Who Actually Holds the Keys to Your Website?

Quick quiz, no looking anything up. Where is your domain registered, and in whose name? Who can log into your hosting? If your web person vanished tomorrow — fell out with you, closed their business, simply stopped replying — could you get into your own website by Friday? If you answered all three without hesitating, you're in a small minority. Most owners hold none of their own keys and have never noticed, because nothing has gone wrong yet.

How businesses end up locked out of themselves

Nobody plans this. It accumulates. The first developer registered the domain under his own account because it was quicker. The agency set up hosting on their master account because that's their standard practice. The analytics were created under a marketing freelancer's login. Each choice was convenient at the time, and each one quietly moved a key out of your pocket. The result is a business whose entire digital presence depends on the continued goodwill, solvency and reachability of people who don't work there.

The emergencies this creates

• The disappearing developer: the site needs an urgent fix, and the only person with access hasn't answered emails in months.
• The hostage negotiation: a dispute over a final invoice, and suddenly your own website becomes a bargaining chip against you.
• The silent expiry: the domain was on someone else's card, the card expired, and your site and email simply stop one Tuesday.
• The inherited mystery: you bought or took over the business, and the digital keys belong to someone from two owners ago.

Every one of these is common, and every one is preventable with an hour of admin done in peacetime.

The peacetime audit

Make a simple register — a spreadsheet is fine — with a row for each: domain, hosting, website admin, analytics, search console, email service, booking system, payment provider. For each row record where the account lives, the email address it's registered to, and who can access it. Two rules turn the register into protection. First: the primary account for every critical service belongs to an email address the business owns — not a supplier's, not a departed employee's, not your nephew's. Second: at least two people in the business can reach each key, so no single holiday becomes an outage.

Where you find a key in someone else's pocket, ask for it back now, politely, while relations are good. 'We're centralising our accounts for insurance purposes' is a sentence nobody argues with.

Ownership is a design decision

The deeper fix is choosing suppliers whose model doesn't require holding your keys at all. When our pipeline delivers a site, the structure is yours by design: your domain in your name, your content, your analytics under your ownership, full access from day one. Lock-in isn't a feature we forgot — it's a feature we refuse, because a supplier who needs to hold your keys is telling you something about how they expect to keep you. AI does most of the work. Paul reviews everything before it ships.

Run the audit this week. It's an hour of unglamorous admin that turns your worst-case scenario from an emergency into an inconvenience.