Who owns your website logins? A checklist before you hire anyone

Why this comes before hiring

Most small businesses get their accounts set up by someone helpful: a web designer, an agency, a nephew, the employee who was good with computers. The work gets done. The question nobody asks is whose name went on the account.

It matters later, usually at a bad moment. The rules each platform runs on show why:

• Domain renewal reminders go to the registered holder. ICANN’s rules require registrars to send them about a month and a week before a domain expires, and again within five days after if it isn’t renewed. If the registration is in someone else’s name or email, you won’t see them.
• A Google Business Profile has one primary owner, and only owners can add or remove the people who manage it.
• A Search Console owner you remove can come back if their verification token is still on your site. Google says to remove the tokens too.
• A Facebook Page needs at least one person with full control. If nobody has it, Meta deactivates the Page and schedules it for deletion.

None of this is hard to fix while everyone is still answering the phone. It’s much harder after a falling-out, a closed agency or an employee who has moved on.

The rule

Your business owns every account, in its own name, with its own email. Anyone you hire gets their own access, at the lowest level that does the job, and only for as long as the job lasts.

That last part comes straight from the FTC’s advice to small businesses on vendors: when a vendor has a real need for access, grant it on a need-to-know basis and only for the time it takes to finish the task. Don’t reuse passwords, and don’t share them.

Map your accounts

Go through the list below with your logins in front of you. For each account, answer three questions. Anything you mark “Don’t know” or “Not sure” is the first thing to find out.

Start with your business email. Most accounts reset their password through email, so whoever controls that inbox can usually get into everything else.

Your domain name

Your domain is your web address and usually your email address too. It’s the one account that can take both down at once.

1. Find where it’s registered. Search your domain on ICANN Lookup. It shows the registrar and the expiration date. The owner’s name is often hidden from public view.

2. Log in to that registrar. Check that the registrant is your business, the account email is a business address you control, and the contact details are current. ICANN expects registrants to keep that information accurate and to answer their registrar within 15 days.

3. Check renewal. Turn on auto-renew and make sure the card on file is current and is the business’s. Note the expiration date somewhere you’ll see it.

4. Note every login that touches it. Billing and settings aren’t always in the same place.

That last step is one we found on our own domain. When we looked up primebridgeenterprises.com on October 9, 2026, the public record showed the registrar and the expiration date, but no owner name. It also showed the domain was bought through Google Workspace. For domains bought that way, Squarespace’s help center says renewal, auto-renew and payment are managed in the Google Workspace Admin console, while DNS, transfers and registration details are managed in Squarespace. That’s two logins for one domain, and both need to be ours.

Your Google accounts

Google uses different roles in each product. Here is what to check in each one:

Search Console is also how you see whether Google can read your site at all; our guide Can Google read your website? walks through it.

Facebook and Instagram

For a Facebook Page in a business portfolio, Meta has three levels of access: partial access in business tools only, partial access in business tools and Facebook, and full control. Only people with full control can change Page settings, delete the Page, and give or remove access, including on a linked Instagram account.

Give full control to the owner, plus one trusted backup. Give everyone who posts, answers messages or runs ads partial access for those tasks. And never let the number of people with full control drop to zero: Meta deactivates a Page that has nobody with full control and schedules it for deletion.

Lock the doors you own

• Turn on two-step sign-in (also called multifactor authentication or MFA) for every account that offers it. CISA says to start with email and other important accounts.
• Use the business’s own recovery email and phone, not a former employee’s cell or a personal address nobody checks.
• Keep passwords in a password manager or another place the owner controls, so they don’t live in one person’s head.
• Use a strong, unique password for each account. The FTC suggests at least 12 characters with a mix of upper and lower case, numbers and symbols.

Before you hire anyone

The FTC’s first piece of advice on vendors is to put your expectations in writing, up front. For accounts, that means agreeing on six things before work starts:

1. Existing accounts stay in your name. They get their own access, at the level the job needs.

2. New accounts are created in your business’s name and email, with your payment method where there’s a bill.

3. Your domain is registered to your business, in a registrar account you can log in to.

4. You get a list of everything they set up: each account, where it lives, and who has access.

5. Their access ends on a date you agree, or when the work is accepted.

6. Nothing they build depends on their personal accounts to keep running.

That’s how we work too. Our service terms for websites, Google profiles and search visibility say it plainly: you keep ownership.

When a job ends or someone leaves

Do this the same week, not when you next remember:

• Remove their access in each account on your map: Business Profile, Search Console (including their verification tokens), Analytics, your Facebook Page, your website, and any booking or payment tools.
• Change any password they knew, starting with email and the domain registrar.
• Check recovery emails and phone numbers, and replace any that were theirs.
• Look for owners or admins you don’t recognize. In Search Console, Google treats that as a possible sign of a hack.

If someone else already holds it

Start by asking. Most designers and former employees will hand an account back when asked plainly, and it’s much faster than any formal process. If that doesn’t work:

Google profileRequest ownership

Use Google’s request flow for a profile someone else manages. The current owner has 3 days to respond. If they don’t, you may be able to claim it, though Google says that option isn’t always available.

DomainWork with the registrar

Ask the registrar how to change the registrant or move the domain to your own account. Transfers can be restricted: under ICANN’s Transfer Policy, a registrar may deny a transfer requested within 60 days of a registration or a previous transfer. Start early.

Facebook PageMeta’s dispute form

Meta’s Business Help Center has a form to dispute who controls a Page. Have records ready that show the business is yours.

Search ConsoleVerify it yourself

If you control your website or your domain’s DNS, you can verify ownership with your own token. Then review the other owners and remove any you don’t recognize, along with their tokens.

Rules and menus change. The help pages in the sources are the authority for each step. If an account is tied up in a legal dispute, talk to a lawyer before you act.