Who should control the accounts behind your website?

The business should retain appropriate owner access to the accounts that keep its website, email, and public listings running. Collaborators should receive the permissions they need through their own logins where the service supports them. Before work begins, agree on who controls renewal, recovery, publishing, and access changes.

For a small Vermont business, this is an operational task as much as a technical one. The person who updates opening hours may be different from the person who renews the domain. If everyone assumes the web designer handles both, an ordinary staffing change can leave a simple correction waiting on the wrong person.

List the services behind the visible site

Start with the domain registration, website hosting, content system, business email, and any forms or booking tools. Add the image library, code repository, and public listing accounts if they are part of your setup. Do not assume one website invoice means all of those services live in the same account.

For each service, record its purpose, the business contact responsible for it, the renewal arrangement, and how an authorized person obtains access. Keep this inventory somewhere the business can reach without relying on the website itself. It should describe accounts, not expose passwords in a shared document.

A useful test is to ask who would update winter hours if the usual editor were away. The hours consistency guide explains the publishing process; the account inventory makes that process possible. If the answer is unclear, resolve the access gap while there is time.

Distinguish ownership from editing permission

Different services use different role names. Read the permissions before choosing one. Someone who edits page text may not need the ability to remove other users, change payment information, or transfer control of the account. Give access according to the task and the service's actual controls.

For Google Business Profile, Google's owners and managers documentation explains the available roles and supports inviting people through their own Google accounts. Review that guidance when deciding which role a collaborator needs. Avoid making a shared login the default handover method.

Owner access should also have continuity. Identify an appropriate backup person within the business when possible, and confirm that recovery contact details are current. A second name on a spreadsheet does not help if that person has never accepted the invitation or cannot sign in.

Decide who can approve a material change

Publishing a new paragraph is different from changing the domain's routing or removing an account. Write down which changes need the business owner's approval. Keep the process proportionate: routine edits can follow an agreed brief, while changes affecting access, billing, or delivery deserve an explicit check.

Use a short change record for significant work. It can state what changed, who approved it, where it was checked, and how to get help if something fails. This is particularly useful when several suppliers work on the same site at different times.

Ask a supplier to explain any dependency they introduce. If a contact form relies on a service in the supplier's account, you should know what happens when the engagement ends. That does not mean every tool must be moved immediately; it means the operational arrangement needs to be understood and documented.

Keep renewal and recovery practical

Check that renewal notices reach an inbox the business monitors. Record the responsible person and the relevant date. A paid invoice in an old employee's mailbox is poor protection against a missed renewal next year.

Review account recovery through the service's normal settings. Use the security options available to your business, and store recovery material in an appropriate secure place. Do not paste passwords, recovery codes, or API keys into a public project document or a routine email thread with multiple recipients.

If an agency pays for a service on your behalf, ask how that cost is shown and how a transfer would work. Clarify any limits before you depend on the arrangement. The aim is to avoid discovering a missing step during a busy selling period.

Test access before the final handover

Have the intended business owner sign in to the important accounts and perform a small, safe task. Viewing a renewal date, opening the editor, or checking a form destination can establish that access works. Do this through an agreed test rather than changing live settings casually.

Then verify the customer-facing result of any authorized edit. The inquiry-form guide describes why seeing a form in an editor is not enough; a controlled submission must reach the intended inbox. Similar reasoning applies to a page change that has been saved but never published.

Keep a list of unresolved items with an owner and a next step. "Access sent" is incomplete if the invitation was never accepted. "Website delivered" is incomplete if the business cannot obtain its images or understand who controls the domain.

Review access when people or suppliers change

At the end of an engagement, confirm which tasks are complete, which services remain in use, and which permissions are no longer needed. Coordinate access removal so active maintenance is not interrupted. Preserve agreed records and assets before closing a tool that contains them.

Our explanation of how we work covers the relationship between the business and the team handling its search work. Bring account questions into the first conversation so responsibilities are clear before a change is needed urgently.

For help deciding which website issues deserve attention first, request a free search opportunity review. You can share page addresses and business goals without sending passwords or other private account credentials.