How do I make sure my business owns its online accounts?

The short version

• Your domain, hosting, email, Google profile, analytics and social pages are business assets. Treat them like your phone number or your sign.
• Each should be registered to the business and controlled from an account the business owns.
• You hold the top-level access, with two-step login. Staff and vendors get their own lower-level logins.
• Keep a private asset register: what each account is, who owns it, who has access, and when it renews.
• Clean up access the day someone leaves, and review everything once a year.

Which accounts does my business need to own?

Here’s the list most small businesses should check, and what goes wrong when you lose control of each one. Our answer on which logins you should have covers the eight core accounts in brief.

Why does ownership go wrong?

It almost never starts with bad intent. It starts with convenience:

• A web designer registered the domain “to save you the hassle,” in their own account.
• An employee set up the Google profile with their personal Gmail, then left.
• An agency created the analytics account under its company.
• A relative made the Facebook page years ago, and nobody has the password.
• Renewal emails go to an address nobody reads anymore.

Each is fine until the day you need it. Then it can take weeks to untangle, usually at the worst moment.

How do I check and fix my domain?

Your domain comes first, because your website and your email both depend on it.

Check who holds it

1. Look up the domain at ICANN’s lookup tool, lookup.icann.org. The Registrar field shows which company manages it.
2. Sign in to that registrar account. If you can’t, find out who can.
3. Check that the registrant is your business, and that the contact email is an address you control.
4. Turn on auto-renew, and check the card on file. ICANN’s page on registrant responsibilities says that if you choose auto-renewal, you must keep your payment information current.
5. Turn on the registrar lock and two-step login.

ICANN also says you must keep your contact details right and “promptly update” them. You must answer your registrar within 15 days when it asks you something. If the contact email belongs to someone who left, those messages and renewal notices go nowhere. Our answer on what happens if a domain expires explains what follows.

Move it into your control if you need to

If the domain sits in someone else’s account, it can usually be moved. ICANN’s transfer FAQs explain the rules as they stand today:

• Moving to another registrar needs an authorization code, sometimes called an auth or transfer code. Your registrar must give it to you within five calendar days of your request.
• You can’t move a domain to another registrar within 60 days of changing the registrant name, organization or email, unless your registrar offers an opt-out.
• Registrars may also refuse a transfer within 60 days of first registration or of a previous transfer.
• Both the old and new registrar confirm the transfer with you.

If timing matters, plan around those 60-day windows. Our help article on transferring a domain has the steps, and our answer on who should own your domain covers what to do if someone won’t hand it over.

How do I sort out Google Business Profile access?

Every profile has a single primary owner, and it can also have other owners and managers. Google’s owners and managers page says owners have full control, including adding and removing people, while managers can do most of the work but can’t add or remove users or remove the profile.

Make the business owner the primary owner, add one trusted backup owner, and make staff and agencies managers. Two details catch people out. New owners and managers must wait 7 days before some actions, such as taking over as primary owner. And a primary owner can’t leave until they’ve handed that role to someone else. Our guide to owners and managers shows the clicks.

What about hosting, email, analytics and social accounts?

• Hosting. The account should be in your business’s name, or you should have your own full login. If your web company hosts the site on its own account, get it in writing that you can have a full copy and move it when you choose. See how to move to a new host.
• Website admin. Have your own administrator login. Don’t rely only on your developer’s.
• Business email. Hold the admin account, so you can add and remove mailboxes when people join or leave.
• Analytics and Search Console. Create them under a business Google account, then add your web company as a user.
• Social pages. Make sure at least two trusted people in the business are admins, so one person leaving can’t lock you out.

How do I keep these accounts safe?

Ownership doesn’t help much if the account is easy to break into.

Two-step login everywhere. CISA’s MFA page describes it as needing two or more proofs before access, and says people who use it are “significantly less likely to get hacked.” Start with email, because whoever controls your email can usually reset every other password. Then the registrar, hosting, Google accounts, website admin, social admin and payment tools. Our answer on two-factor authentication helps you pick a method.

Long, unique passwords in a password manager. NIST’s current guidelines say a password that is the only lock on an account should be at least 15 characters. They say not to force symbols or routine changes. Change a password when there’s a sign it was exposed. And password managers should be allowed. Our answer on managing business passwords covers the setup.

Business addresses for business accounts. Register important accounts to an address the business controls, such as admin@yourbusiness.com, not to one employee’s personal Gmail.

Separate logins, not shared ones. Our help article on sharing access safely shows how to add people on common services.

How do I make an asset register?

This is the step that ties it all together. Make one simple document and keep it in your password manager or another secure place. For each account, record:

• What it is, for example “Domain: yourbusiness.com.”
• Where it lives: the registrar, host or service.
• Which account owns it.
• Who else has access, and at what level.
• The renewal date and payment method, if any.
• Where the login and recovery codes are stored.

Never put actual passwords in a plain document. Point to where they’re kept.

What should I do when someone leaves?

Access is easiest to clean up on someone’s last day, whether they’re an employee, a contractor or a vendor.

• Remove their access to the website admin, hosting and registrar.
• Remove them from your Google Business Profile, Analytics and Search Console.
• Remove them as an admin on social pages.
• Turn off or reassign their email account, and forward it to someone who stays so customer messages aren’t lost. See removing an email account.
• Change any shared password they knew, then replace shared logins with individual ones.
• Make sure renewal notices and alerts don’t go only to their address.
• Update the asset register.

If the person leaving is the one who knows where everything is, ask them to walk you through the register before their last day.

What are the most common mistakes?

• Letting a vendor register the domain in its own name.
• Setting up the Google profile on a personal account.
• Sharing one admin login among staff and vendors.
• Renewal notices going to an old address, or an expired card on file.
• No backup owner, so one person’s absence locks everyone out.
• Keeping passwords in a spreadsheet or an email.

What if I’m locked out, or a former vendor won’t respond?

Don’t open new accounts to work around it, and don’t give up. Registrars and Google have ways to prove ownership. Start with the registrar’s support team, with documents showing you own the business. For Google Business Profile, request access to the existing profile rather than making a second one; our guide on creating or claiming your profile explains how. It takes time and paperwork, which is why sorting it out while relationships are good is far easier.

How long does it take?

Building the asset register takes an afternoon for most small businesses. Turning on two-step login takes a few minutes per account. Moving a domain or recovering a profile can take days or weeks, depending on who controls it now and the registrar’s and Google’s checks.

How does E-3 handle this?

The domains we manage stay in the client’s name, and accounts we set up are created under your business, with E-3 added as a user. Adding or removing a person’s access to edit a website is one of the more common requests in our support records, with about 100 since 2019, so we make it a routine job. Our free domain and SSL checker shows when your domain renews.

Related questions

• What logins should I have for my own website?
• Who should own my business domain name?
• How should my small business manage passwords?
• How do I share logins with staff and vendors safely?

Sources

1. Registrants' benefits and responsibilities (ICANN)
2. FAQs for registrants: transferring your domain name (ICANN)
3. Manage your Business Profile owners & managers (Google Business Profile Help)
4. More than a password: multifactor authentication (CISA)
5. NIST SP 800-63B-4: Digital identity guidelines, authentication (NIST)