If the person who built your website stopped answering their phone tomorrow, could you change your own opening hours?
For a lot of small businesses the answer is no. Not because anyone did anything wrong on purpose. It’s because the site was set up years ago by a nephew, a friend, or a designer who was helpful at the time, and every account got made in their name, on their email, with their card. It worked fine until it didn’t.
How it goes wrong
The details vary. The shape doesn’t.
The designer disappears. They moved on, changed careers, or just got busy. The website is on their hosting account. The only login to change anything is theirs. The business can’t update a price, add a holiday closure, or take down the staff page for someone who left two years ago. The site keeps running, frozen, until the designer’s card on the hosting account expires, and then it goes too.
The domain lapses. The domain name was registered by whoever set things up, on their email address. The renewal reminders go to an inbox nobody at the business can see. The card on file expires. The domain lapses, and with it the website and the business email, because both depend on that name. If it isn’t recovered in time, it goes back on the open market, where anyone can buy it. Some people buy expired business domains on purpose because they still get traffic.
The fall-out. A business partner, a former employee or a marketing agency set things up, then the relationship ends badly. Now they hold the keys, and getting them back means lawyers or begging.
The forgotten email. Everything was registered with an address like info@ or an old personal Hotmail, which nobody can log into any more. Password resets go there, so the business locks itself out of its own accounts.
The common thread: the business never owned the pieces. It rented them through someone else.
The pieces, in plain words
A website isn’t one thing. It’s four or five things from different companies, held together by settings. Knowing what each is makes the rest of this easy.
The domain name is your address, like yourbakery.com. You don’t buy it outright. You rent it by the year from a company called a registrar (well-known ones include GoDaddy, Namecheap, Squarespace Domains and Cloudflare). Whoever is listed as the “registrant” in that registration is the legal holder of the name. That’s the single most important line in this whole article.
DNS is the signpost system that says where the domain points: this is where the website lives, this is where the email goes. It’s a list of settings, usually kept at the registrar, sometimes at a separate service. Whoever controls the DNS controls where your customers end up and where your email is delivered.
Hosting is the computer your website actually lives on. If you use Squarespace, Wix, Shopify or similar, the hosting comes with it. Otherwise it’s a separate hosting company. The hosting account is where the bills go and where the site can be switched off.
The site’s admin is where you log in to change words, photos and prices. On Squarespace or Wix, it’s the same account as the hosting. On WordPress or a custom-built site, it’s a separate login inside the site itself.
Email at your domain (you@yourbakery.com) is usually a separate service again, most often Google Workspace or Microsoft 365. It depends on the domain and the DNS. If either goes wrong, your email stops.
And alongside the website, a few accounts that matter just as much: your Google Business Profile (the box with your hours, map pin and reviews that shows up when people search for you), your social media pages, and any booking or payment system.
Whose name should be on each one
Yours. Specifically, the business’s, or yours as its owner. Every one of them.
That means:
- The registrant on the domain is your business name, with an email address you control.
- The hosting account is opened in your name, with your card.
- The site’s admin has an account for you at the highest permission level, often called Owner or Administrator.
- Google Business Profile lists you as the primary owner.
- The email service has you as an admin.
A designer, developer or agency can still do all the work. They should do it on your accounts, with their own logins that you gave them. That’s the difference between a helper and an owner, and it costs nothing to set up properly at the start.
A good test of anyone who builds sites: ask them whose name the domain and hosting will be in. “Yours” is the only right answer. If they hesitate, or say it’s easier if they keep it, that tells you something.
The email address everything hangs on
Every account above has a recovery email. That’s where password resets go, where renewal warnings go, and where the “someone just tried to log in” alerts go. If it’s someone else’s address, they effectively own the account, whatever the name on it says.
Use one address you will have for as long as the business exists, and that more than one trusted person can get into if you’re in hospital. Many owners use their own main email. Some create a dedicated one for exactly this. What matters is that it isn’t the employee who might leave, or the designer, or an address at the very domain you’re trying to protect. If the domain lapses, an email address at that domain stops working at the worst possible moment, and the renewal warnings were going to it.
Turn on two-step verification everywhere you can, and make sure the phone number or authenticator app it uses is yours too. Write down the backup codes and keep them somewhere safe and offline.
Audit what you have today
Do this today (five minutes). Look up who holds your domain. Go to ICANN’s free lookup tool at lookup.icann.org and type in your domain. It’ll show the registrar and the expiry date. The registrant’s name is often hidden behind a privacy service now, which is normal and fine. But you’ll know which company holds it and when it expires. If you don’t recognize the registrar, or the expiry date is close and you’ve never paid a renewal bill, start the checklist below this week.
Then, for each piece, find out three things: which company, whose account, and can you log in right now. Not “I think I have the password”. Actually log in.
- Domain. Which registrar? Can you log in? Is the registrant your business? Is it set to auto-renew, with a card that won’t expire before the renewal date?
- DNS. Is it at the registrar or somewhere else? Can you log in there too?
- Hosting. Which company? Whose card is paying? Can you log in?
- Site admin. Can you log in and change something small, like a sentence on the contact page? Is your account the top-level owner?
- Email. Who is the admin on your Google Workspace or Microsoft 365 account? Is it you?
- Google Business Profile. Are you listed as the primary owner? (It’s in the profile’s settings, under people and access or managers, depending on the version.)
- Social media, booking, payments. Same three questions for each.
- Recovery emails and phone numbers on every account above are yours.
Write the answers down: the company, the login email, where the password is. A password manager is the best place for that. Most of them also have a way to leave access to a trusted person in an emergency.
Getting access back
If you find a gap, it’s usually fixable. Start with the friendliest route.
Ask the person who set it up. Most of the time they’ll gladly hand it over, and they’re often relieved to stop being responsible for it. Be specific about what you’re asking for: “please change the registrant on the domain to my business name and my email,” or “please add me as an Owner on the hosting account, then remove yourself.” Do it while you’re on good terms. It’s much harder after a falling-out.
For a domain, if they won’t or can’t help, contact the registrar directly. Registrars have processes for proving who should hold a domain, and having your business registration, invoices showing you paid for the site, and the domain matching your business name all help. It isn’t quick, and every registrar handles it a bit differently. If the domain is about to expire, act now. After a domain expires there’s usually a grace period for renewing, then a redemption period where getting it back costs much more, and then it’s released to anyone. The exact timing depends on the registrar and the ending (.com, .net, a country code), so check with yours rather than trusting a rule of thumb.
For a Google Business Profile that someone else claimed, Google has a “request access” process when you search for your business while signed in. If the current owner doesn’t respond within a set time, you may be able to claim it yourself.
For hosting and the site itself, if you have no way in at all, it can be quicker to rebuild than to recover. That’s a frustrating answer and sometimes the right one. If you still control the domain, the new site can go live at the same address and your customers won’t notice. The domain is the piece you can’t easily replace. Protect it first.
If someone is holding your accounts hostage for money or out of spite, talk to a lawyer. If it’s a domain that matches a trademark you hold, there’s a formal dispute process called the UDRP, run through approved providers. It costs money and takes time, so it’s a last resort, not a first one.
Giving access without giving it away
You’ll always need help from someone: a designer, a marketing person, a nephew. Here is how to let them in without handing over the business.
Invite them; don’t share your password. Almost every service now has a way to add a second person with their own login: hosting companies, website builders, Google Business Profile (as a “manager” rather than an owner), Google Workspace and most registrars. GoDaddy calls it Delegate Access; Cloudflare calls them Members. Use it. When they leave, you remove one person and change nothing else.
Give the lowest level that does the job. Someone writing blog posts doesn’t need to be able to delete the site. Someone fixing a broken page doesn’t need billing access. Most services have roles like editor, manager, admin and owner. Owner stays with you.
If a password really must be shared, share it through a password manager’s sharing feature, not a text message, and change it when the work is done.
Get it in writing. If you hire someone to build or run your site, the agreement should say plainly that the domain, the accounts, the content and the code belong to your business, and that they’ll hand over everything when the work ends. One sentence covers it.
Do a quick review once a year. Pick a date you’ll remember, like when you renew the domain. Look at who has access to each account. Remove anyone who no longer needs it.
The honest part
None of this is exciting, and it’s easy to put off because nothing is broken today. The trouble is that you find out you don’t own your website on the worst day to find out: the day it goes down, the day the domain lapses, or the day you need to change something urgently and can’t.
An afternoon now saves that day. Log in to everything, put your name on everything, and write down where it all is. My own sites are built on accounts in the client’s name from day one. It’s no extra work for me, and it means the site is theirs whatever happens between us. Whoever builds yours should be glad to do the same.