Code ownership is in most contracts and it is nearly meaningless on its own. A repository you cannot deploy is a souvenir.
What matters is whether another competent engineer could take over without calling the last one.
The five things to insist on
The repository, in your account. Not shared with you. Owned by an organisation you control, so access does not depend on a relationship staying friendly.
Infrastructure in your name. Hosting, domain, database, and third-party service accounts billed to you. This is the one that traps people, because moving a running system between accounts is far harder than setting it up correctly on day one.
A deploy anyone can run. Documented, and ideally automated. If shipping a change requires a specific laptop, you do not own the software in any way that matters.
Credentials in your vault. Not in a developer’s password manager. Not in a config file in the repository, which is its own separate problem.
Documentation that answers the 6pm question. Where does it run, how do I deploy, how do I roll back, what breaks first, who do I call.
The test
Ask your current developer what would happen if they disappeared tomorrow. Not as a threat, as a fire drill. The quality of the answer tells you exactly how much you own.
If the honest answer involves a scramble, that is a real business risk sitting in your operations, and it is fixable in a week or two of unglamorous work.
Why we bring it up unprompted
Because we would rather a client be able to leave than feel stuck. Software people cannot walk away from tends to be software they resent, and that is a worse outcome for everyone than losing the account.
Want WordPress to feel handled?
Self-serve onboarding takes minutes. Parameter takes care of the rest — hosting, ops, and improvements when you need them.