Who has the keys to your website and online accounts

Most owners find out at a bad moment. A web designer moves on or the employee who looked after the online side leaves, and a few weeks later someone needs to change the opening hours or fix a contact form that stopped sending. For a business in South Florida that moment often arrives with a storm warning, when the listing needs to say "closed tomorrow" before customers start driving over, and for a shop in Greater Manchester it might be bank holiday hours or a new phone number after a move across town. Then nobody can log in. The account was set up with that person's email and the security code goes to their phone, so the business that paid for everything now has to ask for access to its own pages. If you have ever searched "who owns my website" late at night, you know how that feels.

The good news is that this is fixable, and it's far easier to fix while everyone is still on good terms. Below is the routine we follow when we start with a business. It takes an afternoon with a notepad and the people who currently help you, and at the end you'll know who holds every key.

Who owns my website, and what owning means online

Paying the invoice doesn't make you the owner of an account. On almost every platform, control sits with whoever created the account or whoever holds its owner role, and that is often the freelancer or agency who did the setup because it was quicker for them at the time.

A website usually has two separate logins worth caring about. The hosting account is where the site lives and where it gets billed, and the site admin is where pages are edited. The domain name is another piece with its own rules (we cover it in a separate article), so for now just note who holds it. The tool that counts your visitors sits inside an analytics account that belongs to someone's login. Your Google Business Profile has owners and managers, and your social pages are usually controlled from a business settings area where people are given roles.

Step one: list every account

Start with a plain list. Paper is fine, but a spreadsheet is better because you'll keep updating it. Work through these groups:

• Website: the hosting account and the site admin login, plus any paid add-ons that came with their own account.
• Measurement: the analytics account that counts your visitors, and any ad accounts linked to it.
• Listings: your Google Business Profile and any map or directory listings you have claimed.
• Social pages: each social page or profile, along with the business settings area that controls it.

For each account, write down four things: what it is, which email address logs in, who holds the owner role and who else has access. You may not know all of it yet, and that's the point of the exercise. Leave blanks and fill them in as you check.

Look closely at the login emails. In our experience, a personal address that belongs to a former helper is the most common problem, and a close second is an address tied to one employee's name at your own company. What good looks like is a shared business address that you control, something like admin@ or office@ at your own domain, that will still exist when people come and go.

Step two: check that the business holds the owner role

Now log in to each account (or sit beside whoever can) and look at the access screen. Menu names shift from time to time, so look for words like users, people, roles or access.

• Site admin: open the users screen and look for an administrator account under the business email. Try logging in with it yourself before you tick it off.
• Hosting: account settings show the account holder name and the billing contact, and you want the business name in both places.
• Analytics: go to the admin area and find access management at the account level, which sits above the individual website. Your business email needs the highest role there.
• Google Business Profile: under the profile's settings, the people and access page tells you who the primary owner is, and that line should name the business.
• Social pages: in the business settings area, scroll through the people with full control and check whether the business email appears among them.

When the owner role belongs to a former helper, ask them to add the business email as an owner and then step down themselves. Most platforms make this a quick job for the current owner. If the person won't respond or the account was abandoned, platforms usually have an ownership request process, but it can be slow and you'll need proof such as business registration papers or a utility bill at the listed address. That's the main reason to do this while relationships are friendly.

Step three: add a second admin and lock down recovery

Every important account should have two people with top-level access, for example the owner and a trusted partner or manager. With only one admin, the business is stuck again the day that person loses their phone or leaves.

Then turn on two-step verification everywhere it's offered. This is the extra code you type after your password, and it blocks a lot of the casual break-ins we see. The detail people miss is where that code and the recovery options go:

• The backup phone number should be a business line or the owner's own phone.
• The recovery email should be the shared business address from step one.
• Backup codes, the one-time codes most platforms offer, can be printed and kept in the office safe or a locked drawer by the register, or saved in a password manager that the business owns.
• If you use an authenticator app, set it up on at least two devices held by the two admins.

A code that goes to a former employee's personal phone is the same old problem wearing a new coat, so open each account's security settings and change anything that points to a person who might leave.

Step four: give helpers their own logins

Sharing a password feels quicker, and it creates trouble later. You can't tell who changed what, and you can't remove one person without changing the password for everyone. The two-step code also tends to end up on whichever phone was set up first.

Almost every platform lets you invite someone by email and give them a limited role. A web helper can be an editor on the site without touching the hosting. Someone who reports on visitors can have view access in analytics. A social media helper can be added as a manager on the business listing and given a page role in business settings. A bookkeeper who only needs to see ad spend can be given billing access and nothing more. Give each person the lowest role that lets them do the job, and you stay the owner throughout.

The payoff shows up when someone leaves. You open your list and remove their access from each account the same day, then change any password they might have known, and everything else keeps working. Put a reminder in your calendar every few months to compare your list against what each platform actually shows, because roles drift as people get added for one-off jobs and never removed.

How Pixedi handles this in Care

Watching the business's online accounts is part of our Care plan, which is $250 a month. When we start, we build the account list with you and check who holds each owner role, and the monthly report notes any change in who has access. We work only through logins you invite us to, so the business stays the owner of every account. The plan can be cancelled with 30 days written notice, and leaving is a matter of removing our access.

Your next step

Pick one account today, and make it your Google Business Profile because it's the one customers see first. Open its people and access settings and check who is listed as primary owner, then write that at the top of your new list. If the name there belongs to someone who no longer works with you, send them a short, friendly message this week asking them to add your business email as owner.

Ask AI about this article

Opens the assistant in a new tab with this page as the source.

ChatGPTClaudePerplexityGemini