# How to Take Back Your Website and Google Accounts

> Take back your accounts in order: an email on your own domain, then the domain registrar, Google Business Profile, Search Console, website and hosting, GA4 and Tag Manager, Google Ads, then Meta. Each platform defines owner differently. Search Console owners can regain access through a token left on your site, and new Business Profile owners wait 7 days before removing anyone.

- Canonical URL: https://www.pavadotech.com/blog/how-to-take-back-website-and-google-accounts-from-agency
- Author: Om Patel
- Published: 2026-09-28
- Topic: GSEO

To take back your website and Google accounts from an agency, get into each account as its owner, using an email on a domain you control, then remove the agency. It is nine separate accounts with nine different definitions of "owner", and three of them have traps that can undo the whole job: [Search Console](https://support.google.com/webmasters/answer/7687615?hl=en) lets a removed owner back in through a token left on your site, Google Business Profile makes a new owner wait 7 days before removing anyone, and a Meta ad account created in the agency's portfolio can never be moved out.

This is the account-by-account checklist. If you are still deciding whether to leave, or how to have that conversation, start with [how to fire a marketing agency](https://www.pavadotech.com/blog/how-to-fire-a-marketing-agency), which covers the exit order, contracts and what to do when they refuse. This post is the part where you sit down with the logins.

- **Start with an email you control.** Every recovery path sends a code to an owner email. An address the agency created for you is not yours until you hold its password and recovery phone.
- **Own the domain first.** The domain is where your email, website and Search Console verification all live. Whoever controls DNS can eventually control the rest.
- **Search Console tokens:** Google says you must remove a verified owner's token from the site, or they "might regain access".
- **The 7-day wait:** a new Business Profile owner cannot remove other owners or transfer primary ownership for 7 days.
- **Meta ad accounts do not move.** An account created in a portfolio "can't be deleted or transferred from the portfolio."
- **Save a baseline before you cut access,** so any change after the split shows up as a change, not a mystery.

## The 15-minute audit: who owns what right now

**Before you ask for anything, find out what you already have.** Most owners have logins to some of these and assume they have all of them. Open each one and look for the specific thing in the third column.

| Account | Where to check | You own it if |
| --- | --- | --- |
| Domain registrar | Search your domain at [ICANN Lookup](https://lookup.icann.org/) to see the registrar, then try logging in there | You can log in to the registrar account that holds the domain |
| Hosting | Your hosting control panel, or ask who sends the hosting invoice | The hosting account is in your name and billed to you |
| Website admin | The Users screen in WordPress, Squarespace, Wix or similar | You are an Administrator, not an Editor |
| Google Business Profile | business.google.com, then People and access | You are the Primary owner |
| Search Console | Settings, then Users and permissions | You are listed as Owner, ideally verified |
| GA4 | Admin, then Account access management | You are Administrator on the account, not only on the property |
| Tag Manager | Admin, then User Management | You are Administrator on the account and have Publish on the container |
| Google Ads | Admin, then Access and security | You have Admin, and no manager account has ownership |
| Meta | Business settings, then Ad accounts and Pages | The ad account and Page are owned by your portfolio, not shared to it |

If the web designer ever asked you "who is your host?" and you had no idea, you are in good company. In an r/web_design thread about client types, a designer described the typical small business answer: ["How would I find my site's login information and I have no idea who's my host."](https://www.reddit.com/r/web_design/comments/1v9xi2h/tell_me_if_these_two_types_of_clients_ring_a_bell/) That is fixable in an afternoon, but only if you know it before the relationship turns sour.

## The order matters more than the speed

**Take the accounts in the order that gives you leverage for the next one.** The domain unlocks email and Search Console. Email unlocks every recovery flow. Doing it out of order is how owners end up locked out halfway through.

1. **An email on your own domain,** or at minimum a Google account only you control, with your phone as the recovery number.
2. **The domain registrar.**
3. **Google Business Profile,** because of the 7-day wait.
4. **Search Console.**
5. **Website admin and hosting.**
6. **GA4 and Tag Manager.**
7. **Google Ads.**
8. **Meta.**
9. **Cleanup:** passwords, third-party connections, removing the agency everywhere at once.

The owner who posted in r/SEO about [canceling a freelancer with 0 ROI](https://www.reddit.com/r/SEO/comments/1whjup1/canceling_my_seo_service_due_to_0_roi_but_the/) was told by the top comment, with 158 upvotes, to "change any passwords youve shared with him and remove any of his accounts for any analytics and data properties (GSC, GA, GTM, etc.)". The reply underneath added the sequencing that matters: "Do the accounts password change first and make sure all the emails id associated you have access to. Only after that you have to let go."

One trap before you start: an agency on r/GoogleMyBusiness described its own setup as ["We use their own emails we create for them."](https://www.reddit.com/r/GoogleMyBusiness/comments/1fz2881/help_if_you_can_please/) An address created for you, with the agency's phone as the recovery number, is theirs in practice. Log in, change the password, replace the recovery phone and email with yours, and turn on 2-step verification before you use it for anything below.

## 1. The domain: find it, then move it without the 60-day trap

**Look up your registrar, then ask the agency to move the domain into an account you own at that same registrar.** That is usually faster and safer than transferring it to a new registrar.

ICANN's lookup shows which registrar holds the domain. If that registrar is GoDaddy, Namecheap or similar and you have no login there, the domain sits in the agency's account. The cleanest fix is an account-to-account move at the same company. [GoDaddy's help page](https://www.godaddy.com/help/transfer-my-domain-to-another-godaddy-account-822) says domains moved to another account "will keep all existing DNS settings", and the recipient has 10 days to accept. Keeping DNS means your website and email do not blink.

Note the catch on that same page: "connected products, such as a website or email, do not transfer with the domain." If the agency also bought hosting or email at that registrar, those need their own plan (section 4).

If you want to leave the registrar entirely, two ICANN rules apply, per its [registrant FAQ](https://www.icann.org/resources/pages/name-holder-faqs-2017-10-10-en):

- **Auth code:** your registrar "must provide you with the AuthInfo code within five (5) calendar days of your request."
- **60-day lock:** "You cannot transfer a domain name to a different registrar within 60 days of making changes to the registrant name, organization or email address." Some registrars let you opt out, but they do not have to.

So do not rush in and change the registrant name and email, then try to transfer. ICANN itself suggests completing the transfer before changing contact information, or simply changing hosting or nameservers instead of registrars. A YouTube creator who covers domains, in a video with 91,650 views, adds a practical rule from his experience: transfers take "anywhere from two to nine days", so if the domain expires within seven days, renew it where it is first.

## 2. Google Business Profile: get added, then wait 7 days

**Ask to be made owner, wait out Google's 7-day restriction, then take primary ownership and remove the agency.** Skipping the wait is why owners hit errors mid-handover.

Google's [owner and manager rules](https://support.google.com/business/answer/3403100?hl=en) say a profile "can have multiple owners but only one primary owner," and that when you become an owner or manager "you have to wait 7 days" before you can delete the profile, remove other owners or managers, or transfer primary ownership. Plan the calendar around it: added on day 1, primary owner on day 8.

If the agency will not add you, use Google's request access flow. The current owner "has 3 days to respond," per [Google's claim guide](https://support.google.com/business/answer/4566671?hl=en), and after that you "may have the option to claim the profile." [Service-area businesses](https://www.pavadotech.com/blog/service-area-business-google-business-profile) follow a different support route, covered in that guide.

The worst case is real. A clinic owner on r/GoogleMyBusiness wrote that the agency ["kicked out of our business page and claimed ownership"](https://www.reddit.com/r/GoogleMyBusiness/comments/1vciglc/kicked_out_of_my_own_google_business_page/), marked it permanently closed, and would accept an access request, then "give access for two minutes and then kick us out." The most detailed reply: "screenshot every single step," file a third-party complaint, and submit proof of the business: registration, lease or utility bill, phone bill, signage photos. If the profile gets suspended along the way, the steps for [a suspended Business Profile](https://www.pavadotech.com/blog/google-business-profile-suspended-what-to-do) apply.

## 3. Search Console: remove the token, not just the user

**Removing the agency from the user list is not enough if they are a verified owner.** You also have to remove the file or tag they used to verify, or they can let themselves back in.

Google's [Search Console user guide](https://support.google.com/webmasters/answer/7687615?hl=en) separates two kinds of owner. A verified owner proved ownership "using a token... such as an HTML file uploaded to the website," and "to add or remove a verified owner, you must add or remove a token on the site." A delegated owner was simply added by someone else and can be removed from the user screen.

When you remove a verified owner, Search Console warns that the user "might regain access" and tells you to "remove the tokens listed in the notification." You can also find them under **Unused ownership tokens** on the Users and permissions page. Tokens usually live in one of three places: an HTML file in the site's root folder, a meta tag in the site header (often set in an SEO plugin), or a TXT record in DNS.

This is where owning the domain pays off. A Domain property requires "a DNS record to your domain provider's record list," per Google's [verification help](https://support.google.com/webmasters/answer/9008080?hl=en). Whoever controls DNS can verify themselves as owner without anyone's permission, and remove anyone else's DNS token. Get the registrar first, and Search Console follows.

One commenter in the r/SEO thread asked the question every owner should: "do you actually have your own login to Google Search Console and GA4, verified as owner, not just added as a user under his account?"

If Search Console and your Business Profile sat in the agency's name, you have probably never seen how Google, or ChatGPT, actually describes your business. Once they are back in your hands, we audit what search engines and AI assistants say about you, who they name instead, and what to fix first.

## 4. Website admin and hosting

**You want an Administrator login on the website and a hosting account billed to you.** An Editor login lets you change text; it does not let you remove the agency or move the site.

WordPress has six predefined roles, per its [roles documentation](https://wordpress.org/documentation/article/roles-and-capabilities/), and Administrator is the one that runs the whole site on a single install, including users and plugins. Check the Users screen for every admin account and ask who each one belongs to. Old agency staff logins are common.

Hosting is often the hidden one: the agency pays the host and bills you inside a monthly fee. If that is you, you have two options. Ask them to transfer the hosting account, or take a full backup and move the site to a host in your name, then point your domain's DNS at it. If the site lives on the agency's own platform and cannot be exported, you are [renting a website](https://www.pavadotech.com/blog/do-contractors-need-a-website-in-2026), and the realistic fix is a rebuild. Before any move, read the guide to [traffic drops after a redesign](https://www.pavadotech.com/blog/website-traffic-drop-after-redesign), because a move that changes URLs can cost you rankings.

## 5. GA4 and Tag Manager

**Get Administrator on the GA4 account and Publish rights in Tag Manager.** Those two control what gets measured and what code runs on your site.

If the agency created your GA4 property inside its own account, it can be moved to yours. Google's [move property guide](https://support.google.com/analytics/answer/6370521?hl=en) says "you must have the Administrator and Editor roles for both the source and destination accounts," so either the agency does it or temporarily gives you those roles. While you are in Admin, check data retention. Google's [retention settings](https://support.google.com/analytics/answer/7667196?hl=en) offer 2 or 14 months for standard properties, and they only affect explorations and funnel reports. Set it to 14 months so your detailed history stops expiring. If you also want to see visits from ChatGPT and other assistants, see why [AI assistant traffic is not showing in GA4](https://www.pavadotech.com/blog/ga4-ai-assistant-traffic-not-showing).

Tag Manager is the one owners forget. Its [permission levels](https://support.google.com/tagmanager/answer/6107011?hl=en) run from Read to Publish, and Publish means "full rights to create versions, workspaces, make edits, and publish." Anyone with Publish can change the tracking, or add a script, on every page of your site without touching the website login. Make yourself Administrator on the account, then remove the agency.

## 6. Google Ads

**Make sure you hold Admin on the account itself, then unlink the agency's manager account.** Your campaign history stays with an account that is yours.

Google says an account that unlinks from a manager "won't lose its own account campaign history or access to any Google Ads features," per its [unlinking guide](https://support.google.com/google-ads/answer/7458428?hl=en). The complication is manager ownership. If the agency's manager account has ownership of your account, Google's [access levels page](https://support.google.com/google-ads/answer/9978556?hl=en) says its admins "can also edit user access, managers, and product links within your account." Ask them to add your email as Admin and release ownership before unlinking.

Two checks before you cut the link: which conversion actions your campaigns count, and who pays. A [Google Ads consultant's handover guide](https://ivitskiy.com/blog/en/google-ads-analytics-account-ownership/) points out that a conversion tag or shared audience supplied from the agency's manager account is the part that can stop working after unlinking. If the ads are billed on the agency's card or invoice, set up your own billing first so campaigns do not stop. If results fell apart after a handover, the checklist in [why Google Ads stopped working](https://www.pavadotech.com/blog/why-did-my-google-ads-stop-working) is the place to start.

## 7. Meta: the account that may not come back

**If the agency created your ad account inside its own Meta business portfolio, you cannot get that ad account back.** You can only be given access to it.

Meta is blunt about this in its [ad account help](https://www.facebook.com/business/help/915885887059947): "If you create a new ad account in a business portfolio, it will permanently be a part of that portfolio. This means the ad account can't be deleted or transferred from the portfolio." Claiming an existing account into a portfolio can do the same.

Meta's [partner access page](https://www.facebook.com/business/help/1717412048538897) adds that a partner with full control "cannot share the business asset with another business – only the organization that owns the asset can share it." In plain terms: whoever owns the portfolio decides.

What you can own: your Facebook Page, your Instagram account, your pixel or dataset if it was created in your portfolio, and the lead lists you download. If the old ad account was the agency's, create a new ad account in your own portfolio, add the agency as a partner if you keep working with anyone, and rebuild audiences from the customer lists you own. If your Meta leads also stopped turning into jobs, the comparison of [Meta lead forms and landing pages](https://www.pavadotech.com/blog/meta-lead-form-vs-landing-page) is worth reading before you relaunch.

## Save a baseline before you cut access

**Export and save everything before you remove anyone, and date it.** If something changes after the split, you want proof and a restore point, not a guess.

The r/SEO thread had a practical warning from a commenter: "a bitter freelancer with FTP or CMS access can plant something small that only shows up weeks later and looks like a random ranking drop instead of sabotage." You do not need to assume bad intent to follow the advice. Save:

- A full website backup from the host, including the database.
- Copies of robots.txt, your sitemap and the canonical tags on your top 10 pages.
- Search Console performance data for the longest date range it offers, and the Links report.
- GA4 traffic and conversion reports for the last 14 months.
- Google Ads change history and the conversion action list.
- Business Profile photos, posts, and your review count on the day.
- Call tracking numbers and who owns them, since [call tracking software](https://www.pavadotech.com/blog/best-call-tracking-software-for-contractors) accounts are often in the agency's name too.

## The cleanup checklist

Run this on the day you remove the agency, in one sitting:

1. **Change every password the agency ever knew,** starting with your email, then the registrar and hosting.
2. **Remove the agency from every account in the audit table,** including old staff logins on the website.
3. **Delete Search Console tokens** listed under Unused ownership tokens.
4. **Check your Google Account's third-party connections.** One r/GoogleMyBusiness commenter wrote that removing the SEO company from their Google Account connections "fixed a similar issue for me." Google's [third-party connections page](https://support.google.com/accounts/answer/13533235?hl=en) is where you review and remove them.
5. **Replace recovery phones and emails** on every account with yours.
6. **Turn on 2-step verification** everywhere it is offered.
7. **Write it down:** a one-page list of every account, the login email, and who has access. Keep it somewhere other than the agency's shared drive.

Got through the checklist and found the agency never set up Search Console properly, or your Business Profile was half filled in? That is the starting point for our audit: we check how Google and AI search currently read your business from the accounts you now own, and show you the fixes in order.

## Can you do this yourself?

**Yes, most of it takes an afternoon plus the 7-day Business Profile wait.** The audit table, the domain move at the same registrar, Search Console, GA4 and Tag Manager are all a few clicks each once you know where to look.

It stops being a DIY job in three situations: the agency refuses and you need the platform dispute processes, the site lives on a platform you cannot export, or the Meta and Ads accounts were built in the agency's own structures and need rebuilding. Before you hire the next provider, check whether the last one was worth what you paid, using [signs your agency is ripping you off](https://www.pavadotech.com/blog/how-to-tell-if-my-marketing-agency-is-ripping-me-off) and [what to pay a marketing agency](https://www.pavadotech.com/blog/what-should-i-pay-a-marketing-agency-as-a-contractor). And write one clause into the next contract: every account is created in your name, and the agency works inside it. A retainer you cannot audit is one of the quieter places [a small business loses money](https://www.pavadotech.com/blog/where-is-my-small-business-losing-money).

The r/SEO owner who was threatened with a competitor got the most useful reply in a single line from another commenter: "Lock those down before you say another word to him." Once the accounts are yours, the threat is just talk. If you want a second opinion on what Google and AI search see once you are back in control, [our GSEO work](https://www.pavadotech.com/gseo) starts there.

## FAQ

### How do I find out who owns my domain name?

Search your domain at ICANN's free lookup tool, lookup.icann.org. It shows the registrar, and the registrant details if they are not hidden by privacy. The registrar is the company you log into to control the domain. If you have never logged in there, the agency's account holds it, and you ask them to move it to an account in your name.

### My agency set up Search Console. Can they get back in after I remove them?

Yes, if they were a verified owner. Google says that to remove a verified owner you must also remove their verification token from the site, such as the HTML file or meta tag they used. Search Console warns you when a removed user still has tokens and lists them under Unused ownership tokens. Delete those, then check the list again.

### Why can't I remove the agency from my Google Business Profile right after I become owner?

Google makes new owners and managers wait 7 days before they can remove other owners or managers, transfer primary ownership, or delete the profile. Plan for it: get added, wait out the 7 days without starting a fight, then take primary ownership and remove the agency.

### Can my agency transfer my Facebook ad account to my Business Manager?

Not if they created it inside their own business portfolio. Meta says an ad account created in a portfolio is permanently part of it and cannot be transferred. The agency can give your portfolio access, but they keep ownership. If that is your situation, create a new ad account in your own portfolio and move the Page, pixel and audiences you own.

### Will I lose my Google Ads history if I unlink my agency?

Not if the account is yours. Google says an account that unlinks from a manager account keeps its own campaign history and access to Google Ads features. What can stop is anything the agency supplied from its manager account, such as a cross-account conversion tag or shared audience lists, so check your conversion actions before unlinking.

### Do I have to transfer my domain to a new registrar?

Usually not. Moving the domain from the agency's account to your own account at the same registrar is faster and keeps your DNS settings, which keeps your website and email running. A full registrar transfer needs an auth code, which your registrar must give you within 5 calendar days, and is blocked for 60 days after certain contact changes.

### What should I save before I remove my agency's access?

Export GA4 reports, Search Console performance data, Google Ads change history and your Business Profile photos and posts. Save copies of robots.txt, your sitemap and your top pages, and a full site backup from the host. If anything changes after the split, you have a dated baseline to compare against.

### Is it illegal for an agency to keep my accounts?

That depends on your contract and where you are, and this post is not legal advice. Practically, most platforms side with the business that can prove it is the business: registration papers, a utility bill, the phone number on the listing. Start with the platform's own ownership process, and bring in a lawyer if the accounts are tied to a billing dispute.