Insights / Digital Foundation
Who actually controls your website and digital accounts?
If your provider disappeared tomorrow, could you still log in? Here’s how to find out, and what to fix first.
Here’s a call we get more often than we’d like.
The website project stalled.
The person who built it stopped replying.
Nobody inside the business can log in.
The details vary. A developer took on more than they could finish. A long-time contractor moved on. An employee set everything up under a personal email and then left. Often nobody did anything wrong on purpose. The accounts were set up for convenience, years ago, and nobody wrote down where.
The result is the same. You can’t update the site. You can’t finish the project. You can’t move to someone else. Your business depends on one person, and that person isn’t picking up.
The question isn’t whether you trust your provider. It’s whether your business could keep running if they disappeared tomorrow.
Owned, managed or licensed
“Own everything” sounds right, but it’s too simple. Some things should be in your business’s name. Some are reasonably held by a provider on your behalf. You need to know which is which.
Owned means the account is registered to your business, with an email address you control. Your domain, your Google Business Profile, your analytics and your ad accounts belong here.
Managed means a provider runs it for you. Agency-managed hosting is common and can be a good arrangement: they look after servers, security and updates. What matters is that you know where the site lives, you can get a current backup, and your agreement says how your files and data come with you if you leave.
Licensed means you have the right to use something you don’t own outright: premium themes, add-ons, page builders, fonts, stock images, some software platforms. Licences are often tied to whoever bought them. Find out whose name they’re in and whether they transfer.
None of this needs to be adversarial. A good provider will welcome the conversation. Your agreement should spell out who owns what and what happens at exit. If the terms matter a lot to you, have a lawyer read them.
The account inventory
Sit down with whoever manages your digital presence and work through this list. For each item, record where it lives, whose name and email it’s under, who has admin access, and when you last checked.
Domain registrar.
The most important one. Whoever controls the registrar account controls your domain, and with it your website and often your email. It should be in your business’s name, with renewal notices going to an address you control. Turn on auto-renew and two-factor authentication.
DNS.
DNS may sit at the registrar, the host or a separate service. It decides where your site and email actually point. Know where it’s managed and who can change it.
Hosting.
Know the provider and whether the account is yours or managed for you. If it’s managed, confirm you can get a full copy of the site on request.
CMS admin.
Whatever your platform, someone at your business should have their own administrator login. Not a shared one, and not a limited editor account. Everyone with access should have a named account you can remove.
Analytics.
Your measurement history belongs to the business. Make sure an account you control has owner or administrator rights on Analytics, Search Console and Tag Manager. Add providers as users.
Ad accounts.
Google, Microsoft, Meta and LinkedIn ad accounts hold your history and your billing. They should sit under your business, with agencies given access, not the other way round.
Google Business Profile.
Your local listing, reviews and photos. The primary owner should be someone at your business, with managers added as needed.
Email.
Business email usually runs on Google Workspace or Microsoft 365, set up by someone at some point. Know who holds the top-level administrator account. Lose that and you can lose your inbox.
Code and backups.
Know where backups are stored, how often they run, and whether you can reach one without your provider. For custom work, know where the code lives and what your agreement says about taking it with you.
If you can’t fill in a line, that’s the line to fix first.
If you’re already locked out
Start calmly. Ask in writing for access, and name the specific accounts. Many lockouts end there.
If that doesn’t work, start at the top of the list. Domain registrars, Google and most platforms have recovery processes for verified owners. They usually want proof the business is yours: incorporation documents, invoices, matching billing or contact details. It takes patience. Recover the domain and email first, because most other recoveries depend on them. Take a full backup of the site as soon as you can reach it.
Then fix the cause, not just the symptom: business-owned accounts, named logins, two-factor authentication, and a written record of where everything lives. That’s part of looking after the foundation. If the site needs work as well, decide what it actually needs once you hold the keys.
Plan the exit before you need it
The best time to agree how a relationship ends is at the start, when everyone is friendly. Ask any provider:
- Which accounts will be in our name, and which will you hold?
- If we part ways, what do we get, in what format, and how fast?
- Which licences transfer to us, and which don’t?
- Who do we call if our main contact leaves your company?
Clear answers are a good sign. Vague ones tell you something too. Here’s how to evaluate a partner more broadly.
Your business shouldn’t depend on one person.
Know where everything lives.
Know who holds the keys.
Write it down.