October 15, 2026 · Faith Forge Labs Editorial Team
Who Owns Your Website? The Access List to Keep Before You Need It
A working website can still depend on accounts nobody in the business can recover. Keep a clear access inventory while everything is running normally.
Your website may look like one thing, but keeping it running can involve several separate accounts. The domain name, hosting, content editor, business email and source code may all sit with different providers. Knowing who pays an invoice does not necessarily tell you who can recover the account.
The useful question is practical: if the person who normally handles the website were unavailable tomorrow, could your business renew it, make an urgent change and arrange qualified help?
Make an account map, not a password spreadsheet
Start with a private list of the services your website depends on. For each one, record the provider, its purpose, the business account owner, authorised administrators, renewal responsibility and the approved recovery route. Keep passwords and recovery codes in an appropriate protected system, separate from this inventory.
- Domain registration: where the name is registered and who receives renewal and account notices.
- DNS: where the records directing website and email traffic are managed.
- Hosting: where the website runs and who can request support.
- Website administration: who can edit content and manage user access.
- Source code and releases: where the current project and deployment instructions are kept.
- Backups and connected services: where copies are held and which email, form or other services the site uses.
These responsibilities can overlap, but do not assume they do. Cloudflare's explanation of DNS is useful background if the difference between a domain name and the system directing its traffic is unfamiliar.
Check that business access actually works
A hypothetical business might have a website editor login while its former supplier still controls domain renewal. Editing the homepage would not solve a renewal problem. The inventory should expose that dependency while there is time to resolve it calmly.
Ask an authorised person to confirm access through each provider's normal sign-in process. Check that recovery details are current and that renewal notices reach someone responsible. Record when the check happened. An old screenshot or a password remembered from years ago is not the same as current access.
Give suppliers the access needed for their work, using individual or delegated accounts where supported. Avoid making one person's personal inbox the only recovery path for a business-critical service. The NCSC's guidance on important online accounts includes website and domain accounts and recommends strong sign-in protection.
Agree what a handover includes
When a project ends, ask for a short operational handover: the account map, release instructions, backup location, renewal responsibilities and any known limitations. Confirm which access remains necessary for ongoing support and how it will be removed when that work ends.
Access records help you understand operational control. They do not replace the agreements governing ownership, licences or supplier responsibilities. Keep those agreements with the business records too.
If the inventory reveals missing access, write down what is missing before changing anything. Do not cancel hosting, move DNS or remove the last working administrator as an experiment. For an existing project with a broken handover, our software project takeover guide explains the recovery questions to address first. If you need help untangling the dependencies, start with the account map, without sending credentials in the enquiry.