Who's Got the Keys? A Digital Custody Audit for Small Business Owners

Picture this: it's a Tuesday morning, your website is down, and you need to fix it fast. You reach for the phone to call the person who built it — and that's when it hits you. You don't have their login. You don't have the hosting password. You might not even be sure which company hosts the thing.

If that scenario makes your stomach drop a little, you're in good company. We hear versions of this story all the time from small business owners across the country. The website works fine day to day, so nobody thinks about who actually holds the keys. Until, of course, they do.

The Quiet Problem Nobody Talks About

Here's how it usually happens. A few years back, you hired a freelancer you found through a friend of a friend, or maybe a nephew of a colleague, or a small agency with a nice pitch deck. They were great. They built the site, set up the hosting, registered the domain, wired everything together — and then went back to their life.

The catch? A surprising number of them did all of that under their own accounts. Their email address on the domain registrar. Their credit card on the hosting plan. Their login on your WordPress dashboard. From your perspective, everything looks normal. From a legal and practical perspective, you may be renting your own storefront.

This isn't usually malicious. Most designers aren't scheming to hold your website hostage. But when a freelancer moves, changes careers, stops answering emails, or — worst case — passes away, the paperwork matters more than anyone's good intentions.

Run a Digital Custody Audit This Week

You don't need to be technical to figure out where your website actually lives. You need an hour, a cup of coffee, and a spreadsheet. Here's the checklist.

1. Find out who owns your domain

Go to a WHOIS lookup tool (ICANN's lookup at lookup.icann.org is free and straightforward) and type in your web address. The results will show the registrar — GoDaddy, Namecheap, Google Domains, whoever — and often the registrant contact. If the registrant is your designer's name or their company, that's your first red flag. The domain is the single most valuable asset here; whoever controls it controls whether customers can find you at all.

2. Identify your hosting provider

Your domain and your hosting aren't always in the same place. If your designer manages hosting for you, ask directly: whose name is on the account? Is it billed to your card or theirs? If you're not sure where to even start looking, the answer to the domain question usually gives you a trail to follow.

3. Check your CMS access

Can you log into your own WordPress, Squarespace, Shopify, or Wix dashboard — right now, without asking anyone? If the answer is no, or if you've never had credentials in the first place, that needs to change this week. You don't have to touch anything once you're in. You just need to know the door is open.

4. Locate the supporting cast

Email accounts tied to your domain, SSL certificates, third-party plugins with paid licenses, analytics accounts, backup services — each of these is another set of credentials floating around in someone else's head. Make a list. You'll be surprised how long it gets.

What to Do If the Keys Aren't Yours

So the audit turned up some uncomfortable answers. Don't panic — but do act.

Start with the friendly route. Email your designer or agency and ask them to transfer account ownership to you. Most will do it without fuss, especially if you frame it as housekeeping rather than an accusation. Get everything in writing.

Put everything under your roof. Going forward, your business email should be the primary contact on your domain registrar and hosting account, and the payment method should be yours. Designers and developers can have their own logins as collaborators — but you're the account owner. That distinction is everything.

Turn on two-factor authentication — and keep the backup codes yourself. Handing over a password isn't enough if the recovery phone number belongs to someone who's gone AWOL.

Keep a credentials document somewhere safe. A password manager works. A printed sheet in a fireproof drawer works too. Whatever you choose, update it whenever something changes.

A Word on the Rebuild Tax

Here's the hidden cost of getting this wrong: when a website can't be recovered, it often has to be rebuilt from scratch. That's not just the design fee — it's lost search rankings, broken links, downtime, and the general chaos of explaining to customers why your site looks like a construction zone. Compared to that, an hour with a spreadsheet looks like a bargain.

Make It a Habit

Once you've done the audit, put a reminder on the calendar to review it once a year. People change jobs. Companies get acquired. Email addresses get retired. A quick annual check keeps your custody picture current.

Your website might be the hardest-working employee you have — showing up nights, weekends, and holidays without complaint. It deserves an owner who knows where it lives and who has the keys. Take the hour. Do the audit. Future you, standing calmly in front of a Tuesday-morning emergency, will be very grateful.