Introduction
Many website problems become much harder because nobody knows who owns the accounts behind the site.
A developer may leave, an employee may move on or an agency relationship may end.
If the business controls the key digital accounts, another qualified professional can usually take over.
These are ten areas I would document before a website project is considered complete.
1. Domain Registrar
The business should know where the domain is registered and have recoverable access.
Document renewal responsibility and protect the account with multi-factor authentication.
The domain is too important to exist only inside a contractor's personal account.
2. DNS Provider
DNS may be managed at the registrar, host or a separate provider.
Record who controls it and preserve important records before changes.
DNS mistakes can affect website and business email simultaneously.
3. Website Hosting or Deployment Platform
Know where the live website runs.
Keep account ownership, billing and recovery information under business control.
Developers can still have technical permissions without being the only recovery path.
4. CMS Administrator Access
For WordPress or another CMS, maintain at least one business-controlled administrator account.
Use individual accounts for staff and developers.
Do not share the same administrator password across the whole team.
5. Source Code Repository
Custom websites should have a known source-code repository.
The business should have appropriate organization or repository access according to the contract.
Do not let the only current source exist on one developer's laptop.
6. Analytics
Keep business ownership of analytics properties used to measure traffic and conversions.
Agencies can be added as users.
This prevents historical data from disappearing when providers change.
7. Search Console
Google Search Console contains valuable search and indexing history.
Verify the property under a business-controlled Google account and grant outside providers appropriate access.
Do not rebuild the property from scratch every time the SEO provider changes.
8. Business Email and Email Delivery
Know which provider hosts staff mailboxes and which service sends website emails.
These may be separate systems.
Document DNS dependencies and billing.
Website migrations should not accidentally interrupt business email.
9. Payment and Commerce Accounts
Payment gateways, Shopify stores, merchant accounts and ecommerce services should be owned by the legal business where required.
Developers should not receive customer revenue into personal accounts.
Keep financial and technical permissions appropriately separated.
10. Backup Storage and Critical Third-Party Tools
Document backup storage, CDN, booking tools, CRM, forms, API services and other critical integrations.
Record who owns each subscription and how access is recovered.
Small dependencies become major problems when nobody knows where they are configured.
Create an Access Register
Maintain a secure internal list of provider names, account owners and responsible people.
Do not store plain-text passwords in an ordinary spreadsheet.
Use a password manager or secure credential process.
Review the register when staff, developers or agencies change.
Frequently Asked Questions
Should the business own every software account? — Business-critical accounts should be owned or recoverable by the business, while developers may manage technical access.
Can an agency own licenses? — Yes for some service models, but renewal dependency and transfer implications should be clear.
Who should control Search Console? — The business should retain ownership-level access and grant providers appropriate permissions.
How often should access be reviewed? — Review after staffing or vendor changes and as part of regular security maintenance.