Keeping control when someone else runs your website

A close friend of mine asked me to help with the website for their family’s small business. She had started managing the site and was learning about search traffic, rankings, competitors, and ways to improve traffic and sales. We wanted to establish a baseline by installing Google Analytics and Google Search Console so she could measure whether her changes were working. Then we ran into an access problem. Her WordPress account only had editor permissions. So did the owner’s. The company that hosted the site held the only administrator access, and she couldn’t install the plugin we wanted to use for measurement. The business has only an online storefront where customers buy through its website, but the owner depends on the provider to make changes beyond what his account allowed.

Why owners hand it all to one provider

I understand why the owner chose that arrangement. He needed a website for his business and someone who knew how to build and run it. He chose a single company that offered WordPress and WooCommerce, hosting, search engine optimization, email, and the other services needed to operate the site. For an owner trying to get a business up and running, having one company handle the technical work is an appealing offer.

In conversations with small business owners over the years, I have heard similar reasons for hiring a provider. They have customers to serve and limited time to learn the technology. A recommendation from someone they trust can carry more weight than a technical comparison they are not equipped to make. The provider knows which accounts are needed and creates the setup. Unless someone explains the access arrangements, the owner may assume that paying for the website gives them the ability to take it elsewhere. That assumption deserves attention before the business depends on the site for sales.

What control actually means

When I talk about control, I mean the ability to authorize work, retrieve the business’s data, and put someone else in charge of maintenance. An owner can retain those abilities while paying a provider to do every technical task. Restricting an employee’s account to editing can be sensible. Administrative access allows changes that can disrupt a site, so access should match the work to a person’s responsibilities. The FTC makes the same distinction in its guidance on controlling access to business data. The business still needs a secure way to appoint another administrator if the provider becomes unavailable or the relationship ends.

Getting the access and backups back

In my friend’s case, the questions extended beyond installing a plugin. We had difficulty obtaining backups and understanding what service the owner had paid for. I coached her on the technical aspects of what to request. She handled the communication with the provider, and following through with getting a backup took firm emails with deadlines. The business has since received a full backup of the site, including the database and media files. That backup captures a snapshot in time of the site but allows us to recreate the site from that point if necessary. The business owner also eventually received administrator access to their WordPress site. Getting access to the business’s own site data had become a project alongside the work my friend was supposed to be doing. Discussions with the provider are ongoing, and we expect to obtain direct access to the site’s files, database, and backups.

Years earlier, I helped the owner of a small radio station who sold products through a WordPress site in a similar situation. A single contractor had built and hosted it, and the relationship had deteriorated into litigation over several years. I was brought in after the judgement to retrieve the data, download it, and restore the site with another provider. Afterward, I educated the owner about their options, provided recommendations moving forward, and then handed access over to the owner. That experience is why I want owners to discuss a handover or fallback plan while they still have a working relationship with their provider. Recovering a site requires access to its data and somewhere to restore it. Those arrangements are easier to establish before a disagreement or an interruption forces the issue and costs the owner time, money, and customers.

Know where each piece lives

An owner needs to know where each service is managed and who can make changes. A WordPress login provides access to the application. The domain registration, hosting, and email may have separate accounts. DNS, the service that directs traffic for the domain, is another part of the setup the owner needs to understand. The business should remain the registered holder of its domain even when someone else manages it. ICANN recommends this arrangement in its guidance on domain registration and administration. It gives the owner a concrete point to check with the provider before considering the rest of the setup. For each account, the provider should explain how the business can recover access. If the service uses a shared hosting account, the explanation should cover how the owner can obtain the site’s files and data and move to another provider.

Backups you can restore

Backups need the same scrutiny. WordPress requires both files and a database to restore a typical site. Its backup documentation explains those components and recommends keeping copies in different locations. A copy held only in the provider’s hosting account leaves the owner dependent on continued access to that account. I would also want evidence that someone had restored the site from a backup. A restoration test can reveal missing files or other recovery problems while the business is still operating. CISA recommends regular testing of backup availability and integrity in its ransomware recovery guidance. For an owner, the practical questions include how recent the recovered data would be and how long the site would be unavailable.

Questions to ask your provider

These are the questions I would bring to a conversation with a provider:

• Which accounts control the domain, DNS, website hosting, email, and stored media?
• Can the business recover access to those accounts if the provider becomes unavailable?
• Where are the backups, and can the business retrieve a copy independently of the website’s hosting account?
• When was the last successful restoration test, and what did it recover?
• If another contractor takes over, what will they receive, how long will the handover take, and what will it cost?

Those questions also help an owner judge the service they are buying. A provider should explain what the fee covers and which requests cost extra. They should explain why they recommend a particular setup and what the owner would need to do to leave it. I would expect a provider to teach the owner enough to make those decisions. The owner can then decide which work to delegate, knowing how to withdraw access when a contractor’s work ends. A smaller provider can offer that clarity just as a larger company can. The arrangement matters more than the size of the company.

Where to start

My friend’s attempt to measure search traffic exposed an access problem that had consequences for her work. For owners in a similar position, I would start by asking the provider to walk through the accounts and demonstrate how a backup can be recovered. The owner should leave that conversation knowing what another contractor would need to keep the website running.