Your website might be the thing customers see, but it’s not the thing that takes your business offline. That’s usually a login. Specifically, one of about five logins that most small businesses have never written down, never protected properly, and couldn’t recover if they lost them.
It’s worth half an hour this week to check these.
1. Your domain registrar
Whoever controls your domain registration controls everything that hangs off it: website, email, the lot. Lose it, and someone can move your domain, change where it points, or simply let it expire.
- Know where each domain is registered and which login owns it.
- Turn on two-factor authentication and registrar lock.
- Turn on auto-renew, and check the card on file won’t expire.
- For
.audomains, make sure the registrant and eligibility details (like your ABN) are right.
I go into more detail in Domain hygiene.
2. Your DNS provider (often Cloudflare)
DNS decides where your website and email actually go. Anyone with access can redirect your site or your mail in about thirty seconds, and the change is live worldwide almost immediately.
- Check who’s a member of your Cloudflare account, and remove anyone who shouldn’t be there.
- Make sure every member has two-factor authentication. A security key is best.
- Have at least two people with full access, so one lost phone doesn’t lock the business out.
- Replace any Global API Key with scoped tokens (see why).
3. Your email admin account
Microsoft 365 or Google Workspace admin is the master key to everything else, because nearly every other account resets its password by email. If an attacker gets into the mailbox that receives your registrar’s password resets, they don’t need the registrar password.
- Keep a separate admin account that isn’t used for day-to-day email.
- Two-factor on every account, not just the admin. Phishing-resistant methods (security keys, passkeys) for admins.
- Check the recovery email and phone on the admin account. It’s very common to find them pointing at a former staff member or a personal address nobody can reach.
4. Your hosting
The hosting account (or the server login) is where your website and its backups live. Same rules: two-factor, more than one person able to get in, and a note of which company it’s with and how it’s paid for.
And check that your backups aren’t stored only inside that same account. If the account goes, so do the backups. Keep at least one copy somewhere else, and check now and then that it actually restores.
5. The account that pays for all of it
This is the one nobody thinks of. The registrar, Cloudflare, hosting and email are usually paid on a card or a billing login. A card that expires, or a billing contact who left in 2023, is how domains lapse and sites go dark on a public holiday.
- Know which card pays for what, and when it expires.
- Make sure renewal and billing emails go to an address someone actually reads, like a shared accounts mailbox, not a person.
The one-page list
Put all of this on one page and keep it somewhere safe, like a password manager’s secure note (not a sticky note, and not a spreadsheet on the shared drive):
| Service | Provider | Login (not password) | 2FA on? | Who else has access | Paid by / renews |
|---|---|---|---|---|---|
| Domain | |||||
| DNS | |||||
| Email admin | |||||
| Hosting | |||||
| Billing |
If you can’t fill in a row, that’s the one to fix first.
The test is simple: if you were unreachable for a week, could someone else in the business keep the website and email running? If the answer is no, the business depends on one phone, one person or one inbox. That’s worth fixing before something forces the issue.
Want help working through the list? Get in touch and we’ll do it with you.
