The domain, DNS, hosting, WordPress administration and email may belong to different accounts. A website can keep working for years while its owner has access to only one of them. The gap becomes obvious when a renewal fails or a contractor is no longer available.
Create a record of the services that control the site's operation. Include the provider, account owner, recovery contact and the location of authorized access instructions. Do not place passwords or recovery codes directly in the same ordinary document.
Distinguish ownership from daily administration. A developer may manage hosting on behalf of a business, but the business should understand who holds the contract and what happens if the relationship ends. A WordPress Administrator role does not establish ownership of the domain or the billing account.
Check where each service sends password resets and renewal notices. If the domain's recovery email depends on a mailbox under that same domain, ask what happens when the domain expires or mail stops. The arrangement may have a supported recovery route, but it should be known and documented.
Include paid extensions and external integrations that the site cannot easily replace. Record whether a license belongs to the organization or is supplied under a contractor's agreement. Avoid assuming that a working activation means the organization can download future releases independently.
Read the diagram as text
- Domain and DNS: Who can renew the domain and change where it points?
- Hosting: Who holds the contract and can recover access during an outage?
- WordPress administration: Which authorized owner controls administrative access and recovery?
- Email: Who controls the inboxes receiving resets and renewal notices?
- Licenses and integrations: Which organization or contractor owns the account and update access?
Keep secrets in their secure system; the ownership record should point to authorized access instructions.
Test access through the normal authorized process while everything is functioning. Confirm that the designated owner can identify the account and reach its recovery method. Do not change registrant or billing information casually; use the provider's documented transfer process when a change is needed.
Review the record after a migration, staff departure or new service connection. A short inventory can prevent a long search through old email during an outage. Its purpose is to make control and responsibility visible, while the actual secrets remain in an appropriate secure system.
