Many small business websites quietly depend on one person who built them years ago. Here is how to take back control of your site, your accounts and your data before that becomes a problem.
Most small business websites start the same way. A freelancer, an agency or a tech savvy friend builds the site, launches it, and everyone moves on. Years later the business owner needs a change, a renewal fails, or something breaks, and nobody is quite sure who has the passwords. If that sounds familiar, you are not alone, and the fix is mostly a matter of good housekeeping.
Why ownership matters more than design
A website is not one thing. It is a domain name, a hosting account, a content management system, an email setup, analytics, and often a handful of paid plugins or services. Each of these has its own login and its own renewal date. When all of them sit in the name of someone who no longer works with you, your business is one expired card or one unanswered email away from going offline.
This is not about distrust. Good developers change jobs, retire, or simply get busy. The goal is to make sure your business can keep running no matter who is helping you with the technical side.
Step one: make an inventory
Sit down with a notebook or a spreadsheet and list every piece of your online presence. For each item, write down who the account belongs to, which email address it uses, and when it renews.
- Domain registrar, where your web address is registered
- DNS provider, which is sometimes the same as the registrar and sometimes not
- Hosting account, where the site files and database live
- Website administrator login
- Business email service
- Analytics and search tools, such as Google Analytics and Search Console
- Paid themes, plugins and licenses
- Payment, booking or newsletter services connected to the site
You will probably find a few gaps. That is normal, and it is exactly why this exercise is worth doing.
Step two: move accounts into the business name
The domain is the most important item on the list. Whoever controls the domain controls where your website and email point. Make sure the registrar account is registered to your business, uses an email address the business controls, and has a payment method the business pays for.
Do the same for hosting. If your developer hosts the site on their own account, ask them to either transfer it to an account in your name or give you a clear written agreement about access and backups. Most professionals are happy to help with this, because it protects them too.
Use a shared business address such as admin or office at your own domain rather than a personal inbox. People leave, but a role based address stays with the company.
Step three: give people their own logins
A common shortcut is one admin account that everyone shares. It feels simple, but it means you can never tell who changed what, and you cannot remove one person without locking out everyone else.
Instead, give each person their own account with only the access they need. A writer does not need full administrator rights. A developer working on one task can get temporary access that you remove once the job is done. Turn on two factor authentication for every account that offers it, starting with the domain, hosting and site administrator logins.
Step four: store credentials properly
Passwords written on sticky notes or kept in old email threads are a real risk. A password manager with a shared business vault solves this neatly. The owner keeps control of the vault, and team members or contractors only see the entries they need.
Keep recovery codes for two factor authentication in the same place, or printed in a safe spot. Losing the phone that holds your codes should not mean losing your website.
Step five: know where your backups are
Ask a simple question: if the site disappeared today, where would we restore it from? A good answer includes automatic backups, stored somewhere other than the hosting server itself, and at least one restore that someone has actually tested.
Many hosting plans include backups, but they often keep only a short history and live on the same infrastructure as the site. A separate copy, in an account your business owns, is cheap insurance.
Step six: decide who looks after updates
Platforms like WordPress rely on regular updates to the core software, the theme and the plugins. Skipping them is one of the most common reasons small sites get hacked. After a handover, it is easy for updates to fall through the cracks because everyone assumes someone else is handling them.
Pick one responsible person or service and write it down. Some owners handle updates themselves once a week. Others prefer a dedicated WordPress maintenance service that takes care of updates, backups and monitoring so nothing depends on memory. Either choice is fine as long as it is clear.
Step seven: write a one page site guide
Finish by writing a short document that anyone could pick up in an emergency. Include where the domain and hosting are, who to contact for support, where backups are stored, how to reach the password vault, and what to do if the site goes down. Review it once a year, ideally when your domain renews.
A calm habit, not a crisis
None of these steps require deep technical knowledge. They take an afternoon, and they turn your website from something you rent from a person into an asset your business actually owns. If you want a second opinion on how secure your setup is, teams like Bearmor focus on exactly this kind of practical WordPress care. Whatever route you choose, the best time to sort out ownership is before you need it.
