Who actually controls your website? A checklist for business owners

Ask a room of business owners who controls their website and most will name a person: the developer, the agency, 'the hosting company'. Ask who controls the domain, the DNS, the admin account, the analytics or the backups, and the room goes quiet.

This is not a failure of diligence. Websites are assembled over years by different suppliers, and control drifts quietly into other people's accounts. It only becomes visible when something goes wrong: a renewal is missed, a supplier disappears, or a site goes offline and three companies each say it is someone else's problem.

The six things that must be answerable

If you can answer these six questions without emailing anyone, your setup is in better shape than most:

• Domain — which registrar is it registered with, and whose account is it in?
• DNS — who controls the nameservers and records that point your domain at your website and email?
• Hosting — which company hosts the site, and who can log in to that account?
• Website admin — who has administrator access to the CMS, and whose email owns it?
• Backups — where are they, how far back do they go, and when was one last actually restored?
• Analytics and Search Console — whose accounts collect the data, and can you get into them?

Why the answers matter commercially

Each of these is a single point of failure. A domain in a former employee's personal registrar account can hold the whole business to ransom when it expires. DNS you cannot edit means every email or website change waits on a third party. Backups that have never been restored are a hope, not a plan.

None of this is exotic. It is the same operational hygiene you would expect of any business-critical system — it just rarely gets applied to websites because they grew out of a marketing budget rather than an IT one.

What to do about it

Start by listing what you know, then close the gaps one at a time: recover registrar access, consolidate DNS into an account you control, make sure at least two people hold admin access to the CMS, and check that backups exist and can be restored.

If that sounds like a fortnight of awkward emails with former suppliers, it often is — which is exactly why website takeovers exist. A structured audit does this work once, documents it properly, and leaves you with a record that stays useful whoever looks after the site next.