If you cannot name the account that controls your domain, you do not yet have a complete website handover. The same applies to DNS, hosting, email and WordPress. A supplier can do the day-to-day work, but the business needs a reliable way to authorise changes and recover access.
For the full operating framework, start with our small-business website continuity plan.
This audit is for a small business preparing for a designer handover, staff change or hosting review. You can do most of it without changing a live setting. Record account ownership and a recovery route; do not collect passwords in a shared spreadsheet.
Start with the domain, then follow the dependencies
Look up the registrar shown on your renewal invoice or in the domain account. Confirm the registered business or authorised contact, billing method, renewal date, login recovery address and who can approve a transfer. Keep the account under business control. The NCSC warns that control of a public domain affects website and email services and recommends protecting the management account. Source: NCSC, Protecting your public domain name.
The registrar may also host DNS, but it need not. Ask where the authoritative DNS zone is managed and who can view its current records. Avoid changing nameservers to “tidy things up”: that one action can affect web and mail routing. If a change is actually needed, use a dated record of the current values and a planned test. Our domain renewal and DNS change checklist covers the change itself.
Next identify the website host and the email provider separately. One invoice may bundle them; two suppliers may share a domain. Check who has account-level access to each, what support will discuss with an authorised person, and how a replacement maintainer would reach the website files and database. Our hosting move guide shows why a website move should not silently become an email move.
Build a control record the business can use
| Service | Account and owner to record | Evidence to keep |
|---|---|---|
| Domain registration | Registrar, business administrator, renewal and recovery contact | Current invoice and account screen |
| DNS | Zone provider and authorised change contact | Dated export of key settings |
| Website hosting | Plan, business account and support route | Backup scope and billing record |
| Business email | Mailbox administrator and recovery route | Provider and recipient list |
| WordPress | Administrators and update owner | Access list and maintenance scope |
| Forms, analytics and licences | Connected account and billing owner | Service inventory |
Do not publish this record or place credentials in it. Store it in the business’s normal secure records, with access for the people who will act on it. Record roles and account locations; use the provider’s secure access controls for logins. Review former staff and supplier access through the relevant provider rather than circulating a shared administrator password.
WordPress access is only one piece
An administrator login lets someone manage WordPress, but it may not let them renew the domain, edit DNS, restore hosting backups or access the mailbox that receives form notifications. Likewise, owning the domain does not guarantee you have the site’s media library or licences. Ask the current provider which systems they control on your behalf and which are already in your organisation’s account.
Separate a legitimate supplier-managed arrangement from a lockout. A designer may hold delegated access to make changes; the issue is whether the business can identify the owner, authorise another provider and retrieve the needed assets and settings under the agreement. If contracts or ownership of particular design work are uncertain, review the signed terms rather than assuming every file or licence transfers automatically.
Check recovery without causing a lockout
For each account, verify the current recovery email and authorised contact from within the provider’s account screen or by asking the account owner. Do not trigger password resets merely to test the list. Confirm that two appropriate business people know how to find the recovery process. For powerful accounts, use the provider’s supported security controls and avoid sharing one login.
Test the business path separately: a harmless labelled form enquiry should reach the agreed inbox and be answered by the right person. If it does not, follow the form-delivery diagnostic rather than assuming the web host is at fault.
When the audit points to a buying decision
Do not replace a functioning host just because its name is unfamiliar. Change hosting when the evidence shows a real gap in support, recovery, limits or operational fit. Our shared versus managed WordPress guide helps compare responsibility. If a managed WordPress platform fits the brief, Krystal’s managed WordPress options are one route to check; its current product page says email mailboxes are separate add-ons. Compare that total arrangement with what you already pay for and who will still maintain the business-specific site.
If your main gap is missing handover information, request the documents and access first. The website handover checklist lists what to receive and test at the end of a build. For a Formby or Freshfield business considering a new site or a transfer, our web design service can be a starting point for a scoped discussion, with the account record in hand.
