List every login your website depends on, who holds it, and which email address recovers it. Anything tied to one person, especially a former employee or supplier, should gain a second owner from the business this month.

Nine logins, most of them invisible

A small business website looks like one thing. Behind it are usually nine or ten separate accounts, each with its own login, opened by different people in different years.

The domain is registered in one place, its DNS may be managed in another, the site is hosted in a third, and the email runs somewhere else again.

Then come the Google accounts, the Facebook page, and whatever other social accounts exist.

The start of the year is a good time to find out who holds each one, because the answer is almost never written down.

The inventory

The last is the one that holds the others. Every other account on the list recovers its password through an email address, so whoever controls that address controls the rest.

The address behind each account

For each account, the question is not only who has the password but which email address it belongs to, since resets, renewal notices and security warnings all go there.

Three answers cause trouble: a personal address, such as an employee's own Gmail; a work address belonging to somebody who has left, deleted when they did; and the address of a supplier you no longer use.

There is a circular version too. If the registrar account recovers through an address on the same domain and the domain lapses, the email that would let you fix it stops arriving.

The fix is a shared business address, read by more than one person and used for every account. The registrar also needs a backup contact that does not depend on the domain itself.

DNS, the forgotten one

Most owners know roughly where the domain is registered. Far fewer know where its DNS is managed: the settings that tell the internet where your site and email live.

Often it is at the registrar. It may instead have moved to the host, or to a separate service a former IT contractor set up, leaving the registrar showing only two nameservers pointing elsewhere.

That matters the day you change email provider or move the site. Both changes are made in DNS, and if nobody can log in wherever it lives, nothing can move.

Google accounts and whoever set them up

Google My Business, Analytics and Search Console each belong to Google accounts, not to the business. Whoever set them up is often the only owner.

All three let you add people. My Business has owners and managers, Analytics has users with different permissions, and Search Console has owners and users.

The danger is the single owner. If that person's G Suite account is deleted when they leave, or their personal Gmail stops being checked, the business can lose control of its own listing and history.

A listing can usually be reclaimed through Google's request process, slowly. Analytics history held by a deleted account may be out of reach altogether.

Social pages

A Facebook page has no password of its own. It is run by personal profiles given roles on it, so a page with one admin depends entirely on one person's account.

If that person leaves, falls out with the business, or loses access to their own profile, the page is stranded, and the routes back are slow.

Two admins from the business is the minimum. Instagram usually works differently, with one shared password, which should change whenever somebody who knows it leaves.

A worked example

A small law office changed its email provider last spring.

The new provider's instructions were simple: change two records in DNS, and mail starts arriving in the new system.

The office manager logged in to the registrar, where the domain had been renewed faithfully for eight years, and found no DNS settings at all. Only two nameservers, pointing to a service nobody in the office recognised.

The IT contractor who had set the office up had moved DNS to an account of his own there, which was sensible at the time and recorded nowhere. He had since retired.

Tracking him down took two weeks, during which the email change sat half done. Once found, he moved DNS into an account in the firm's name within a day.

When somebody leaves

The inventory earns its keep on the day somebody leaves.

Go down the list that afternoon. Remove their access where they had their own login, change any password they knew, and check that nothing still recovers through their address.

Do it while they are on good terms and reachable. A colleague leaving amicably will hand over a listing in minutes; the same request six months later goes to an inbox nobody reads.

Suppliers belong on the same list. When a working relationship ends, ask for every account opened on your behalf to be transferred to the business, in writing.

Writing it down

One page is enough. For each account: what it is, the company providing it, the login address, whose name it is in, the recovery email, the second owner, and the renewal date.

Passwords do not go on it. They belong in a password manager the business controls, so the page can be shared without becoming a risk itself.

Store it with your other business records, not in one person's inbox, and go through it each January.

The counter-case

Not every arrangement on the list needs changing.

A web company managing your hosting and DNS as part of looking after the site is a perfectly sound arrangement, provided the domain is registered to the business and you know where the rest sits.

A sole proprietor who opened every account personally, with an address they control, has a short list and one real risk: being unavailable. A copy of the page left with somebody they trust covers most of it.

Make the list this month, and give every account a second owner from the business.

This month

  1. List every account the site depends on.
  2. Note the recovery email for each one.
  3. Find where DNS is actually managed.
  4. Add a second owner to every Google account.
  5. Give the Facebook page two business admins.
  6. Move personal addresses to a shared business one.
  7. Store the page with your business records.

Step two is the one most inventories miss, and the one that decides who could actually take an account over.

Updating the site itself, once you know who can log in to it, is covered in clicking update all on a Friday afternoon.

Frequently asked questions

Which accounts does a website depend on?

Usually the domain registrar, DNS, hosting, the site's admin login, Google My Business, Analytics, Search Console, the social pages, and the email account that receives password resets.

Why does the recovery email matter most?

Every account resets its password through an email address. Whoever controls that address can take the account over, whatever the password list says.

What is DNS, and why does it matter?

It is the set of records pointing your address at your site and your email. If nobody can log in where it is managed, nothing can be moved.

What if one person owns our Google listing?

Add a second owner from the business now. If that person's account is deleted or abandoned, getting the listing back means a request process and waiting.

What should happen when an employee leaves?

Go through the inventory that afternoon: remove their access, change any shared passwords, and check that nothing still recovers through their email address.

Should the passwords go on the list?

No. Passwords belong in a password manager the business controls. The list records which accounts exist, who owns them, and where their recovery emails go.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure who registered your domain?

Send us the address. We will find where the domain, DNS and hosting actually sit, and whose name they are in.

Start a Conversation