Create an address on your own domain that at least two people can read, then change the login and recovery email on the registrar, hosting, website and every related account to it, one account at a time.

The inbox that owns the website

When the website was set up, somebody typed an email address into every form along the way: the domain registrar, the hosting company, the WordPress administrator account, Google Analytics.

Often it was their personal Gmail address, because that was the inbox they had open. It may have been the owner, an office manager who has since left, or whoever built the site.

Every renewal notice, security warning and password reset for those accounts has gone to that inbox ever since.

Whoever can read it can take control of the website. The business, on paper the owner, cannot.

What arrives at that address

The third is the one that decides who really owns the website. Any account that sends its reset link to an inbox belongs, in practice, to whoever reads that inbox, whatever the paperwork says.

Why a personal account is the wrong place

A personal Gmail account belongs to a person. The business cannot reset its password, cannot read it while that person is on holiday, and has no claim to it when they leave.

If the person is unreachable, notices pile up unread. If they leave on bad terms, they hold the keys. If their personal account is ever broken into, every business account tied to it is exposed at the same moment.

None of this needs bad intent. Usually the person simply moved on, and the address became one nobody checks.

Find every account first

Before changing anything, list every account connected to the website.

The registrar holds the domain name, with an account login and separate contact details on the domain itself. The hosting account holds the files and often the email.

The website has its own administrator accounts. Google Analytics, Search Console and Google My Business each have logins, and so do the security certificate, the mailing service, the payment processor and any booking system.

Next to each, write the login address, the recovery address and who can currently sign in.

An address the business owns

The replacement belongs on your own domain, such as web@ or admin@ followed by your domain name, so it stays with the business through any change of staff.

Set it up so at least two people receive it, as a shared mailbox or a group that delivers to both. Google Apps for Work and Office 365 can do this, as can most hosting mail.

Give it a long password and two-step verification. It is about to become the key to everything else.

For the registrar, also add a contact or recovery phone number that does not depend on the domain. An address on the domain stops working if the domain itself lapses.

A worked example

A bicycle courier company with a handful of riders carries documents and small parcels between offices downtown, booked by phone or through a form on its website.

The site, the domain and the hosting had been set up years earlier by a rider who was good with computers, using his personal Gmail for all of it. He had since moved to another city.

Last spring the card on the hosting account expired. The reminders went to his inbox, which he rarely opened by then, and one Monday morning the website and its booking form went offline.

Getting the hosting back took several days of calls. Putting the domain into the company's name took longer, because the registrar would only act on confirmation from the address it had on file.

He was glad to help once he was reached. The company now has a web@ address that the owner and the dispatcher both read, set on every account, with the owner's cell number for recovery.

Changing it without locking yourself out

Change one account at a time, and finish each change before starting the next. Some services confirm the change from the new address and notify the old one, so keep the old inbox reachable while you work.

If nobody can reach the old inbox any more, each service has a recovery process, usually involving proof of identity or of ownership. Expect days rather than minutes, and start with the domain.

In WordPress, change the email under Settings, then General, and in each administrator's own profile. They are separate, and the profile address is the one a password reset uses.

The domain's own details

The domain deserves extra care because it holds everything else up: the website, the email, and every login that depends on that email.

Check who is named as the registrant. It should be the business rather than the person who registered it, with the new business address as the contact email.

Turn on automatic renewal with a card the business controls, and record the expiry date somewhere other than the inbox that receives the reminders.

Keep a list of who has access

Once every account points to the business address, keep a one-page record: each account, its login address, who can sign in, and where recovery goes.

Store it somewhere safe, outside the website, and update it whenever someone joins or leaves.

When a person does leave, the list turns a stressful week into an hour: take away their access, change any password they knew, and nothing else depends on them.

The counter-case

An owner who runs the business alone and reads their personal email every day has less exposure, because in practice the person and the business are the same.

Even then an address on the business domain is the better long-term choice. A business can be sold or handed on; a personal inbox cannot.

Where a former employee or developer controls an account and will not hand it back, the service's own recovery process and professional help are the route, not workarounds.

For everyone else: move every admin and recovery address to one the business owns, one account at a time.

Before the next password reset

  1. List every account tied to the website.
  2. Note each login and recovery address.
  3. Create a shared address on your own domain.
  4. Protect it with two-step verification.
  5. Change the registrar first, then the host.
  6. Update WordPress settings and administrator profiles.
  7. Keep the access list somewhere safe.

Step five comes first among the changes for a reason. The domain holds up the email, and the email holds up every other account.

The same trap with video is covered in a YouTube channel under the owner's personal account.

Frequently asked questions

Why does the admin email matter so much?

Password resets go to it. Whoever reads that inbox can take over the domain, hosting and website accounts, whatever the paperwork says about ownership.

What is wrong with a personal Gmail?

It belongs to a person. The business cannot reset it, read it during absences or claim it when they leave, and its compromise exposes every linked account.

What address should replace it?

One on your own domain, such as web@ or admin@, delivered to at least two people and protected by a long password and two-step verification.

Which accounts need changing?

The registrar, hosting, the website's administrator accounts, Google Analytics, Search Console, Google My Business, and any certificate, mailing, payment or booking service tied to the site.

Why change the registrar first?

The domain holds up the email, and the email holds up every other account. If the domain lapses, everything that depends on it stops.

What if we cannot reach the old inbox?

Use each service's recovery process, which usually asks for proof of identity or ownership. Expect it to take days, and start with the domain registrar.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Domain renewals going to a former employee?

Tell us which accounts your website depends on. We will help you move every one to an address the business owns.

Start a Conversation