The five website keys every business owner should hold

Why start by sorting out your website's keys?

Because on the day something breaks or you switch vendors, you can't move until you know who can open which door. Sorting this out isn't a technical job. It's about contracts, names on accounts and contact details.

1. Domain: your company's internet address. Whose name it's under, and when it renews
2. Hosting: the home your website lives in. Who holds the contract and the dashboard login
3. WordPress admin: the key that opens every door inside your website
4. Email: the mail sent to and from your company address. Who creates the accounts
5. DNS: the signpost that connects your address to your website and your mail

For all five, you only need to write down: where, under whose name, and who can get in. This checklist is as of October 25, 2026.

Names before tech.

Jeensuk's takeIt's fine for your vendor to hold the keys. But you should know where they are.

Key 1: Whose name is your domain under, and when does it expire?

Check who the registrant (the legal owner) of your domain is and when it expires. Also check which email address gets the renewal reminders.

For domains such as .com, ICANN's rules say "registrars must notify the registered name holder of the expiration at least two times": about a month before and about a week before. If the domain lapses, the registrar has to interrupt it before deleting it, and after deletion there's a 30-day "Redemption Grace Period" to restore it.¹ If those reminders go to a former employee's or old agency's inbox, your website and company email could both go dark without anyone noticing.

Registrars must notify the registered name holder of the expiration at least two times. — ICANN, Expired Registration Recovery Policy

Jeensuk's takeYour domain is your company's nameplate. If the nameplate is under someone else's name, the house may be yours, but the mail goes to them.

Key 2: Who holds your hosting contract, and where?

Check the name of your hosting company and whose login controls the hosting dashboard (hosting is the rented space where your website's files live).

The hosting dashboard is the key to the house itself. Whoever has it can change PHP versions, read files and reset passwords. So it matters who holds it.

Jeensuk's takeSometimes the bill goes on your card while the contract is in the agency's name. Check that the person paying and the person holding the key are the same.

Key 3: How many WordPress administrators do you have?

Keep WordPress administrator accounts to the people who truly need them. An administrator holds the key to everything inside the site.

WordPress.org defines an Administrator as "somebody who has access to all the administration features within a single site." An Editor "can publish and manage posts including the posts of other users," and an Author "can publish and manage their own posts."² If admin accounts are still open for a former employee, a past agency or a friend who fixed something once, that's how many doors are standing open.

Jeensuk's takeThe more copies of a key you make, the handier it is, and the more places it can get lost.

Keys 4 and 5: Where are your email and DNS managed?

Check which service creates your company email accounts, and where your DNS (the settings that connect your domain to your website and mail) is changed. The two are linked.

DNS is like the post office's address board. It sends website visitors to your host and mail addressed to your company to your email service. Whoever can change that board can reroute both your website and your mail.

There's one more thing to check for email: the settings that prove your mail is really from you (SPF, DKIM and DMARC). Gmail asks every sender to "Set up SPF or DKIM email authentication for your sending domains."³ Yet when the FTC looked at 11 hosting companies aimed at small businesses in 2018, "only two of the web-hosting companies implement SPF or DKIM by default," and "none offer support for DMARC as a standard feature."⁴ Leave it to the defaults and it may be missing.

Jeensuk's takeYou can't see DNS, but every road your company uses passes through that intersection. At least know who can change the traffic lights.

How do you put it all on one page?

Copy the table below into a company document and fill it in. Don't write passwords in it; keep those in a password manager or somewhere equally safe.

If there's a box you can't fill, ask your developer: "Could you send me a table showing where our domain, hosting, email and DNS are, and whose name each is under? I don't need any passwords." Asking isn't rude. It's the basics of any contract.

1. This week, 30 minutes: block 30 minutes on your calendar and fill in just the first two rows, domain and hosting.
2. If a renewal notice arrives: write down who receives it and who pays.
3. If a person or vendor changes: pull out this table and update who can get in.

If all five keys turn out to be in your company's name and managed by someone you can reach, that's enough. Nothing more to hand off. Wherever a box stays empty or you get stuck, that's the part that's hard to do alone.

Jeensuk's takeSorting this out isn't suspicion. It's preparation. The better the vendor, the happier they'll be to fill in this table.