Squarespace became a major registrar when it took over Google Domains registrations during 2023 and 2024. A large share of the “Squarespace stole my domain” messages we receive trace back to that migration rather than to any theft. The domain is usually intact. What has gone wrong is that the owner no longer knows which account controls it, the Google account it was tied to has been closed, or a site builder registered it under their own login. This guide explains how to confirm where the domain lives, how to tell an account mismatch from genuine domain hijacking (the unauthorized transfer or control of a registered domain), and what to ask Squarespace for. It sits within our domain hijacking hub.
What people usually mean when they say Squarespace stole the domain
The domain is in a different account than expected
Google Domains registrations were migrated into Squarespace accounts keyed to the Google account that owned them. If the domain was registered under a personal Gmail address, a former employee’s account, or a Workspace account managed by an administrator, the Squarespace account that now holds it may belong to someone other than the person who considers themselves the owner. Logging in with the wrong credentials shows no domain at all, which looks like theft.
The Google account was closed
Some owners deleted or lost the Google account during or after the transition. The domain still exists at Squarespace; the login that unlocks it does not. This is an access problem, not a change of ownership, solved through identity verification rather than a transfer dispute.
The registrar account was compromised
Genuine hijacking does happen. An attacker who phishes the Squarespace or Google credentials can log in, change the contact email, and transfer the domain to another registrar, and the registrar processed an authenticated request. Our page on what domain hijacking is describes the pattern.
A developer or agency holds the domain
Squarespace is a site builder first, and many businesses hired a freelancer who registered the domain and built the site inside their own account. When the engagement ends, both stay with the freelancer; see our post on recovering a domain held for ransom by a web developer.
The registration expired
Auto-renewal settings and payment cards did not always carry over during the migration. Under ICANN’s Expired Registration Recovery Policy, registrars must send two expiration notices, roughly one month and one week before expiration, plus a further notice within five days after, and gTLD registries must offer a 30-day Redemption Grace Period after deletion, according to the ICANN ERRP redline of February 2024. If those notices went to a dormant Google address, the first sign is a parking page. That is expiration, handled through our expired domain name recovery service.
How to tell which situation you are in
Start with an RDAP lookup (RDAP, the Registration Data Access Protocol, is the structured successor to WHOIS). The registrar field answers the first question: if it shows Squarespace, the domain made the migration and sits in some Squarespace account. If it shows a different registrar and the updated date is recent, the domain has been transferred out; treat it as a hijack. The creation date confirms whether this is your original registration. The status codes finish the picture: clientTransferProhibited means the domain is locked in place, pendingTransfer means a transfer is under way, and redemptionPeriod or pendingDelete means it expired. A domain still at Squarespace, locked, with your original creation date, has not been stolen.
What to do at Squarespace for each scenario
For an account mismatch, work out which Google identity the domain was registered under. Search old inboxes for Google Domains receipts, check whether a Workspace administrator can see the domain, and ask any former staff member whose account may hold it. Once you find the right login, the domain appears and can be moved to your own account.
For a closed Google account, use Squarespace’s account recovery channel, which, like most registrars, verifies identity before restoring access. Have the receipts and the original email address ready.
For a compromised account, recover the account first, then report the unauthorized transfer through Squarespace’s support and abuse channels, stating the date you lost access and requesting a transfer reversal. If the domain left Squarespace, Squarespace is the losing registrar and the party able to contact the gaining registrar.
For a developer dispute, Squarespace will not move a domain between accounts on your word alone, because to the registrar the developer is the registrant. The paths are a transfer by the developer, a negotiated purchase, or a legal claim on your contract and trademark rights.
For expiration, renew if the domain is still renewable, or ask Squarespace to restore it during the grace period.
Escalating beyond the registrar
When a domain has been transferred away, ICANN’s Transfer Policy requires each registrar to staff a Transfer Emergency Action Contact (TEAC), and a human at the gaining registrar must respond within four hours, though final resolution may take longer, according to the ICANN Transfer Policy Review working group’s TEAC and TDRP slides. Only the losing registrar can open that channel. Registrars undo a transfer between themselves with the Transfer Undo Request Form; our guide to the TURF agreement explains how. If the registrars disagree, the Transfer Dispute Resolution Policy (TDRP) allows one registrar to file against the other, but no later than twelve months after the alleged violation, per the ICANN TDRP text. Our step-by-step guide to recovering a stolen domain name covers the full sequence.
Evidence to preserve
Save the Google Domains receipts, the migration notices Google and Squarespace sent, and any email naming the Google account that held the domain. Screenshot the RDAP record now and again daily, because registrar and status fields change as a transfer completes. Keep login alerts and suspected phishing messages. For a developer case, keep the contract and invoices showing the domain was bought for your business.
How DNAccess helps with a Squarespace domain
DNAccess has recovered hundreds of stolen domain names, and the Google Domains transition has added a new category of work: tracing which account a migrated domain landed in and returning it to the business that paid for it. For hijacks we handle registrar correspondence, TEAC and TURF requests and, where needed, litigation through our stolen domain name recovery service. Afterward we lock it down following our guides on registrar account security and how to prevent domain hijacking. Contact us for a confidential assessment.
We have written the same guide for GoDaddy, Namecheap, Cloudflare and Google Workspace.