The Boring Folder That Could Save Your Website (and Your Sanity)

Picture the scene. You need a new email address added, or a banner changed before the bank holiday weekend. You ring the person who built your website. The number is dead. The email bounces. Suddenly a five-minute job becomes a small panic. Not because the website is broken, but because nobody can prove who owns the bits behind it.

That is why every UK small business should keep a simple ownership file. Not a 40-page technical manual. One page, kept somewhere safe, that says what you own, who has access, and when things renew. It is the difference between a calm handover and a very expensive fortnight.

Your website is a pile of accounts

Most people think of a website as the pages they see. Fair enough. But underneath, there is a chain of accounts: the domain name, the hosting, the content management system, the email service, the analytics, maybe a payment provider or booking tool. Each one has a login, a renewal date and an owner.

When those details live only in someone else’s inbox, you are renting your own shopfront. The site might look fine. But you cannot change the locks, move the sign, or prove the lease is yours. That is a risky place to be, even if your web designer is lovely and has never missed a call.

This is not about pointing fingers

To be clear, most designers and agencies handle this well. They set up accounts in the client’s name, hand over logins, and keep things tidy. The problem is rarely malice. It is drift. A freelancer retires. An agency is bought. A member of staff leaves and their old work email was the recovery address for everything. A client changes accountants, and the old accountant had the domain login. Small changes add up.

In 2026, a website is also more connected than it used to be. Your domain may point to email, your email may feed your CRM, your payment tool may talk to your accounts. One missing login can stall a lot more than a page edit.

The one-page ownership file

The file does not need to be fancy. A table in a document is fine. A printed copy in the safe, plus a digital copy in a password manager, is better. The point is to know where each piece lives and who can get to it.

Here is what to include.

Domain name and registrar

Write down the exact domain, the registrar, the account email, the renewal date, and whether auto-renew is on. For .uk and .co.uk names, Nominet is the registry behind the scenes, but you usually manage the name through a registrar. Check that the registrant email is one you control, not an old agency address. Note any transfer lock and where the authorisation code would come from. If the domain is the family silver, this is the line that matters most.

Hosting and server access

Add the hosting provider, account holder, plan, renewal date and support pin if there is one. If your site sits on a managed platform, note the owner account. If there is a control panel, say who can get in. You do not need to understand every button. You do need to know how to raise a support ticket when the site goes down on a Saturday.

CMS and website platform logins

For WordPress, note the admin URL, the main admin username and the email attached to it. For Shopify, Squarespace or Wix, note the owner account and any staff accounts. Check who holds the highest level of access. A useful test: can you add a new user without asking anyone else? If not, you do not fully control the site.

Email and DNS

Email is the quiet one that bites hardest. Note whether you use Google Workspace, Microsoft 365 or a host’s mailbox service. Who is the admin? Who can reset a password? Where are the DNS records managed? You do not need to paste the MX records into the document, but you should know where they are and who can change them. If your web designer controls DNS and disappears, email can break even if the website stays up.

Analytics, search and marketing tools

List Google Analytics, Google Search Console, Bing Webmaster Tools, your email marketing platform and any booking or CRM tool. For each, note the account owner and who has admin rights. These are not just numbers. They hold your customer data, your enquiries and your history. If you change agency, you want to take that history with you.

Payment and booking tools

If you take payments, note the provider, the merchant account holder, the payout bank details and the renewal or fee dates. The same goes for booking systems and ecommerce add-ons. Make sure the business, not an individual’s personal account, is the merchant where possible. When staff change, payment access should change with them.

Renewal dates and recovery details

Put every renewal in one calendar: domain, hosting, SSL certificate, email, plugin licences, payment gateway fees. Add a reminder 30 days before each one. Then note where the passwords live. Please do not keep a plain-text password list in the same folder as the logins. Use a proper password manager and record the recovery email and phone number. Store backup codes somewhere secure, separate from the main device.

How to build it without a big project

Start with one page and one afternoon. Ask your current web designer or host for a handover summary. Most will send it without a fuss. If you cannot get access, use the account recovery routes for each service. That may take longer, but it is better to find out now than during a crisis.

Then test it. Once a quarter, log in to the domain registrar, hosting and CMS. Check that the recovery email still works. Check that a former employee has been removed. Update the renewal dates. It is a 20-minute job that stops a 20-hour problem.

Handover, staff changes and emergencies

A good ownership file makes staff changes boring, which is exactly what you want. New marketing person? Add them at the right level. Someone leaves? Remove them the same day. Changing agency? You can hand over access cleanly and keep your history. Emergency? You have a phone number, a login and a renewal date, not a mystery.

The file also helps when you sell the business or bring in a partner. A website with clear ownership is easier to value than one tied to somebody’s personal email.

The quick test

Can you answer these without ringing anyone? Who is the registrant of your domain? Who owns the hosting account? Can you get into the CMS as an admin? Who controls your DNS? Where do your analytics live? When does everything renew? If you stumble on more than two, make the file this week.

Your website is a business asset, not a favour. Keep the keys where you can find them.