The business can see the website but may not control it
A small business may assume it controls its website because it can view the site, receive enquiries or ask a provider to make changes. But a website depends on several separate accounts, and one unavailable employee, contractor or agency can create avoidable disruption if nobody inside the business knows where they are or how to recover them.
The article will frame this as a continuity and planning issue, not a reason to distrust outside specialists. A provider can have appropriate day-to-day access. The important question is whether the business can identify its essential accounts, the people responsible for them and a workable recovery path.
Get Cyber Safe Guide for Small Businesses - Get Cyber Safe
Security considerations for your website (ITSM.60.005) - Canadian Centre for Cyber Security
What counts as a website account
Explain in plain language that a domain is the web address customers use, while hosting is where a site’s files and data are made available online. DNS settings direct the domain to services such as the website and business email. These are separate from website administration, form-notification accounts, analytics, Search Console and connected business profiles.
Clarify that a .CA domain registrant is an important record to check, but it does not settle every question about legal ownership of website designs, custom code, photography, software licences or contract rights. Those questions depend on the agreement and may need legal advice.
WHOIS and .CA domain privacy: answering frequently asked questions - CIRA
Run a five-question business access check
Give readers five practical checks: Can a named business person receive account-recovery messages? Can the business confirm the domain registrant and renewal date? Can it renew, transfer or update a critical service if necessary? Does each provider have named, appropriate access rather than a shared personal login? Is there a current record showing what each account does and who manages it?
Explain that the aim is not to collect passwords in a casual spreadsheet or remove supplier access. Federal small-business cyber guidance recommends knowing where important assets are held, using unique credentials and multi-factor authentication where available, applying access appropriate to a person’s role, and removing access when someone leaves.
Get Cyber Safe Guide for Small Businesses - Get Cyber Safe
Make a one-page website access record
Provide a simple record structure: account or asset; business purpose; named internal owner or administrator; provider with routine access; recovery email and phone; multi-factor authentication status; renewal or review date; and next action if information is missing.
The article will suggest starting with the domain, because customers use it to find the business, then working through email and enquiry-related accounts. It will advise recording secure recovery arrangements rather than passwords.
WHOIS and .CA domain privacy: answering frequently asked questions - CIRA
Get Cyber Safe Guide for Small Businesses - Get Cyber Safe
Fix the gaps that could interrupt customers first
Prioritize an outdated recovery email, a domain renewal that nobody monitors, sole access held by a departing team member, and accounts that receive website enquiries. A hypothetical example can show how a contractor might discover that its web address, email and contact-form notices are controlled through separate accounts, then assign an internal administrator and document supplier access.
Readers planning a redesign or rebuild can include account access and handover expectations in their project brief before comparing proposals. This makes assumptions visible without requiring them to choose technical solutions first.
Security considerations for your website (ITSM.60.005) - Canadian Centre for Cyber Security
When outside or legal help makes sense
Recommend asking for help when access is missing, account control is disputed, a provider cannot explain the arrangement in plain language, a major rebuild is planned, or rights to designs, code, images or licences are unclear. Professional website support can help map technical dependencies and define a sensible handover, while a qualified legal professional is the appropriate source for contract and intellectual-property advice.
Close with a restrained option for businesses preparing a new custom website project or rebuild: ask prospective providers which accounts they will manage, what access the business will retain and what handover information will be provided.