A Pretty Website, Zero Traffic, and a Domain She Didn’t Own

A friend sent us a link recently with one line: “Can you look at this? The owner is asking me what went wrong.” The website was lovely. Soft colours, rounded buttons, little illustrated touches everywhere. A product catalogue, a WhatsApp button on every page, buy buttons that sent shoppers to a marketplace store. Everything worked. A Kuala Lumpur agency had built it about ten months earlier, for a small online brand selling a specialist health product. The owner is not a technical person. She had asked for a website that was “SEO-ready”, and she was told it would bring traffic.

One month in, no traffic. Fine, it was new. Three months in, no traffic and no enquiries. The agency said three to six months is normal for a new site. Six months in, the same answer. At ten months, still nothing from Google. So she decided not to renew with the agency. They sent her two things: a domain transfer code and a backup file. Then, in effect: good luck.

Technically, the agency did nothing wrong. A transfer code and a backup are exactly what you are entitled to when you leave. But think about who received them. A business owner who has never logged into a domain registrar now has to find a developer, move a website and transfer a domain before it expires in December. We kept asking ourselves one question: why did she need to transfer anything at all?

This is what we found when we looked, what it teaches, and the three things we tell every client before we build anything. We have left out the business name, the agency name and the product, on purpose. This is not about one agency. It is a pattern every business owner should know how to spot.

Lesson 1: your domain should be in your name, in your account

A domain transfer code (also called an EPP or auth code) only exists because domains sit inside a registrar account, and moving them between accounts needs proof. ICANN, the body that oversees domain names, describes it as “a code created by a registrar to help identify the domain name holder and prevent unauthorized transfers”.^[3]

If the agency had registered the domain in the owner’s name, inside an account she controlled, leaving would have been simple. She would keep paying the yearly renewal herself, and pointing the domain at a new host would be a settings change, not a transfer. No code, no deadline, no stranger needed. Instead, the domain sat in the agency’s account, so leaving the agency meant moving the domain too.

ICANN is clear about whose job a domain is. Its list of registrant responsibilities says: “You will assume sole responsibility for the registration and use of your domain name.”^[4] That responsibility is hard to carry if you can’t log in.

There is also a timing trap. ICANN notes that after changes to the registrant name, organisation or email, a domain is usually locked: “You cannot transfer a domain name to a different registrar within 60 days of making changes to the registrant name, organization or email address”.^[3] Some registrars let you opt out. If you are cleaning up ownership details close to an expiry date, start early.

What we do: we register client domains in the client’s own name or company name, in an account they can log into. If they ever leave us, they keep the domain and simply point it somewhere else.

Lesson 2: know where your website lives, and have a key

The same goes for hosting. You don’t need to manage your own server. You do need to know where your site is hosted, have a login of your own or a named contact who can act for you, and have a recent backup you can actually open. If your web designer disappeared tomorrow, could you name your host? Most of the owners we ask can’t.

Who looks after the hosting matters more than the price. We explain the difference between managed and unmanaged hosting, and what the cheap plans leave to you, in our guide to web hosting in Malaysia (published 14 October).

What we found when we looked (13 October 2026)

We ran a read-only check of the site, the way we would for any new client. To be fair to the agency first: the site works, it looks good, every page has a title and a description, and most of them use sensible search terms. Somebody did think about that part. The problems are underneath.

On the page

What we checked	What we found
Pages in the sitemap	19 (5 pages, 5 product pages, 8 blog posts, 1 category)
Main heading (H1) on the homepage	6 H1 tags in the page code, two of them the same heading repeated
H1 on each product page	4 on every product page
H1 on About, Contact and the blog page	None
Heading order	H2s and H3s used for styling, not as an outline (customer names as headings, the footer copyright as an H2)
Amount of text	About 150 to 350 words on most pages, including menus and footers

Google won’t refuse to rank a page because it has two H1s. But headings are how a page tells readers and search engines what it is about, and four competing “main” headings on a product page means nobody checked. Thin pages and a muddled outline are signs of a site that was designed, not optimised.

Off the page: 1,211 links in a few weeks

This is the part that stopped us. In the backlink index we use, on 13 October 2026, the domain had:

• 1,211 backlinks from 1,190 different domains, for a domain registered in December 2025;
• 1,120 of those links from cheap new domain endings such as .website, .site, .store, .online, .shop and .space; the ones we sampled were automatically generated “website checker” and “SEO tool” pages;
• 151 links at the end of September, and 1,211 by 12 October: more than 1,000 appeared in under two weeks;
• a third-party spam score of 53 out of 100 for the link profile;
• no Google rankings in Malaysia for any search term in our ranking data.

We can’t tell from the outside who created those links or why, and we won’t guess. Pages like these sometimes appear on their own. But a thousand links in two weeks from throwaway domains is also exactly what a bulk “backlink package” produces. Google’s spam policies define link spam as “the practice of creating links to or from a site primarily for the purpose of manipulating search rankings”, and list “Buying or selling links for ranking purposes” and “Using automated programs or services to create links to your site” among the examples.^[2] Links like these don’t build trust with Google, which mostly ignores them. A domain whose only links look like this has, in practice, no reputation at all.

If you have paid someone for SEO, you are entitled to ask a simple question: which links did you build, and where? A real answer is a list you can click through. Our guide to backlinks in Malaysia explains what good links look like.

Lesson 3: anyone who promises traffic is selling hope

Google says it plainly in its own guide to hiring an SEO: “No one can guarantee a #1 ranking on Google. Beware of SEOs that claim to guarantee rankings, allege a ‘special relationship’ with Google, or advertise a ‘priority submit’ to Google.”^[1] The same page says: “If they guarantee you that their changes will give you first place in search results, find someone else.”^[1]

“Three to six months is normal” is true, as far as it goes. Our own guide to how long SEO takes says the same. But “wait” is only an honest answer when work is actually being done while you wait: pages improved, content added, real links earned, and a monthly report you can check. Waiting on its own is not a strategy.

Our view: an agency can sell beautiful websites without selling SEO, and that is a perfectly honest business. The problem starts when “SEO” is in the quote and nobody can show you what was done.

Lesson 4: design for the customer you actually have

One more thing, and it’s our opinion rather than a measurement. The product is mostly bought by adults living with a long-term health condition, and by parents of children who have it. The site looks like a baby shop. Cute, but it speaks to the wrong person. An adult who has been dealing with a painful condition for years wants to feel understood and reassured, not like they have wandered into a nursery. Good design starts from who is buying and how they feel when they arrive, not from what looks nice in a mock-up.

What the agency got right

It is worth saying. The site works on phones, the catalogue is easy to use, the WhatsApp and buy buttons are where a shopper expects them, and every page has a title and a description. When the owner left, she got her transfer code and her files without a fight. Plenty of small businesses in Malaysia never get that much. The lessons above are about what was missing, not about a bad website.

What not to do

• Don’t let anyone register your domain in their own account. Ask for it in your name or your company’s name, with a login you hold.
• Don’t sign an SEO quote that promises traffic or rankings. Ask what work will be done each month, and how you will see it.
• Don’t accept “wait a few more months” without a report. Waiting is only reasonable when work is visible.
• Don’t buy link packages, and don’t let anyone buy them for you.
• Don’t leave a provider in the last month before your domain expires. Transfers take time, and ownership changes can lock a domain for 60 days.

Check it yourself: five minutes, no technical skills

1. Who holds your domain? Search your domain on ICANN’s free lookup tool. Note the registrar and the expiry date. Don’t expect to see your own name: for most domains the owner’s name, company and email show as “REDACTED FOR PRIVACY”, so the lookup can’t prove the domain is yours. The real test is a login: can you sign in at that registrar and see the domain in your account? If not, ask whoever holds it, in writing, whose name and email are on the registrant record.
2. Where is your site hosted? Ask your web designer for the host’s name and how you would log in. Write it down somewhere other than your email.
3. Do you own your Search Console? Google Search Console is free. You should be an owner of your site’s property, not just someone who receives screenshots.
4. Is Google showing your pages? Type site:yourdomain.com into Google. If almost nothing comes up after several months, ask why.
5. What links were built? If you pay for SEO, ask for the list of links built last month. If there isn’t one, that is your answer.

Frequently asked questions

Who should own my website domain?

You, or your company. The domain should be registered in your name or your company’s name, in a registrar account you can log into. Your web designer can manage it for you, but it should never sit only in their account.

What is an EPP or transfer code?

It is a code the current registrar creates so a domain can be moved to another registrar safely. You only need one when the domain moves between registrar accounts. If the domain is already in your own account, changing web designer or host usually needs no transfer at all.

Can an SEO company guarantee traffic or first place on Google?

No. Google’s own guide to hiring an SEO says “No one can guarantee a #1 ranking on Google” and warns against anyone who claims to. An honest agency will explain the work it will do and how you can check it, not promise a result.

Are cheap backlink packages bad for my website?

They don’t help, and they can hurt. Google’s spam policies list buying links and using automated services to create links as link spam. Links from throwaway “checker” pages give your site no real reputation, and they leave you with a profile you may later need to explain.

Not sure what you own?

Send us your website. We will check who holds your domain and when it expires, where the site is hosted, whether Google is showing your pages, and what your backlink profile looks like, and reply in writing in plain language. No call, no pressure. Request a free written review, read how a proper SEO audit works, or see what our SEO services include, and what they don’t promise.

References

1. Google Search Central, “Do you need an SEO?”, last updated 5 June 2026. Accessed 13 October 2026.
2. Google Search Central, “Spam policies for Google web search”, “Link spam”, last updated 28 August 2026. Accessed 13 October 2026.
3. ICANN, “FAQs for Registrants: Transferring Your Domain Name”. Accessed 13 October 2026.
4. ICANN, “Registrants’ Benefits and Responsibilities”. Accessed 13 October 2026.
5. Total Web Solutions records: read-only check of the site on 13 October 2026 (sitemap, page titles, descriptions and headings); the public domain registration record (registered December 2025, expiring December 2026); backlink index and ranking data for Malaysia, 13 October 2026. The business and the agency are not named at the owner’s request.