Website Governance and Continuity: Who Controls Your Site If Things Go Wrong?

Website governance means writing down who controls your domain, hosting, code, and business accounts before a dispute or a death forces the question. The accounts to secure are the domain registrar login, the hosting account, the code or CMS admin, and the Google and social logins. Every one should sit in the company's name, not a person's. Without that record, a locked-out business can lose access to its own site for weeks.

Most owners only discover the gap at the worst moment. A director leaves, a founder passes away, or a former developer stops replying.

Who controls your website right now?

Right now, someone holds the logins to your domain, hosting, and business accounts. In many companies, no one is quite sure who.

The accounts that decide control are more numerous than most owners expect.

Account	Who should own it	Why it matters
Domain registrar	The company	Controls renewal and transfer of the domain
Hosting or cPanel	The company	Holds the site's files and email
Code or CMS admin	The company, with vendor access	Where changes get published
Google Business Profile, Search Console, Analytics	The company	Your map listing and search data
Social and payment gateway	The company	Public presence and money coming in

The hosting account and the Google Business Profile are the two most often left in a vendor's hands. Clients often cannot say whether they own their domain, hosting, or code, and that uncertainty is the real risk.

The first thing we check when an owner is unsure is whose name the domain and hosting actually sit under.

What happens when directors disagree?

When directors fall out, whoever holds the account logins controls the website, whatever the paperwork says about who paid. A domain sitting in one director's personal name can be held over the company.

The fix is structural, and it works best before any dispute. Register the domain and hosting in the company's name, tied to a shared company email rather than a personal Gmail.

Store the passwords in a manager the company controls, so access never depends on one person's goodwill.

What happens if the founder or web person leaves or passes away?

If the one person who set everything up leaves or passes away, the business can lose access to its own site. Regaining it means proving ownership to the registrar, which takes weeks at best.

This is where a domain registered in the company's name and a company-owned recovery email earn their keep. Recovering a personally-registered domain after an owner's death can run to weeks of back-and-forth with the registrar (an illustrative timeline, not a fixed process).

We have seen a business locked out of its own site because a former vendor held the accounts. In one case, a previous provider refused to transfer the domain and Google Workspace even after a police report.

How do you put governance in place in an afternoon?

You can close most of the risk in a single sitting by recording and re-homing a handful of accounts. None of it needs technical skill, only access and a decision to keep control with the company.

• Register the domain and hosting in the company's name, using a company email as both the account and the recovery address.
• Store every login in a shared password manager, not a notebook or one person's memory.
• Keep the registrar and hosting contact details current, so renewal notices reach the company. A lapsed domain is one of the running costs people forget, and it can take a site and its email down together through its DNS records.
• Write down where the code lives and who is allowed to deploy it.
• Keep independent backups the company can restore without the original vendor.

Common governance mistakes

These arrangements look fine until the day they are tested. Each puts control of a business asset in the wrong hands.

• The domain sits in a staff member's or vendor's personal name.
• A personal Gmail is the account and recovery email for everything.
• One person holds every password, with no backup access.
• No one has written down what exists or where it is hosted.

Frequently asked questions

Should the domain be in my name or the company's?

The company's name, in almost every case. A domain is a business asset, so registering it under the company keeps it with the business when anyone leaves. Registering it personally invites a dispute later, even between people who trust each other today. Use a company email as the account address, so control never depends on one individual's inbox.

What if a former developer or agency holds our accounts?

Ask for a full handover in writing, listing the domain, hosting, code, and every Google account. A professional provider transfers them without drama. If they refuse, you may need to prove ownership to the registrar or host to recover access, which is slow and sometimes needs legal help. The lesson for next time is to hold the top-level accounts yourself and grant others access.

Who should have access to the domain and hosting?

The company should own the top-level accounts and grant working access to whoever needs it. Your developer can have admin rights to build and maintain the site without holding the registrar login that controls the domain. This split lets you change vendors without losing anything. Ownership of these accounts is also part of what you are paying for in a build.

What is a website continuity plan?

A website continuity plan is a short record of what digital assets you own, where they live, and who can reach them if a key person is unavailable. It usually lists the domain, hosting, code, email, and business accounts, plus the recovery contacts and where the passwords are stored. Kept current, it turns a potential crisis into a lookup. It belongs with your other business continuity documents, not only in one person's head.

Can we recover a domain if the owner has passed away?

Sometimes, but it is far harder than keeping the domain in the company's name to begin with. If it was registered personally, the registrar will ask for proof that the business is entitled to it, which can involve estate documents and delay. A domain held under the company transfers through normal business processes instead. This is the strongest reason to fix ownership while everyone is present.

Owning your website before you need to prove it

Storming Solutions builds and maintains websites for Malaysian businesses from Kuala Lumpur, and hands over every account in the client's own name. We think a business should be able to walk away from any vendor, including us, without losing its domain, its email, or its site.

Not sure who currently controls your domain and hosting? Ask us to help you map it on WhatsApp or book a short call, then see how we work on our web development service page.