How to Find Who Owns a Website

You can look up who registered a domain, but not always who runs the site. Registration data is public through RDAP, the successor to WHOIS — but for individuals the contact details are withheld under data protection law, and a domain’s registrant is not necessarily the person publishing on it. For UK companies, the more useful trail usually runs through Companies House. Last reviewed 6 September 2026.

Use RDAP to check domain registration data

RDAP — the Registration Data Access Protocol — is the standard replacement for WHOIS and is what registries now serve. Every registry and registrar operates an RDAP service, and lookups are free.

The practical routes are ICANN’s own lookup tool, which queries RDAP for most generic domains, or the relevant registry directly: Nominet for .uk, and the registry for whichever suffix you are checking.

What you get back is registration data — who the domain is registered to, when, through which registrar, and the name servers it points at. What you do not get is anything about the site’s content, its business, or who writes it.

What registry lookup data can show

A typical record shows the registrar, the creation, updated and expiry dates, the domain status codes, and the name servers.

The dates are often the most useful part and the least used. A creation date tells you how long a domain has existed, which is a quick sanity check against a site claiming decades of trading. Status codes such as clientTransferProhibited or serverHold tell you whether the domain is locked or suspended.

Name servers indicate who hosts or fronts the site — a Cloudflare name server, for instance, tells you the site sits behind Cloudflare and that the underlying host is deliberately not visible.

Why registrant details may be hidden

Since the GDPR came into force in 2018, registries and registrars have withheld personal contact data from public registration records by default. Before that, WHOIS commonly showed a registrant’s name, address, telephone number and email.

The rule of thumb now: individuals are redacted, organisations often are not. A domain registered to a limited company frequently still shows the company name; one registered to a person usually shows nothing but the registrar and a relay address.

Separately, many registrars sell privacy or proxy services, which substitute the proxy’s details for the registrant’s even where disclosure would otherwise apply. A record naming a privacy service tells you the owner chose not to be listed — which is lawful, common, and not in itself suspicious.

How .UK domain lookup works

Nominet runs .uk and its WHOIS service behaves differently from the generic registries, in a way that matters.

Nominet distinguishes registrants who are non-trading individuals — whose details are withheld on request — from those registered for business purposes, whose registrant name is shown. So a .uk domain used for a business is more likely to name its holder than a .com is.

Nominet also operates a data quality policy: registrant details must be accurate, and domains with demonstrably false details can be suspended. That gives .uk records more evidential weight than many suffixes, though Nominet does not verify every registration at the point of sale.

UK-registered companies must in any case publish their company name, number and registered office on their website under the Companies Act — so for a British business, the site’s own footer is often a faster route than any lookup.

When to use registrar or company records

For anything commercial, go to the company records rather than the domain records.

Companies House gives the registered office, directors, accounts and people with significant control — free, and far more informative than a redacted RDAP entry. Match the company named in the site’s footer or terms of service to its filings. Regulated firms appear on the FCA Financial Services Register, and charities on the Charity Commission register.

If you need the registrant’s identity and it is withheld, the routes are narrow: registrars disclose to law enforcement and in response to court orders, and a civil claimant can apply to a court for disclosure. Sending a request to the registrar’s abuse contact is appropriate for reporting abuse; it is not a way to obtain someone’s identity.

Privacy and data limitations

Four limits are worth holding on to.

The registrant is not necessarily the operator. Domains are held by agencies, developers, holding companies and former owners. A name on a registration is a lead, not a conclusion.

Historic WHOIS data is not authoritative. Commercial services sell archived records from before 2018; they may be accurate, stale, or wrong, and using them to identify a person who is now protected sits uncomfortably with the reason the data was withheld.

Hosting lookups show intermediaries. An IP address usually resolves to a CDN or host, not to the publisher.

And redaction is the lawful default, not evasion. Most withheld records belong to ordinary people who registered a domain for a personal site. Treating absence of a name as evidence of bad faith is the commonest error made with these tools.