Most companies only notice a login is missing when they urgently need it: the agency can't be reached, a certificate expires, or the site has to move. Then the search starts for passwords, account numbers and whoever set it all up at the time.
This checklist lists the logins that belong to a website. For each one it says what you should have and what to watch for. You don't need any technical knowledge, just an hour and your provider.
Domain and registrar
The domain is the address of your website and your email. It is registered through a registrar;
for .at domains, one of the registrars accredited by nic.at.
- An account with the registrar, with username and password
- Domain holder: your company, not the agency and not an employee in their own name
- Term and renewal: does the domain renew automatically, and which account pays for it?
The second point matters most. Whoever is registered as the holder controls the domain. If the agency is listed, ask them to change it.
DNS
DNS decides where your domain points: which server delivers the website and which one receives the email. Usually the registrar or the host manages the DNS records.
- Who manages the DNS records, and with which login?
- A current list of the records, as an export or a screenshot
That list helps most during a server move: the email records come across too, and email keeps arriving without a gap.
Hosting and server
The server holds your website's files and database.
- An account with the host, with your company as the customer
- Access to the server or web space, for example via SFTP or SSH
- Access to the database
- Where the backups are, how often they run and when one was last restored
The last point is worth pressing on. You only know a backup works once it has been restored.
Content management system
The content management system is where you edit text and images.
- Your own administrator login for the company, not just an editor login
- Which system in which version is in use, and which extensions are installed
With an administrator login you can add and remove users yourself. You will need that when an employee leaves, if not sooner.
The email addresses on your domain are often hosted by a different provider than the website.
- An account with the email provider
- Administrator access to manage the mailboxes
SSL certificate
The certificate provides the encrypted connection, the https in the address. Many hosts now
renew it automatically.
- Who is responsible for renewal, and does it run automatically?
- For purchased certificates: the account with the issuer and the expiry date
An expired certificate is quickly fixed. Until then, though, your visitors see a warning that stops many of them from reading on.
Analytics and Search Console
If you collect visitor statistics or use Google Search Console:
- Owner access for your company, not just read access
- Which services are embedded, so your privacy policy stays accurate
Search Console shows how Google finds your site and whether there are indexing problems. Your company should be the owner and give providers access as needed.
Where to keep it all
A spreadsheet on the desktop is a start. A safer setup:
- A password manager with a shared vault for the company. You can share individual logins and revoke them later.
- At least two people in the company have access, so a holiday or a staff change locks nobody out.
- An emergency copy, for example printed and kept in a safe, or encrypted in a second location.
When someone with access leaves the company, change the passwords.
Check it once a year
A list nobody maintains goes out of date without anyone noticing. Once a year, take half an hour and go through it:
- Does every login still work? Sign in rather than assume it does.
- Are the holder and the customer still correct, for example after a change of company name?
- Do people have access who no longer work for you?
- Are the card and billing address for the domain and hosting up to date?
The last point sounds trivial. But an expired credit card is all it takes for a domain renewal to fail.
What to ask your provider
You don't have to compile the list yourself. Send your provider a short request in writing:
- Who are the domain, hosting and email registered to?
- Please set up a login of our own for each account.
- Please send us a list of the DNS records.
- Where are the backups, and when was one last restored?
- Where is the source code, and how do we get a copy?
For most providers this is a routine request, answered within a few days.
Note: this is not legal advice. Your contract determines what your provider has to hand over. If questions remain, talk to a lawyer.
If you would rather not keep the list yourself: when we run your website, we document all access in one place, and you get a copy.