Former agency refusing access: Recovering your domain, hosting, Google Ads, Business Profile, and Meta account

Communication first: What should the written request include?

Sending a written, dated request to the previous service provider before official applications both resolves many problems and creates a record for subsequent steps. As also noted in the domain transfer guide , a substantial share of delays results from the account being held in a reseller dashboard or communication breaking down rather than malicious intent.

Rather than using a ready-made text, it is important that the request include these elements:

• The business’s legal trading name and the name of the authorized person making the request.
• A clear description of each asset: domain, hosting package, Google Ads customer ID, and Facebook Page address.
• Exactly what is requested for each asset: transfer or authorization code, removal of the lock, primary ownership, Administrator role, and full backup.
• The business email address to which access will be added; business portfolio information for Meta.
• A reasonable response date and the channel through which the request was sent.
• A question about how any outstanding balance or unpaid invoice will be settled.

Keep an evidence file ready alongside the request: the contract or proposal letter, payment receipts and invoices, and emails about account creation. The invoice recipient shows who paid for the domain and hosting. If the request goes unanswered or a dispute arises about entitlement, consulting a lawyer is recommended; this article does not provide legal advice.

Web designer withholding the domain: Official rules for .com and .com.tr

If the web designer withholds the domain, the route depends on whose name it is registered under: if the business is the registrant, the code can be requested directly; if someone else is the registrant, ownership must be transferred first. The step-by-step process and the “If the former agency does not provide the transfer code” section are in the domain transfer guide ; only the main provisions of the official texts are included here.

.com and .net: The current ICANN Transfer Policy states that only the registrant has authority to approve or reject a transfer request. Under the same text, if the registrar does not provide this capability in its own dashboard, it has five calendar days from the registrant’s first request to provide the AuthInfo code and remove the transfer lock. It cannot refuse the code solely on the grounds of a payment dispute with the registrant. ICANN’s domain transfer page, states that a complaint can be filed with ICANN if a policy violation is suspected.

.com.tr and other .tr domains: TRABİS procedures are handled through a registration organization (KK). The Communiqué on Internet Domain Names contains the following notable provisions:

• Article 24: The authorization code is requested through the releasing KK’s website; the KK cannot block access to the code on grounds such as the domain holder having outstanding debt.
• Article 12: The KK may conduct operations through resellers and lists its resellers on its website; if the domain is in a reseller dashboard, this is how the KK behind it can be identified.
• Article 17: At the domain holder’s request, the KK provides current and accurate information about its own records, at least by email.
• Article 16: The KK resolves complaints within one month at the latest; those who receive no response within this period report their complaint to the Authority.

In both systems, there are circumstances in which a transfer may be rejected within 60 days after initial registration or the previous transfer; ICANN additionally has a 60-day lock after a change of registrant.

How do you obtain the hosting account and file/database backups?

If hosting access cannot be obtained, the priority is not the account itself but a complete website backup: website files, database, and email mailboxes if present. If the hosting account was opened in the previous service provider’s reseller account, the hosting company usually deals with that account’s owner; the initial request is therefore still made to the previous service provider.

List the following separately in the backup request:

• A complete archive of the directory containing the website, including uploaded images and plugins.
• A complete database dump (SQL file).
• An export of email mailboxes or temporary access for migration.
• A list of DNS records, especially MX, SPF, and verification TXT records.

In our migration process, the received backup is opened and tested before the old account is closed; an archive that will not open or a missing database is identified at this stage. If the business controls the domain and the backup is sound, the website is installed on new hosting opened in the business’s name, and domain routing is changed last.

If the website is not handed over: WordPress Administrator access

If the business does not have a WordPress user with the Administrator role linked to its own email address, the website cannot be considered effectively handed over. An Editor or Author role does not permit plugin, theme, and user management.

According to WordPress’s password reset documentation , the easiest route is the password reset link on the login page, and the new password goes to the email address registered on the account. If the administrator account’s email belongs to the previous service provider, this route is unavailable to the business. The same document states that the available method depends on what kind of access to the website remains: those with phpMyAdmin, FTP, or WP-CLI access can also reset the password through the database or files. WordPress access therefore largely depends on hosting access.

The following are requested at handover: an Administrator user created with the business email, information about which account holds paid theme and plugin licenses, and an up-to-date backup. After access is obtained, previous users’ permissions are reduced or removed, and passwords are changed. How licensing, source files, and copyright can be addressed in a contract is discussed in the web design contract guide .

Taking a Google Ads account back from an agency: Access, manager account, and ownership

The key to taking a Google Ads account back from an agency is whether the business has a user with Admin access in the account. According to Google’s access levels page , granting account access, changing access levels, and unlinking manager accounts can only be done at the Admin level.

Service providers usually connect to the account through a manager account (MCC). Google’s client account ownership page states these rules: a client account can have only one owner; the manager account automatically owns an account newly created from that manager account; a manager linking an existing account does not become its owner by default. Users in the client account cannot transfer ownership, but they can unlink the owning manager at any time. There are three distinct situations:

• The business has an Admin user: Unlink the previous service provider under Managers in Access and security. According to the unlinking page , the account does not lose campaign history and can be linked to a new manager account.
• The business has no user: First request Admin access for the business email address. Google requires at least one user with administrative access in the client account before ownership can be removed.
• No access is being granted: The official pages we reviewed do not describe a route for Google to transfer an account in which the business has no user. Try the “Contact us” channel in the Google Ads Help Center; if necessary, open a new account in the business’s name.

Before unlinking, check billing: according to the same page, if the account uses monthly invoicing and its paying manager is the manager account being unlinked, ads will stop running. Access to shared remarketing lists and cross-account conversion tracking is also lost. A step-by-step exit plan is provided in the Google Ads agency or freelancer article.

Google Business Profile: Ownership request and the 3-day period

For Business Profile, the official route is an ownership request, and the current owner is given 3 days to respond. According to Google’s requesting ownership page , the current profile owner is notified by email when a request is sent; if there is no response after 3 days, the profile may be claimed.

The differences between owner, primary owner, and manager roles, appeals following a rejection, the waiting period for new users, and the rules agencies are expected to follow as authorized representatives are explained in detail in the Google Business Profile ownership request guide and are not repeated here. The recommended sequence is brief: first request in writing that the previous service provider make the business account the primary owner; if there is no response, start the ownership request flow.

Google Analytics and Search Console: Administrator and owner roles

In Analytics, the decisive role is Administrator; in Search Console, it is verified owner. Once the business obtains one of these roles, it can manage other users itself.

Google Analytics

According to Analytics’ user management page , adding or changing users requires the Administrator role at account or property level, and deleting users requires it at account level; the last user with the Administrator role cannot delete themselves. If the business has no Administrator, the “No one has administrative access” page describes the recovery route: ownership of the websites sending data to Analytics is proved with an analytics.txt file containing the specified text or a meta tag; if Google Ads or AdSense accounts are linked, their ownership must also be proved, and then the form is completed. According to the page, access is not granted if ownership of all listed websites cannot be proved. Because this route requires access to website files, it again depends on hosting access.

Search Console

According to Search Console’s owners and users page , a verified owner is someone who has proved ownership with a token such as an HTML file uploaded to the website, and a property must have at least one verified owner. If the business controls the website or DNS, it can become an owner by performing its own verification. The old owner is then removed, and their verification tokens are deleted; the document states that if the tokens are not deleted, the removed owner can verify ownership again.

Meta Business Suite: Whose portfolio holds the Facebook Page?

With Meta, what matters is which business portfolio owns the Facebook Page, and requesting access does not mean taking ownership. Meta’s page on requesting access to a Page states that this request asks for permission to perform tasks such as viewing content, commenting, or running ads, rather than taking ownership. According to the same page:

• To request access to another business’s Page, the business must first add a primary Page to its own portfolio.
• Make the request through “+ Add” under Settings, Accounts, Pages; choose partial access or full control.
• The request goes to the person with full control of the Page or the portfolio containing the Page.
• Meta states that, for privacy reasons, it cannot disclose information about the person with full control of the portfolio to those who do not know who that person is.

Adding the Page to the business’s own portfolio is a separate matter. According to Meta’s page on adding a Page , if the Page belongs to another person or business, the owner must first remove it from their own portfolio; if the Page is linked to an Instagram account, that Instagram account is also added to the portfolio. For Meta, the written request should therefore ask not only for “access” but also for removal of the Page from the previous service provider’s portfolio.

To prevent a repeat: Account ownership clauses in a new working relationship

The rule for preventing the same problem is simple: assets are opened in the business’s name, and the service provider is added with only the access needed for the work. Meta’s page on granting partners access clearly explains the logic of this arrangement: a partner granted full control can manage everything but cannot share the asset with another business; only the organization that owns the asset can do that.

The following points must be clarified in writing in a new working relationship:

• The domain and hosting are opened in the business’s name and with the business email.
• The business has at least one Admin user in Google Ads; whether ownership will be granted to the manager account is specified separately.
• Primary ownership in Business Profile, the account-level Administrator role in Analytics, and verified ownership in Search Console remain with the business.
• The Facebook Page and advertising account remain in the business’s portfolio; the service provider is added as a partner.
• Specify when access will end and which backups will be delivered when the working relationship ends.

How these clauses can be written into a contract is explained in the web design contract and Google Ads agency or freelancer articles. At Onur Freelance, hosting and domains are opened in the business’s name; ownership of advertising and profile accounts remains with the business, and we are added as users.