How to check where your website is really hosted

Two minutes of looking will tell you most of it. A whois search says who your domain is registered with and whose name is on it. A nameserver lookup says who controls where the domain points. An address lookup says which company’s server the website is answering from. Those are three different companies surprisingly often.

And if the answer turns out to be “it is all sitting in an account belonging to the lad who built it in 2016”, we hear that one a lot and it is fixable. There is a section on it further down.

The question underneath the question

When somebody asks where their website is hosted, they usually want to know one of these, and it pays to be clear which:

• Who do I pay, and whose account is this in?
• Which company can change where my domain points, today, without asking me?
• Whose machine is actually serving the pages?

The middle one is the one that matters in an emergency. Control of DNS is control of your website and your email, and it can sit somewhere entirely separate from both the registrar and the server.

Start with whois

For a .uk domain, Nominet runs a public lookup on its own site. For .com and the rest, ICANN runs one. Type in your domain and read what comes back.

You are looking for the registrar, which is the company the name is registered through, and the expiry date, which is worth writing on a calendar today. On a .uk domain you may also see the registrant name, which is the legal owner of the domain. If that name is not your company, deal with it now rather than the week you want to move.

Personal details are usually hidden by privacy rules, so a blank contact field is normal and not a sign of anything sinister. The registrar name is the useful part, because that is who can lift the lock on the domain and start a transfer.

Then the nameservers

Nameservers are listed in the same whois result, or you can ask directly. On Windows, open a command prompt and type nslookup -type=ns yourdomain.co.uk. You will get back two or more names.

Read the middle of those names. If they look like ns1.somecompany.com, then somecompany is holding your DNS, and whoever has the login to that account can move your website and your email wherever they like without asking you. If they mention Cloudflare, your records are in a Cloudflare account, which may be yours, your agency’s, or your old developer’s.

This is the single most useful thing on the page. Plenty of businesses discover here that the company they pay every month for hosting has no ability to change anything about their domain. It is also the point at which people start asking what their host is actually responsible for, which we have set out in what a host owes you and what it does not.

Then the address the site answers on

Now find the A record, which is the numeric address your domain points at. nslookup yourdomain.co.uk will show it.

Take that number and look it up on a whois service in its own right. What you get back is the company that owns the block of addresses, which is usually the data centre or network provider rather than the host you buy from. A great many hosting companies rent space and machines from somebody larger, so the name you see may be an unfamiliar one even when your host is exactly who you thought.

If several unrelated websites answer on the same address, you are on shared hosting. If the address serves your site and nothing else, it is more likely a server or a slice of one that belongs to you.

Email lives somewhere else entirely

The MX record answers a separate question: which server accepts mail for your domain. Look it up with nslookup -type=mx yourdomain.co.uk.

Records mentioning Google or Microsoft tell you the mail is on a big platform and is nothing to do with your website host. Records pointing at the same company as your hosting mean the two are tied together, which is worth knowing before anybody starts moving servers about. Untangling those two is a common reason people ring us, and our email hosting page explains how we separate them when you ask.

When Cloudflare is in the way

If Cloudflare is proxying your site, the address lookup returns Cloudflare and goes no further. The real server is behind it and deliberately hidden, which is the point of the service.

You are not stuck. The MX record almost always still points at the real mail server, which usually gives away the hosting company. So does the login screen for the control panel if you can find its address. Failing that, an old invoice or the welcome email from when the site was set up will name them, and those emails are usually still in somebody’s inbox.

Fingerprints, when the lookups go quiet

• Try adding /cpanel or :8443 to your domain in a browser. A cPanel or Plesk login screen appearing tells you what the server runs, even if you have no password.
• Look at your bank statement or accounting software for the last year and search for hosting-shaped payments. The name on a direct debit settles a lot of arguments.
• Search the company mailbox for words like renewal, invoice, domain and expiry. Hosts send renewal reminders relentlessly, and one of them will be sitting in an inbox somewhere.
• Check the SSL certificate in your browser. It sometimes names the provider that issued it, which narrows the field.

“It’s in my old developer’s account”

Somebody built the site years ago, bought the domain on their own card, put the hosting under their own reseller account, and the business has been paying them a small amount ever since without ever holding a login. It comes up often enough that it has stopped surprising us.

Usually it is not malice. It is how a lot of small web work was done, and most developers hand things over politely when asked. Start there. Ask for the registrar login or a domain transfer, a copy of the files and database, and the DNS records. Be pleasant about it. Pleasant gets you a reply.

If there is no reply, your route back in depends on the registrant name. If the domain is registered to your company, the registrar can help you regain access to the account, and for .uk domains Nominet will investigate registrant details it has reason to believe are wrong. Its Dispute Resolution Service is a separate route, for arguments about who holds the rights to a name. Both are slow, and both are a last resort. If the domain is registered to the developer personally, you are in a weaker position, which is exactly why the whois check is worth doing today rather than in a crisis. Our domain names page covers getting names back into your own account.

Whatever happens, take your own copy of the site while you still have any access at all.

Write it down while you know it

Once you have the answers, put them somewhere the business can find them: registrar and login, who holds the DNS, the hosting company and account, where the mail is, the SSL, and every renewal date. One page in a shared drive is enough.

We ask for that page whenever somebody moves to us, and it is rare that one already exists. The businesses that have it are the ones who have already had one bad week and decided never again.

Where is my website hosted FAQs

We will run the lookups for you

Send us the domain name. We will run all three lookups and write the answers up as the one page this article says you should have: registrar, DNS, host, mail, SSL, and when each of them next falls due. That page is yours to keep whatever you decide to do next. If you do bring the lot under one roof afterwards, managed hosting on UK servers starts at £1 a day + VAT and the untangling comes as part of it rather than as an extra.