What website access should a business owner keep?

The checklist below is long, but it rests on a few ideas that apply to every account.

• Named people, not shared logins. Each person who needs access gets their own account where the service allows it. A shared password cannot be withdrawn from one person without changing it for everyone, and nobody can tell afterwards who made a change.
• Only the access the job needs. Someone who updates content does not need to be able to transfer the domain. Most services offer roles; use the lowest one that does the job.
• Multi-factor authentication everywhere it is offered. An authenticator app or a hardware security key is stronger than a code sent by text message.
• Recovery details the business controls. The email address and phone number used to recover an account decide who can take it over. They should belong to the business, not to a supplier or one person's personal inbox.
• Remove access that is no longer needed. When a project ends or someone leaves, their access should end too, and the removal should be recorded.

For each category, the first list is what the business should hold or know. Where a provider operates something for you, that is fine, provided you can tick the "know" items and the arrangement is written down.

1. Domain

The domain is the part every other recovery depends on, so this is the one category where the business should hold the account itself.

• Which registrar the domain is with
• That the business is the registrant, in an account in the business's name
• A working sign-in, tested recently, without asking anyone
• Multi-factor authentication on the registrar account
• Recovery email and phone that belong to the business
• The renewal date, and that auto-renew is on with a payment method that will not expire unnoticed
• Who receives renewal and expiry notices

2. DNS

DNS decides where your website and email point. It is often hosted somewhere other than the registrar, such as Cloudflare or your hosting company.

• Which company hosts the DNS (the nameservers show this)
• Whose account the DNS sits in, and who can change it
• A current copy of every DNS record, kept somewhere the business can reach
• Which records your email depends on, so nobody deletes them by mistake
• Who makes DNS changes, and how changes are recorded

Changing DNS does not always need registrar access. Our guide to who owns your business website explains how the registrar, nameservers and DNS fit together.

3. Hosting and platform

• Where the website runs: the company and the product
• Who pays for it and who receives the bills
• Who administers it, and whether the business has any administrative account
• How changes reach the live website, and who can make them
• What happens to the hosting if you leave the provider

4. Source code

Not every website has source code the business can hold. Some website builders do not let you export the site at all, which is worth knowing before you choose one.

• Where the code is kept, for example a Git repository, and in whose account or organisation
• That the business holds a recent copy, or has a written right to one
• What the contract says about ownership of the code and any parts the provider licenses to you
• How the code is deployed to the live website

5. Analytics and search

• Google Analytics: a business account with administrator access
• Google Search Console: a business account as a verified owner
• Google Business Profile: a business account as owner
• Any other tracking or advertising tools, and who set them up
• That no former employee or past supplier is the only owner of any of these

6. Third-party services

Websites usually depend on more services than anyone remembers. List each one.

• Email provider, and the admin account for it
• Form handling and where enquiries are delivered
• Booking systems and online ordering
• Payment providers
• CDN or security services, such as a web application firewall
• APIs, plugins and integrations, and whose accounts they run under

7. People

The final category ties the others together. Keep a simple access register, even a single page, that records:

• who has access to each account
• why they have it
• what level of access they have
• whose details are used for recovery
• what happens to their access when the relationship or employment ends
• when the register was last reviewed

When a supplier relationship ends or a person leaves, work through the register in this order:

1. 1. Confirm the business can sign in to each account before removing anyone, so you do not lock yourself out.
2. 2. Take a copy of the DNS records and anything else you would need to rebuild.
3. 3. Remove the person's account or role, rather than sharing a new password with everyone else.
4. 4. Change any shared credentials they knew, and check the recovery email and phone on each account.
5. 5. Revoke API keys or access tokens created for them.
6. 6. Record what was removed and when.

If you are moving to a new supplier, our guide to moving your website to a new provider covers the handover. If you are in the harder situation where the supplier cannot be reached at all, our guide to what to do if your web designer disappears covers recovery step by step.

Review the register when anything changes: a new supplier, someone leaving, a new service connected to the website. Otherwise, once a year is a reasonable rhythm for a small business. The test is simple: could the business sign in to each account today, and does everyone with access still need it?

On Dettogni's services, the domain and registrar account stay with the client, and registrar changes are made by the client from written instructions, or through limited delegated access where the registrar offers it.

• Who actually owns your business website?
• How to move your website to a new provider
• What happens if your web designer disappears?

All resources