Who Has Access to Your Website? The List to Make Before You Need It
A beauty salon outside Warsaw dropped off the internet on a Wednesday afternoon. Nobody hacked anything and no server caught fire. The domain expired, and the renewal reminder went to the email address of an intern who had finished her placement two years earlier. The owner found out from a customer who could not get through by phone either, because the mailboxes sat on the same domain as the site.
Getting the address back took eleven days and a restoration fee of around four hundred zloty. The cause of all of it had nothing to do with technology. Nobody had ever written down which accounts the business stood on and who held the passwords to them. That list takes one evening to make, and you tend to need it precisely when there is no time to make it.
The seven accounts your online presence runs on
Owners usually think of this as a single thing they call „my website”. In practice it is several independent services from different suppliers, often set up by different people in different years.
| Account | What it gives you | What happens without access |
|---|---|---|
| Domain at the registrar | the address customers know you by | when it expires, site and email die together |
| Hosting or server | where the site files actually live | the site stops loading, backups sit with someone else |
| Site panel or editor | changing prices, hours, photos | every typo needs a middleman |
| Email on your domain | your correspondence with clients | you lose the history of enquiries and quotes |
| Google Business Profile | map pin, reviews, opening hours | someone else decides what Google shows |
| Analytics and Search Console | traffic and search query data | measuring results starts from zero again |
| Social media pages | contact with regulars | a business page can hang off an ex-employee’s personal account |
You rarely lose all of it at once. Usually one line of that table gives way at the worst possible moment, and it turns out the person who set it up has left the company or stopped returning calls.
Owning an account is not the same as having the password
This distinction rescues more situations than anything else here, and almost nobody learns it until things get tense.
With domains, the owner is the registrant, the entity named in the registry. Whoever knows the login to the registrar panel is only an administrator, and in a dispute the administrator loses to the registrant. In a Google Business Profile the roles split into owner and manager: a manager can do everything except one thing, which is removing somebody else’s access. Analytics and Search Console work the same way, where an administrator grants and revokes access and an ordinary user only looks at charts.
There is a quick test that works on all of these services. Log in and see whether you can delete another person from the list of users. If you can, you are the deciding party on that account. If you cannot even see such a list, your access exists at somebody’s discretion and can disappear whenever they choose.
Your domain: a five minute check
Open your registrar’s WHOIS lookup and type in your address. The field you want is the registrant. You will see your own company details, your provider’s details, or a note saying the data is hidden for privacy reasons, which is normal for sole traders. In that last case, ask the registrar to confirm the registrant against the invoice you have been paying.
If the registrant turns out to be your provider, do not panic and do not draft a termination letter that same evening. Transferring the registrant is usually a single form, as long as you are asking during calm times. What to do when the relationship has already soured is a longer story, and I set out the order of steps in the piece on how to move your website to another provider.
The table worth keeping
An access list does not need to be pretty. It needs to exist and be current. For each service, note six things: the supplier, the login page address, whose name the account is formally in, the username, where the password lives and the date of the next payment. The seventh column is the one people skip and the most interesting: who else has access here.
Passwords belong in a password manager, something like Bitwarden or 1Password. Not a sticky note under the keyboard, not a file called passwords.xlsx on the desktop, not the notes app on a phone that can be left in a taxi. A manager gives you two things none of those can: you can share one specific password with one specific person without texting it, and you can see who you shared it with.
Then there is the uncomfortable part. Somebody you trust besides you, a business partner or a family member, should know how to get into that manager. A one-person business where only the owner knows the passwords has a single point of failure, and that point is a human being.
A company mailbox instead of a personal address
The pattern repeats itself across small businesses. The receptionist sets up the Google Business Profile on her personal Gmail account, because that was quicker at the time. A year later she changes jobs, and with her goes the only person who can edit opening hours or reply to reviews. Recovering a profile through Google’s form takes weeks and sometimes does not work at all.
Create business accounts on an address that belongs to the business, something like office@yourcompany.com. That address stays with the company no matter who comes and goes, and you can change its password whenever you want. How to set one up and what it costs is covered in the piece on business email on your own domain. The same goes for the contact address held by your domain registrar, since that is exactly where expiry warnings land.
How to ask your provider for access
None of this needs the tone of an impending break-up. Providers who work honestly treat the request as routine, because they would rather have a client who knows what they own.
Write briefly that you are tidying up your company records, and ask for four things: confirmation of who the domain registrant is, administrator rights in Analytics and Search Console, the owner role on your Google Business Profile, and a complete copy of the site including photos at original resolution.
What you do not need, and should not argue about: root level access to the server, accounts inside the provider’s own tools, and the licence to a commercial theme bought for a single deployment. If, on the other hand, your request about the domain registrant is met with silence or a refusal, you have just answered a question you may already have been asking yourself.
The other half of the problem: dates
Access is one thing, payments are another. A domain expires every year, and nobody will ring you about it if the email went into a void. A .pl renewal runs to roughly a hundred and twenty zloty a year, which makes it small enough to slip your mind and important enough that missing it takes your business off the internet.
Put three recurring reminders in your calendar: the domain renewal, the hosting payment, and an annual review of the whole access list, ideally alongside your yearly accounts. Turn on auto-renewal at the registrar, then check that the card attached to it has not expired, since a dead card is the most common reason auto-renewal quietly fails. What you are actually buying under each of those line items is explained in hosting, domain and SSL in plain language.
How this looks with us
At Sitario the puzzle is smaller by design. We register the domain in your name, so the registrant is you rather than us. You can download the complete source of your site from the panel with one click and host it anywhere, including the day you decide to leave. You edit the content yourself in the editor, so there is no third party holding the password to your own price list. A business website costs PLN 249 as a one-off including the first year of hosting, and renewal from the second year starts at PLN 149 a year.
Honestly though, that shortens the list rather than removing it. Your Google Business Profile, your social accounts and your mailboxes stay on your side, because they are yours and that is how it should be. You still need to keep the access table. It just has fewer rows in it.
Where to start tonight
Block out one evening and do four things in order. Check WHOIS to see who the registrant of your domain is. Log in to your Google Business Profile and confirm that your role there says owner. Set up a password manager and move everything you find along the way into it. Put the renewal dates in your calendar.
If that evening reveals something you do not have, that is good news. You are finding out on a quiet Thursday rather than on the day a customer tells you your site will not open.