Research brief: Owning your stack — why agency-managed platforms cost more than they save (piece 4 of 15)

Status: Research material — not a finished article. Compiled May 22, 2026.

TL;DR

• "Ownership" in 2026 is a layered claim — domain, DNS, code, content, data, infrastructure, analytics, and customer relationships each live in different places, and most small businesses unknowingly cede control of three or four of those layers to their agency or platform.
• The lock-in costs are not theoretical: roughly 9 of 10 web migrations fail to improve SEO (single-source — flag), 50% organic traffic loss is common, and the average post-migration recovery is 523 days (Search Engine Journal study of 892 domain migrations, Jan 2025). One UK retailer lost ~£3.8M in the first month of a botched migration.
• The WP Engine / Automattic dispute (Sept 2024 → ongoing), Shopify's forced sunset of checkout.liquid (Aug 13, 2024 / Aug 28, 2025 / June 30, 2026), and Squarespace's absorption of Google Domains (Sept 7, 2023, $180M) are three live case studies that prove platform "ownership" is conditional.
• The defensible position for a small business is not "build everything custom" but a small, boring, portable stack: own the registrar account under the business's own name as the Registrant, own the Git repo, use open content formats, keep an exportable database, and treat any platform that can't produce a clean export as a hostage situation in slow motion.

Decomposition

Strongest atomic claims and case studies are filed as their own entries, linked below. The Ownership Checklist (the practical deliverable) lives at Ownership Checklist: what an SMB must be able to walk away with at agency separation. Recommendations are filed as rule entries.

Honest gaps and caveats

• The "9 of 10 migrations fail" framing is single-sourced (Numen Technology blog citing unnamed analysis). Lead public-facing writing with the 523-day stat instead — it's the SEJ 892-migration study and is the stronger evidence. See "9 of 10 web migrations fail" — single-sourced (Numen Technology); use 523-day SEJ stat instead vs [[sej-892-migrations-523-day-recovery]].
• Domain-hostage cases are pattern-documented but rarely litigated. Describe the pattern; don't overstate prevalence.
• The WP Engine / Automattic case is in motion through 2026; specific procedural details cited should be flagged with "as of [date]."
• Candid Creative's own stack (Cloudflare Tunnel, self-managed VM) has real Cloudflare-specific dependencies that should be acknowledged, not glossed.
• Page builders are not uniformly bad anymore — Divi 5's block format and Elementor's Gutenberg interop suggest the category is fixing its lock-in problem. The strongest "shortcode lock-in" argument applies to legacy installs.
• GDPR Art 20 portability is narrower than commonly assumed. It covers personal data, not website content / SEO rankings / plugin config.
• The Doctorow framing is rhetorical, not empirical. Some platforms (Stripe, Cloudflare, Postgres, Linux) have not enshittified despite being enormous. Use as a diagnostic, not a law.

Editorial direction (for the public piece)

1. Lead with a concrete recent event (Shopify checkout.liquid sunset or ACF takeover), not the framework. Doctorow framing arrives on page 2.
2. Treat the Ownership Checklist as the deliverable. Most readers will scan, save the checklist, and act on it.
3. Stage recommendations by audience (under-5-year sites, Wix/Squarespace owners, WordPress + page builders, new builds).
4. Honest "owned stack" pricing for an SMB: $30–$80/month in infrastructure (Postgres + small VM + Cloudflare + registrar + Workspace) + a maintenance retainer that reflects real operational work. Don't undersell the retainer — that's where the operational-risk counter-argument lives.