My preferred method back in my freelance days was to have a few clauses in my standard contract about copyright -- basically laying out that I wasn't doing work

My preferred method back in my freelance days was to have a few clauses in my standard contract about copyright -- basically laying out that I wasn't doing work-for-hire, and would retain copyright in anything I produced, with an agreement to transfer copyright to the client upon receipt of payment. That gives a nuclear-option threat of filing a DMCA takedown; telling a client that you can legally have their site turned off within 24 hours is a lovely piece of artillery to have in your back pocket, and since the actions are all taken by their hosting provider there's no possibility of "unauthorized access" charges coming back at you.