Logins and passwords, credentials, oh my!

By | September 16, 2019

Managing the many the credentials needed for a business website

managing the many passwords that come with your small business website

Managing the many logins and passwords necessary to participate on the internet can be downright painful. Unfortunately managing details for a business website is often a hot mess. Personnel changes, expired agency contracts, and the sheer volume of accounts to track often lead to lost credentials and missing information.

A website is a business asset, and all credentials should be owned by the business.

We’ve spent many hours helping clients untangle their website messes and track down logins set up by agencies clients no longer work with or who no longer exist. A website is a business asset, and all credentials should be owned by the business.  Helping clients recover these assets inspired us to formalize our own procedure of providing documentation of all accounts relevant to the website.

So what do you need to be aware of? What needs to be in your control? And if you don’t have this information, how can you find it?

What information for my website should I have on hand?

Domain registrar

Your domain name identifies your website and is part of your website address. For example, in the URL, is our domain name. All domain names are registered with a domain name registrar. This may have been purchased or included along with your website’s hosting package, but could also use a separate company entirely. You’ll need to keep your domain renewed in order for your website to run properly, so you’ll want to keep the login to your registrar on hand. If a business doesn’t clearly own their domain name with credentials to access their registry information, it is putting a valuable business asset at risk.

Website hosting

Websites “live” on servers provided by a hosting company. Your domain name is set up to tell your browser where to go — the “where” being the server provided by your webhost. This may be the same company your domain is registered with. Some web hosts use a second login for the hosting control panel so there may be a few pieces to track here.

FTP (file transfer protocol)

FTP allows you to upload files from your computer directly to your web server via the internet. A user ID, password and FTP address are required to use FTP. Chances are if you decide to give your current site a facelift, or add any custom functionality, a designer or developer will need this information.

Content Management System (such as WordPress)

A Content Management System (CMS) allows you to edit content on your website without needing HTML or programming knowledge. These usually require a login address, username and password.


Every WordPress site and many other content management systems use a database to organize and structure the data behind the site. describes it this way: “Think of it as a file cabinet where you store data in different sections called tables. When you need a particular file you look into that particular section (table) and get the file (data) you need.” While you won’t need the database information to update or maintain your website, it is useful if you are moving your site to a new server.

Google services
(Google Analytics, Google MyBusiness, Google Search Console, Google AdWords)

These third-party services are often utilized to improve or monitor the health of a website, or to drive traffic to a website. We suggest using a unique email address (and the same one for all the accounts) and not a particular individual’s email address to set up these accounts. These accounts allow you to set up access for others, but the ownership should always be with the business. Set up correctly you can remove access if an employee leaves or add access for a new contractor without needing to share passwords.


If your company email uses your domain name in its email addresses (for example, uses our domain), changes in your domain’s DNS (Domain Name System) settings can affect your email. At minimum, keep a record of where your email is hosted so you know who to reach out to if you have a problem. If you want to be extra thorough, keep a note of your MX records which specify the mail server responsible for sending and receiving email messages on behalf of a domain name. We recommend that your email be hosted at a different place than where your website is hosted. You don’t want to risk losing your website and email if your hosting goes down.

These are the most common services you want to keep on your radar. Depending on your website’s features and your company’s marketing needs, there will undoubtedly be other accounts to track (think email marketing platform, e-Commerce information, social media, a premium themes or plugins).

I don’t know who built our site. How do I find all this information?

If you need to track this information down, someone familiar with the company website’s history is always the best way to start. They will hopefully be able to help you begin to fill in the holes without much research necessary. When helping clients who find them themselves in sensitive situations, we encourage them to inform people they are creating a document that holds all the organization’s electronic assets.

Track down domain registrar and hosting

To track down information about your domain, your first step is to do a WHOIS lookup. Whenever a domain name is registered, the registrar is required to make this information publicly available. This information can be looked up online using the WHOIS service and should reveal which company the domain name is registered with and contacts on the domain.

By looking at the IP address or name servers listed on the WHOIS lookup, you may be able to piece together where the site is hosted. There are also free websites that help take the guess work out of that such as One thing you won’t learn from these services is if your company worked with an agency who is a reseller of web hosting. It will show you which company’s hosting they resold, but you likely will not be able to find out the agency’s name. In these cases, if the hosting company won’t help you, you will need to track down the agency in order to gain access to the hosting information you need.

Once you gain access to your hosting, you should be able to find or create a new FTP login from within your hosting control panel.

Reset passwords or take steps to regain ownership of accounts

A CMS should allow you to reset the password on the login without having any of this information, as long as you have access to the email address on the account.

Google allows you to follow a number of steps and reach out to their support to verify ownership and regain access to an analytics or Adwords account if you can’t simply reset the password.

All websites have a shelf life. Whether it’s the changing technology that powers your site, a new brand direction, or changes to your business, eventually you will want to rebuild or expand your website. Keeping this information organized will save you time and sanity when that time comes. More importantly, should your website unexpectedly go down, you will have all the necessary information to get the site back up as quickly as possible, saving yourself from doing this research in a panic. Download our handy worksheet to start collecting and keeping the information for your website organized.


Download free worksheet


Diane Cody
Diane Cody
Diane joined the Spire2 team as a graphic designer in 2010. She loves to solve problems through design and is passionate about building marketing campaigns that perform across all platforms.