Website Ownership and Access Checklist for Small Businesses

Separate ownership from practical access

A website can be online and taking enquiries while the business owner cannot change a price, renew the domain or recover an administrator account. Before changing suppliers, make a list of the services that keep the site running and confirm who can access each one. A working login is stronger evidence than an assumption that everything is included in the handover.

Account control and contractual ownership are separate questions. Access to a hosting dashboard does not settle who owns custom code, photographs or design assets. Review the agreed contract and licences for those questions; this checklist covers operational access rather than determining legal ownership. Record any uncertainty as an item to resolve with the supplier.

Start with the domain and DNS

Identify the registrar where the domain is registered, the registered contact, renewal date, billing contact and recovery method. Confirm that an authorised person in the business can sign in and see the correct domain. For UK domains, Nominet provides Online Services for domain management; the registrar is still an important starting point for routine account and renewal questions.

Next identify the DNS provider. DNS records connect the domain to services such as the website and email, and this provider may be different from the registrar or web host. Ask for a record of the current configuration before any move. Changing nameservers or deleting records without understanding them can disrupt services beyond the website. Agree who will carry out and verify each change.

• Record the registrar, DNS provider and account holder.
• Check renewal reminders reach a monitored business contact.
• Confirm the recovery route works if the normal mailbox is unavailable.
• Keep the DNS inventory in a controlled location; do not publish account credentials.

Check hosting, source files and the publishing route

Find out where the live website runs and how updates reach it. A hosting account, a source-code repository and a content-management system may be three separate services. Ask the supplier to demonstrate the normal publishing process and identify which account pays for the hosting. Record any paid themes, plugins, fonts or other dependencies that need renewal.

For a custom-built site, agree how the business receives the source files, database exports where relevant, build instructions and configuration inventory. For a managed website platform, check which content and settings can be exported and what would need rebuilding elsewhere. Do not assume every platform offers a complete portable copy. Secret values should move through an agreed secure method, not a shared handover document.

Give people appropriate individual access

Use individual collaborator accounts where the platform supports them, with permissions suited to the work. Someone updating articles may not need the ability to change billing or manage every user. WordPress, for example, distinguishes editorial roles from administrative capabilities. Check the actual permissions in your platform rather than relying on a familiar role name.

Confirm that the business retains the administrative access it needs and can recover the account independently. Enable the available account protections and store recovery information securely. During a supplier change, establish and test the replacement access before removing old collaborators. Avoid sharing a single password among everyone involved.

Include analytics, search and enquiry services

A website handover should cover the accounts used to understand and respond to customers. List Search Console, analytics, form delivery, booking tools and business email services. Record the relevant property or project identifier so that access to an unrelated account is not mistaken for access to the live site.

Google Search Console separates owners from users with different permissions. Check that the business has an appropriate ownership and recovery arrangement, then grant suppliers the access their work requires. Confirm that a person in the business can open the correct reports. For enquiries, agree a controlled test and verify where a submitted form is stored or delivered, rather than assuming the on-screen success message proves delivery.

Use this handover inventory

Copy these headings into a private checklist. For each system, record the account URL or identifier, responsible business contact, supplier role, renewal responsibility, recovery method location, date checked and any unresolved action. Record where a secret is stored, never the secret itself. Mark items as verified only after someone demonstrates the required access.

• Domain registration and DNS configuration
• Hosting, billing and deployment project
• Website editor or CMS and administrator access
• Source repository or supported platform export
• Database, uploaded media and backup location
• Search Console and analytics properties
• Business email, contact forms and booking integrations
• Software subscriptions, licences and renewal dates
• Recovery contacts and the approved location of recovery codes

Test the handover before closing it

Agree a small acceptance exercise: sign in with the business account, make and reverse a harmless content change, inspect the latest backup and confirm who can restore it. A backup file existing is not the same as a tested restoration. Where a restore test is needed, use an isolated environment and avoid overwriting the live site or exposing customer data.

Finish with an action list showing what remains with the old supplier, what has transferred and who owns each outstanding step. If URLs or hosting will change, plan the migration separately with a redirect and launch checklist. Website maintenance then becomes easier to organise because account access, renewal responsibility and recovery arrangements are documented rather than dependent on memory.

Related services and guides

• Website maintenance and support
• Compare handover scope in website quotes
• Plan redirects and launch checks for a redesign

Further reading

• Nominet: Online Services
• WordPress: roles and capabilities
• Google: Search Console users, owners and permissions