Here's a call I get a few times a year. A business owner's website has gone down, or their email stopped working, or they want to move to a new designer. And when we start looking, nobody can find the login. The domain was registered by a nephew in 2017. The hosting is on a card that was cancelled. The person who built the site stopped answering months ago.
The website was never really theirs. It just looked that way while everything kept renewing.
This post is a ten-minute audit to find out whether that's you, and what to do if it is.
The Four Things You Have to Control
A website isn't one thing. It's at least four separate accounts, usually with four separate companies, and you need to hold the keys to each one.
| Piece | What it is | Who you'd log into |
|---|---|---|
| Domain | The name itself (yourbusiness.com) | A registrar: GoDaddy, Namecheap, Cloudflare, Google/Squarespace Domains |
| DNS | The settings that point the name at your site and email | Usually the registrar, sometimes Cloudflare or your host |
| Hosting | The server your site's files live on | SiteGround, WP Engine, Cloudflare, Wix, Squarespace, etc. |
| The site itself | The admin login to edit pages | WordPress admin, Wix editor, Shopify admin |
The domain is the one that matters most. If you own the domain, you can always rebuild everything else. If someone else owns the domain, they own your business's name online, your email addresses, and every link anyone has ever shared to you.
The Ten-Minute Check
Do this today, not "when things settle down."
- Look up your domain. Search "whois" plus your domain name. Look for the registrar and the expiration date. If privacy protection hides the owner, that's fine, but the registrar name should be visible.
- Try to log into that registrar. Do you have an account there? Is it under your email, or your web designer's? Is the email on file one you still check?
- Check the expiration date. Anything under 90 days out needs attention now. Domains that lapse can be bought by someone else, and you will not get them back cheaply.
- Find the hosting bill. Look for a monthly or annual charge on your statements. Whose name is the account in? Whose card is it on?
- Log into the site admin. Not the designer's login, yours. Do you have an administrator account, or just an "editor" one that can't add users?
If you cleared all five, you're in better shape than most businesses I meet. If you got stuck on any of them, keep reading.
The "Web Guy Disappeared" Scenario
This is the most common version of the problem, and it's rarely malicious. A freelancer registered your domain under their own account because it was faster. They set up hosting on their reseller plan. They meant to transfer it. Then they changed careers, or moved, or just got busy.
Now you need a change made, and there's nobody to make it.
What to do, in order:
- Try every contact you have. Email, phone, LinkedIn, a mutual acquaintance. Most people will help if you reach them. Ask specifically for a domain transfer and admin access, not "can you send me the logins."
- If the domain is in their name and they won't respond, contact the registrar. Some will work with you if you can prove the business is yours (business license, matching name on the site, invoices). It's slow, but it works more often than people expect.
- If the domain is in your name but you can't log in, that's an account recovery, and registrars handle it every day. You'll need ID and probably the last four digits of a card.
- In the meantime, make sure the domain doesn't expire. Some registrars will let you renew a domain you don't have login access to, just by paying. Do that first.
I wrote a separate post on what to do if your site gets hacked, and a lot of the same recovery logic applies here: secure the domain first, everything else second.
Locking It Down Once It's Yours
Once you control all four pieces, spend fifteen minutes making sure it stays that way.
- Turn on auto-renew for the domain, with a card that won't expire soon. Set a calendar reminder a month before the renewal anyway.
- Enable registrar lock (sometimes called "transfer lock"). It's a checkbox that stops anyone transferring the domain out without unlocking it first.
- Use your own email as the account email, on a domain you control, not a designer's address and not a free account nobody checks. And turn on two-factor authentication.
- Give your designer their own admin account instead of sharing yours. When the relationship ends, you remove one user and nothing else changes.
- Write it all down. One document: registrar, host, platform, the account emails, the renewal dates. Store it somewhere your business partner or spouse can find it. This is on my security checklist for a reason.
What Good Looks Like
A business owner in Manteca I worked with last year had all of this in a single page in her password manager: registrar, DNS, hosting, admin logins, renewal dates. When she hired me, she added an admin account for me in five minutes. When the project was done, she could have removed it in two. She didn't need to trust me with her business. She just needed to trust the setup.
That's the goal. Not a website you're afraid to touch, but one you could hand to any competent person tomorrow and keep running.
The Bottom Line
Your domain name is the most important digital asset your business has, and it should be registered in your name, on your account, with your card. Everything else can be rebuilt. That can't.
Run the ten-minute check. If any step made you nervous, fix that one first. And if you'd rather have someone walk through it with you, that's part of what I do for clients in Lodi and across the Valley.
Not sure whether your setup is solid? Get a free audit and I'll tell you what I can see from the outside, including who your domain is registered with.
Want help applying this to your business?
Get a free website audit and a personalized action plan. No pressure, no sales pitch.
Get a Free Audit