Week 2 · Monday
Who controls your website, domain, email, and Facebook page?
Find out who controls your business's most important online accounts and how to keep access when people or providers change.
Imagine a shop owner needs to update the hours on their website before a busy weekend. The person who built the site is unavailable. Nobody knows where to sign in, and the password reset message goes to an old email address.
The business paid for the website. It still cannot change the hours.
This is an illustrative situation, but the question is worth asking in your own business: If the person who set up an account disappeared tomorrow, could you still manage it?
Last week, we started an inventory of business technology. This week, we will use that inventory to identify who holds the keys.
Four assets that can have four different accounts
A domain name is the name people use to find your business online. Your website is the content they see when they visit. Your email service handles messages. Your Facebook page is managed through Meta's access system.
One provider may help with all four, but access to one does not automatically give you control of the others.
| Asset | What to find out |
|---|---|
| Domain name | Where is it registered, who is listed as the registrant, and who receives renewal notices? |
| Website | Who can edit it, who manages its hosting, and what happens if you change providers? |
| Business email | Who can manage users and help recover access to the business's email service? |
| Facebook page | Who has access, what can each person do, and who can manage access when someone leaves? |
An administrator is someone with permission to manage a system. Those permissions may include adding users, changing settings, or closing an account. Being able to post a photo or read an inbox does not necessarily make you an administrator.
Start with the domain
The company through which you register a domain is called a registrar. The registrant is the person or organization that holds the registration under its agreement with the registrar. Registration needs to be maintained and renewed. Paying for a website does not, by itself, establish who holds its domain registration. ICANN: Information for domain name registrants.
Find the registrar's account and confirm the registration details, renewal date, payment method, and notification address. Ask your provider to explain any details you do not recognize. Do not rely only on a public domain lookup, which may hide contact information for privacy.
Also record who manages DNS, the settings that help direct visitors to your website and route email to your email provider. You do not need to change those settings for this exercise. You need to know who is authorized to manage them.
Check what website access actually means
A designer may have permission to edit your pages while a different company hosts the website. Hosting is the service that runs the site and makes it available to visitors.
Ask your provider to show you the arrangement. Can your business update content? Who manages the hosting subscription? If you move, what website files, content, images, and other materials can you take with you under your agreement?
Some website services cannot be moved simply by copying a folder. Get a clear explanation before changing or canceling a service. The FTC recommends clarifying who will manage a website and whether the business can sign in to make changes itself. FTC: Cybersecurity for small business, hiring a web host.
Treat email administration as an important business responsibility
Reading your own inbox and administering the company's email are different jobs. Identify who can add a mailbox, remove access, and help recover an administrator account.
Recovery deserves particular attention. If your only recovery instructions sit inside an inbox you cannot open, they may not help. Ask your provider what recovery methods are supported and record an authorized route that does not depend entirely on the unavailable account.
You can keep using a trusted IT provider. The useful question is whether the business has a clear, workable arrangement for access and recovery.
Review Facebook page access carefully
Open the Page's access settings with the person who currently manages it. Confirm that the appropriate owner or trusted business administrator can manage access, and consider a trusted backup where appropriate.
Meta distinguishes task access from Facebook access with full control. Full control can include changing access, removing other people, and deleting the Page, so it should be limited to people who need that responsibility. Use the platform's access tools instead of passing around one person's Facebook password. Meta: About Facebook Page access.
If an agency manages the Page, also establish which business portfolio it belongs to and how a handover would work. A business portfolio is Meta's way of grouping business assets and access.
A fifteen-minute exercise: make an access map
Add four rows to last week's inventory: domain, website, email, and Facebook page. For each, record:
- The provider and official sign-in address.
- The person accountable for the account.
- Who can administer it and what backup arrangement exists.
- Where renewal or billing notices go.
- How an authorized person would start account recovery.
Keep this record somewhere access is restricted to the people who need it. Do not put passwords, recovery codes, or identity documents in the inventory.
Mark missing answers as "unknown" and assign someone to confirm them. Before ending a provider relationship, verify that the agreed access and recovery arrangements work. Test the handover while both parties are available.
Your takeaway: For each important digital asset, know who controls it, who pays for it, and how the business gets access back.
On Wednesday, we will look at separating personal and business accounts without making everyday work harder.
Follow the Small Business Learning Series for new articles on Monday, Wednesday, and Friday at 1 p.m. Eastern.