Website and domain accounts: keeping logins safe

The safety of your website mostly comes down to a few logins: the domain account, the website or hosting account, the email admin account, and your Google Business Profile. Keep each one in your own name, with a unique password stored in a password manager, recovery details that reach you and not someone else, and helpers given their own access instead of your password. That covers most of what goes wrong for small businesses.

The accounts that actually matter

Not every login is equal. These are the ones that, in the wrong hands, can take your website or email away:

Domain registrar (GoDaddy, Namecheap, Network Solutions and so on). Whoever controls this controls where your website and email go.
Website builder or hosting account. Whoever controls this can change or delete the site.
Email administrator account (Microsoft 365, Google Workspace, or the host's mail panel). This can reset every other password, because most "forgot password" links arrive by email.
Google Business Profile. Your name, hours, phone and reviews on Google Search and Maps.
DNS provider, if it is separate from the registrar, such as Cloudflare.
Social pages and the payment tools linked from your site.

Write these on one sheet: the company, the login email, and who else has access. Most owners are surprised by at least one entry, such as an account opened years ago under an employee's email.

Use a password manager, not a notebook

A password manager is an app that remembers every password for you, behind one strong master password. It fills in logins on your phone and computer, and it creates long random passwords so you never reuse one.

Good options include the one built into your phone (Apple Passwords on an iPhone, Google Password Manager on Android and Chrome) and standalone apps like Bitwarden or 1Password, which work across every device and can share selected logins with a family member or employee.

What matters more than which one you pick:

Every important account gets its own password. When one website you used years ago leaks its passwords, a reused password opens your domain account too.
The master password is long and memorable, like four or five ordinary words strung together, and written down once, kept somewhere physically safe at home.
Someone you trust knows how to get in if you are ill or away. Most managers have an emergency access feature for this.

Check who the account belongs to

The login email on each account is the real owner, whatever the invoice says. Look for these problems:

The account is under your web designer's or an old employee's email. Ask them to change the account email to yours, or to transfer the domain or site into an account you open. When a domain is registered in an old employee's name covers that situation.
The recovery email is an old address you no longer read, such as an internet provider's email you closed when you switched providers.
The recovery phone number is a landline or someone else's mobile.
The recovery email is on the same domain the account controls. If the domain lapses, the reset email has nowhere to go. Use a personal address on a different provider as the recovery address for your domain account.

Give helpers their own access

When a web designer, an assistant or a nephew needs to work on your site, the temptation is to send them your password. Do not. Almost every service lets you invite another person with their own login:

Registrars usually call it delegate access or account users.
Website builders call it contributors, collaborators or site members.
Google Business Profile has owners and managers. Make helpers managers, and keep yourself as the primary owner.
Email admin consoles let you create a separate admin user for the person who sets up mail.

Their own login means their own actions are recorded, you can remove them in one click, and changing your password never locks them out halfway through a job.

When someone leaves

Treat it like handing in keys. The same week someone stops working with you:

Remove their access to the registrar, website, email admin and Google profile.
Change any password they knew, starting with email and the domain.
Check that no recovery email or phone on your accounts is theirs.
If they had their own mailbox on your domain, keep it and forward it to you rather than deleting it, so customer emails still arrive.

Two-factor sign-in means a password alone is not enough to get in; a code from your phone or a security key is also needed. It stops most account takeovers that start with a guessed or leaked password. Turn it on at least for email, the domain account and the website account. Two-factor authentication for your domain and email walks through each step and what to do about backup codes.

Strong passwords do not help if you type them into a fake page. Scam emails about your domain "expiring" or your site being "suspended" link to pages that look like your registrar's login. Always reach your accounts by typing the address yourself or using a saved bookmark. Phishing emails about your domain or website shows the common ones.

Keep a written record

Separate from the password manager, keep a short page, on paper or in a locked file, that lists:

Each account, the company and the login email (not the password).
Renewal dates and which card pays for them.
Who has access and at what level.
Where the master password and recovery codes are kept.

This is the page a family member or a buyer of your business would need, and it is the page you will want when something breaks on a Saturday.

A one-hour routine

Make the sheet of key accounts.
Install a password manager and save each login in it.
Replace any reused password on those accounts with a new random one.
Run the "forgot password" test on each and fix recovery details.
Turn on two-factor sign-in for email, the domain and the website.
Remove anyone who no longer works with you.

Once the accounts are in order, changing the website itself becomes much easier. If yours needs it, you can see your site rebuilt first, and decide only after you have looked at it.