Who should control your website’s domain, hosting and accounts?

Your organization should control its domain and have the access needed to operate, recover and transfer its website. A provider can manage these services, but should not be the only person able to renew a domain or grant access to the data.

This is not about assuming a supplier is untrustworthy. Clear responsibilities and documented access protect both parties when teams or contracts change.

How do domains, registrars, DNS and hosting differ?

The domain is the name used to reach the site and often for email. The registrar manages its registration. DNS holds settings that direct web and email traffic, among other services. Hosting runs the website or serves its files. Different companies may provide these services.

For the domain, your organization should be identified as the registrant in the applicable registration records and control the management account. Confirm transfer and renewal conditions. A publicly displayed contact name, or one hidden by a privacy service, does not establish who actually controls the account.

A hosting account in the organization’s name is often the simplest arrangement. If the service uses a provider’s shared infrastructure, agree in writing on access rights, exports, backups and transition arrangements. Operational control and contractual commitments matter as much as the name on an invoice.

Which other accounts should be inventoried?

The list extends beyond domain and hosting: administration interface or CMS, analytics, Search Console, forms, email delivery and backups. Include licences, integrations and billing accounts the site depends on.

For each service, record its purpose, account holder, administrators, recovery contacts, renewal date and payment owner. An overlooked dependency can interrupt a feature even when the main site remains available. Our guide to what a small business website needs helps separate essentials from optional additions.

How should a provider receive access?

Use individual accounts and appropriate roles where supported. A provider may need hosting administration rights without becoming the sole account owner. Avoid sharing one login across the whole team and several suppliers.

Enable MFA, keep recovery methods under organizational control and store secrets in a suitable tool. An access register should describe where secrets are kept, not become a broadly accessible password spreadsheet. Arrange internal backup coverage so control does not depend on one employee.

Who monitors renewals and backups?

Assign responsibility for domain, hosting and licence alerts. Confirm notifications and billing reach people who are still with the organization. Document recovery that does not depend solely on a mailbox using the affected domain.

A useful backup must be recoverable. An editable site may need files, a database and certain settings. A static website also needs its source material and build procedure. Define backup frequency, retention, storage location and who performs restoration tests.

What should happen before a provider leaves?

Prepare an orderly handover: service inventory, exports, backups, DNS configuration and operating documentation. Identify transferable licences and those tied to the provider’s contract. Test the website, forms and email after changes.

Remove the former provider’s access once the transition is confirmed, and replace shared secrets where needed. Do not delete accounts blindly before identifying their purpose. DNS changes can affect email; coordination with your Microsoft 365 or Google Workspace administrator prevents treating the website as a completely isolated service.

What if a former supplier controls everything?

Start with a factual inventory and a documented handover request. Check agreements, existing access and billing ownership. Contractual advice may be helpful depending on the circumstances; these considerations are not legal advice.

NetBLB can support IT asset and access management and help build a durable arrangement with your supplier. In a complete website project, with or without visual editing, these responsibilities should be defined from the start so your team retains independence.