Control of your assets Which website logins and assets your company should control

If your web provider stopped responding tomorrow, could you get into your own website? Many companies find out at the worst possible moment: when the domain needs renewing, when the site goes down or when they want to switch providers. This checklist helps you review it calmly.

The domain

It’s your website’s address (yourcompany.com) and, almost always, your email’s too. It should be under your company’s control, with a contact email you manage, because that’s what lets you renew it, move it to another provider or recover it.

How to check: log in to the registrar where the domain is paid for. If you don’t know which one it is, ICANN’s registration lookup (lookup.icann.org) shows the registrar and expiration dates. Many lookups hide the owner’s details for privacy, so the real proof is having access to the registrar dashboard.

DNS

DNS settings tell the internet where your domain points: which server shows the website and which receives email. They may live at the registrar, the host or an external service. You need access wherever they’re configured; without it, you can’t switch hosting or email providers.

Hosting

Ideally, the hosting contract is in your company’s name and you pay for it. If your provider buys it for you, ask for your own dashboard login at the very least, and get in writing what happens to the site if the relationship ends.

The site admin account

Your company should have its own administrator account, tied to a company email address. Sharing a single login with your provider doesn’t work: if they change the password, you’re locked out. Everyone who works on the site should have their own account, with only the permissions they need.

Company email

Whatever email service you use, the admin account should belong to your company. It’s what lets you create and remove mailboxes, and recover accounts when someone leaves.

Analytics and Search Console

These properties should belong to an account your company owns. Your provider can have user access, but shouldn’t be the only owner. That way you keep your data history even if you change providers, and that history can’t be rebuilt later.

Paid plugin and theme licenses

If your site uses commercial plugins or themes, the licenses should be under your control or, at minimum, documented: what’s used, who pays for it and when it expires. An expired license usually means the component stops getting security updates.

Backups

Ask where backups are stored, how often they run and whether anyone has ever tested restoring one. A backup that only lives on the same server as the site won’t protect you if that server fails.

If something isn’t under your control

Ask for the transfer in writing, calmly. A professional provider has no reason to refuse: your company’s digital assets belong to your company. If you meet resistance, document what you have and what’s missing before making any decisions.

The checklist, in one afternoon

• Log in to your domain dashboard and note the expiration date.
• Find out where your DNS is managed and confirm you can log in.
• Check that you have your own hosting login.
• Create your own admin account on the site, if you don’t have one.
• Confirm who owns your analytics and Search Console.
• List your paid licenses and their expiration dates.
• Ask about backups and the last tested restore.

Frequently asked questions

What if the domain is registered to my provider?

Ask for the transfer in writing. In the meantime, note the expiration date so it doesn’t lapse without you knowing.

Is it a bad sign that my provider has access?

No. They need access to do their work. The problem is when they’re the only one: your company should have its own access to every asset.