Your business should have documented control of the accounts it depends on, including its domain, hosting and website administration. Suppliers can have the access needed to do their work. Agree ownership, billing, permissions and recovery arrangements before a build starts, then verify the handover rather than relying on a list of passwords.
Separate ownership from day-to-day access
The person who updates the website does not necessarily need to own the domain account. Equally, the business owner does not need to make every technical change personally.
Write down who controls each service and who has permission to work in it. Where a platform supports individual users and roles, use them. Shared logins make it harder to remove one person’s access without affecting everyone else.
Contract terms and platform arrangements differ, so do not assume that paying an invoice automatically gives you every account or licence. Ask for the arrangement in writing and resolve unclear ownership before it becomes a handover dispute.
Make an account register
List the services that keep the website working. Include the domain registrar, hosting, content management system, email delivery service, form destination and any external tools used by the site.
Depending on the project, the list may also include analytics, search tools, design files, a code repository, paid plugins and image licences. Record what exists; do not create unnecessary accounts simply to fill a template.
For each entry, record:
- The service name and account owner.
- The billing contact and renewal arrangement.
- Who has access and at what level.
- The recovery contact or agreed recovery process.
- Any licence or transfer restriction.
- The person responsible for maintenance.
Keep passwords, recovery codes and other secrets out of an ordinary project spreadsheet. Use an appropriate secure system for those.
Pay particular attention to the domain
The domain affects more than the visible website. Changes can also affect email and other connected services. Establish who can access the registrar account and who is authorised to change the DNS records that direct those services.
Check that renewal notices reach a monitored business contact and that the payment method is current. A domain registered years ago through a former employee’s personal account deserves attention before a redesign begins.
Do not move the domain or change nameservers merely to tidy up the register. Inventory first, then plan any necessary changes with the person responsible for the connected services.
Check what happens when a supplier changes
Ask which assets can transfer and which depend on the supplier’s own subscriptions. A plugin licence, font or stock image may have conditions that differ from the website content.
Record the practical consequence. Will a replacement licence be needed? Will updates stop? Is an exported copy of the design or source code included? A clear answer now avoids discovering a dependency during an urgent move.
Make the handover scope part of the website brief. It is easier to agree the deliverables before the work starts than after a relationship has ended.
Protect access and recovery
Use the security controls the provider offers and make recovery arrangements available to authorised people. The NCSC’s guidance for small organisations provides a practical starting point for protecting accounts, devices and backups.
Check whether a single person’s phone or email account is the only recovery route. That person may be unavailable when access is needed. Any alternative should be controlled and documented, rather than a loosely shared backup login.
When someone leaves the project, remove access that is no longer needed. Avoid deleting ownership or recovery methods until the replacement arrangement has been verified.
Test the handover while help is available
Ask an authorised business representative to sign in and confirm the expected access. Check that they can find billing, renewal information and the relevant support route. Do not assume an invitation email proves the process is complete.
For backups, confirm what is included, where copies are kept and who can restore them. A file labelled “backup” is not the same as a tested recovery process.
Finish with a short record of remaining actions and their owners. Review it alongside the website launch checklist. Our website design service can include these handover decisions in the project scope, so the site remains manageable after launch.