list of addresses that receive traffic, redirects one by one, Search Console monitoring for several weeks. The full protocol is in this guide to migrating to Shopify without losing your rankings.

Everything is settled before you sign, while you still have the upper hand. Ask for these points to appear in black and white in the quote or the contract, and be wary of a provider who hesitates to write them down. The other questions to ask before signing are in this comparison of agencies and freelancers.

Take an hour to fill in the table above with what you already know. The empty lines tell you what to ask for, and from whom. Then send the written request to your current provider, before announcing your departure if the relationship is strained.

If you would like us to do this inventory with you, it is the first thing we look at in a discovery call: where your access sits, what holds, what blocks, and whether it is better to take over the site as it is or to rebuild it. For a shop, the takeover is part of our e-commerce offer; to talk about it, book a call.