Who Should Have the Logins to My Website?

You should. The business owner should hold the main login for every part of the website, using an email address the business controls, and everyone else (a designer, a staff member, me) should get their own separate login with only the access their job needs. If you are not sure who holds your logins today, that is worth finding out soon, because it is much easier to sort out while everyone is still friendly and easy to reach.

Your website has more than one set of logins

It is easy to think of your website as one thing with one password. In reality there are often three separate places, and each has its own login.

• Your domain account. This is where your web address is registered. Think of it as the deed to your shop's name.
• Your hosting account. This is where your website's files live. Think of it as the building the shop sits in.
• Your website dashboard. This is the area where you edit pages, change opening hours, and add photos. Think of it as the shop floor.

There are often extras too: your business email, your online booking or payment tools, your social media accounts, and any tool that counts your visitors. Each one is a door, and it is worth knowing who has a key to each.

Why ownership matters so much

When a website is first built, the person building it often creates the accounts for speed. They use their own email address, because it is right there and it gets the job done. Nobody means any harm by this. But years later, that designer may have moved on, changed their email, or stopped answering messages, and your domain or hosting is tied to an inbox you cannot reach.

That is the situation I most want to help owners avoid. If the accounts are in your name, you can always make changes, hand things to someone new, or walk away from a person who is no longer a good fit. If they are not, you may be asking for permission to access your own business.

Who should hold what

Here is how I like to think about it.

You, as the owner. You should be the registered owner on the domain and hosting accounts, with an email address that belongs to the business and not to an individual employee or outside helper. You should also have an administrator login on the website dashboard.

Your web designer or developer. They do not need your personal login. Many dashboards and accounts let you add another person with their own username. That way you can see who did what, and you can remove them later without changing anything for anyone else.

Your staff. Someone who posts news or updates the menu does not need the power to delete the whole site. Give them the lowest level of access that lets them do their job. Many website dashboards, WordPress among them, have roles for exactly this purpose.

Me. When I look after a site, I work through access that you grant. You decide what I can see and change, and you can take that access away whenever you like. I think that is how it should be for anyone who helps with your site.

A simple setup you can do this week

You do not need to be technical for this. Set aside a quiet hour and go through these steps.

1. Write down the three places. Find out which company holds your domain, which holds your hosting, and where your dashboard login page is. Old invoices and emails are a good place to look.
2. Check the email on each account. Is it an address you control? If it belongs to someone else, ask the company how to change it.
3. Turn on two step verification. This asks for a code from your phone as well as your password. It adds a small extra step that makes it much harder for a stranger to get in.
4. Use a password manager. It remembers long, unique passwords so you do not have to. Reusing one password everywhere is a common way accounts get taken over.
5. Give each helper their own login. Remove shared logins where you can.
6. Tell one trusted person where the records are. If you were unwell or away, someone should know how to find them.

What to do when someone leaves

When a staff member, freelancer, or agency stops working with you, remove their access that same day if you can. Then change any password they may have known. Because you gave them their own login instead of sharing yours, this takes a few clicks and does not disrupt anyone else.

It also helps to review the list of users on your website dashboard every so often. Old accounts that nobody uses are easy for people to forget, and forgotten doors are the ones worth closing.

Common questions

Should I just give my designer my own password?

It is better not to. Ask them to create or accept their own login instead. That keeps your account safer, shows who made which changes, and lets you remove them cleanly later.

What if I am already locked out of an account?

Start by contacting the company that holds the account and asking how they verify ownership. They will usually want proof that the business is yours. I cannot promise how smoothly it will go, but having old invoices and your business details ready usually helps.

Do I really need a password manager?

You do not have to, but I recommend one. It lets you use a different strong password for every account without having to remember them all, which is hard to do by hand.