Most local business owners couldn't tell you who owns their domain name, where their website lives or who can log in to their Google listing. That's fine right up until something breaks, someone leaves, or a security scare hits, and then the phone goes quiet while you try to track down a password.
This guide walks you through six simple checks. Most of them take a few minutes each, and once they're done you'll know that nobody, whether it's a hacker, an old web designer or an expired card, can switch off the enquiries your business depends on.
In short
- Your website, email and Google listing rely on a handful of accounts. If you don't control them, you don't fully control your enquiries.
- The six things to check are your domain name, hosting, website login, business email, Google Business Profile and backups.
- Each check takes 5 to 20 minutes. The whole lot can be done in an afternoon.
- This week's big website security news is a good reminder, but there's no need to panic. Ask the right questions and keep your own copy of the keys.
- A good web person will happily give you owner access. If someone won't, that tells you something.
Why this matters more than it sounds
Here's how owners usually find out they don't own their website. It's rarely dramatic at first.
Imagine a roofer in Guildford whose nephew built his website five years ago. The nephew moves abroad and stops answering messages. Then the domain name renewal fails because it was paid on an old card in the nephew's name. The website disappears, and so does every email sent to the business address. The roofer only notices when a regular customer rings his mobile to ask if he's still trading.
Or picture a commercial cleaner in Horsham who parts ways with a marketing company. The company built the website and set up the Google listing, and both sit in the company's own accounts. Getting them back takes weeks of emails, and in the meantime she can't change her opening hours, reply to reviews or update the services she offers.
Neither of these is about being bad with technology. It's about who holds the keys. When you hold them, you gain three things:
- No lost enquiries. Your website, phone number on Google and email keep working whatever happens with suppliers.
- Freedom to choose. You can move to a better provider whenever you like, without starting from scratch or losing your Google reviews.
- Faster fixes. When something goes wrong, you or whoever you trust can act the same day instead of waiting on someone else.
What happened this week, and should you worry?
On 21 October the UK's National Cyber Security Centre (NCSC) warned about a critical security issue affecting PHP, the behind-the-scenes software that runs a huge share of the world's websites, including every WordPress site. Fixes have been released, and the NCSC's advice to organisations is to update as a priority, starting with anything that faces the internet.
For small local businesses, the bigger problem was simpler. Many owners realised they had no idea who to ask, or whether anyone was looking after their site at all.
This isn't rare, either. The government's Cyber Security Breaches Survey 2025/2026 found that 42% of micro businesses and 46% of small businesses had experienced some kind of cyber breach or attack in the previous 12 months. Phishing emails were by far the most common type.
So should you worry? Not really, as long as someone is clearly responsible for your site and you can reach them. A quick, polite email to your web person or hosting company asking "Has our site been updated for the PHP security issue?" is enough for most businesses. If your site is built on a hosted website builder rather than WordPress or similar, the platform looks after the server side for you, so this particular issue is mostly their job.
The 6 things to check
Grab a notepad or open a new document. As you go through each check, write down what you find. By the end you'll have a simple "keys list" for your business.
1. Your domain name (the most important one)
Your domain name is your web address, like yourbusiness.co.uk. Everything else hangs off it: your website, your email addresses and often the link on your Google listing. If it lapses or sits in someone else's name, you can lose all three at once.
What to check:
- Whose name is it registered to? The legal holder (called the "registrant") should be you or your limited company. Not your web designer, not their company, and not a former business partner.
- Which company is it registered through? This is the "registrar", the company you pay each year. For .co.uk and .uk names, the domain lookup tool on Nominet's website shows which registrar holds it.
- Can you log in to that registrar account yourself? If not, ask whoever set it up for a login or to move it into an account in your name.
- When does it renew, and is auto-renew on? Check the card on file is current and in the business's name.
What you gain: your web address and email can't vanish because of a lapsed card or a lost contact. Time: 10 to 15 minutes, longer if you need to chase a login.
2. Your hosting account
Hosting is the rented computer space where your website's files live. Some web designers include hosting in their monthly fee. That's fine, as long as you know who the host is and how to reach them.
What to check:
- Who is the hosting company, and whose name is on the account?
- Who pays for it, and when?
- If your web person disappeared tomorrow, could you, or someone you appoint, get access to it?
- Does the host or your web person apply security updates, like this week's PHP fix? Get a simple yes or no in writing.
What you gain: when something goes wrong, you know exactly who to ring, and you're not waiting on a middleman. Time: 10 minutes, plus one email.
3. Your website login
This is the login you'd use to change the words, photos or prices on your site. On WordPress it's called the admin area. On website builders it's the account owner.
What to check:
- Do you have your own login, with the highest level of access (often called "administrator" or "owner")?
- Is it in your name, using an email address you'll always have?
- Are there old logins for people who no longer work with you? Ask for them to be removed.
You might never use it yourself. Having it means a new provider can step in without rebuilding everything.
What you gain: you can always update your services, prices and areas, which is what turns visitors into calls. If you've ever wondered why people leave without ringing, our guide to why visitors leave your website without calling covers the fixes. Time: 5 minutes to check, a day or two if you need to request access.
4. Your business email
If your email ends in your own web address, like info@yourbusiness.co.uk, it's tied to your domain name. Customers reply to quotes there. Suppliers send invoices there. Google and your other accounts often send password resets there.
What to check:
- Which company provides your email (for example Microsoft 365, Google Workspace or your host)?
- Do you have the main admin login, not just a mailbox password?
- Is two-step verification switched on? This means a code goes to your phone when someone logs in from a new device. It's one of the simplest protections against the phishing attacks the government survey found to be so common.
What you gain: quote replies and new enquiries keep landing, and nobody can quietly read or redirect your email. Time: 10 to 15 minutes.
5. Your Google Business Profile
For most trades, your Google Business Profile is where the calls actually come from. It's the listing that shows your reviews, phone number and map pin. Losing control of it is often worse than losing the website.
Google lets a profile have several people with access, but they're not all equal. According to Google's help page on owners and managers, there's one primary owner, other owners with full control, and managers who can do almost everything except add or remove people or delete the profile.
What to check:
- Sign in at business.google.com, then go to Business Profile settings and People and access.
- You should be the primary owner, using a Google account you control.
- Any agency or helper should be a manager. That's enough for them to do their job, and you stay in charge.
- Remove anyone you don't recognise or no longer work with.
One thing to know: Google applies a 7-day waiting period for new owners before they can do certain things, such as removing other people or changing the primary owner. So don't leave this until the day you need it.
What you gain: your reviews, photos and phone number stay yours, whoever you work with. If you want to get more calls from your profile once you're in control, see our 12 Google Business Profile fixes that bring in more calls. Time: 5 minutes if you're already the owner.
6. Your backups and your keys list
A backup is a spare copy of your website you can put back if something goes wrong. The NCSC's guide to backing up your data recommends backing up what your business needs to operate, including your website, and checking that you know how to restore it.
What to check:
- Is your website backed up automatically, and how often?
- Where are the backups kept? Ideally somewhere separate from the website itself.
- Has anyone ever tested putting one back? A backup that's never been tested is a hope, not a plan.
Then finish your keys list. It should show, for each of the five accounts above: the company, the login email, who has access and the renewal date. Don't write passwords on the list. Keep those in a password manager or somewhere secure, and store the list where a trusted person could find it if you were ill or away.
What you gain: if the worst happens, you're back up and taking calls in hours, not weeks. Time: 15 to 20 minutes.
Your afternoon checklist
- Look up your domain name and note the registrar and renewal date.
- Confirm the domain is registered to you or your company, and that you can log in.
- Find out who hosts your website and whose name is on the account.
- Ask whether your site has had this week's security updates.
- Check you have your own owner-level login to the website.
- Check you have the main admin login for your business email, and turn on two-step verification.
- Confirm you're the primary owner of your Google Business Profile and any helpers are managers.
- Find out where your website backups are kept and when one was last tested.
- Write it all on your keys list and store it somewhere safe.
A word-for-word email to send your web person
Most web designers are perfectly happy to help. Often nobody's ever asked. Here's a friendly email you can copy and send today:
Hi [name],
Hope you're well. I'm getting our business records in order and want to make sure I have a full list of our website accounts. Could you let me know:
- Which company our domain name is registered with, and whether it's in my name or the company's
- Who hosts the website, and whose name the hosting account is in
- Whether I have my own owner or administrator login for the website
- Whether the site has been updated for the PHP security issue announced this week
- Where the backups are kept and how often they run
If anything is in your name rather than ours, could we look at moving it over? Happy to pay for your time.
Thanks very much,
[Your name]
What to do if someone else holds the keys
If your checks turn up a problem, don't panic. Most can be sorted.
If the domain is in someone else's name, ask them politely to transfer it to you. Your registrar can explain the steps. If they won't respond, contact the registrar directly and explain that you're the business using the name.
If someone else owns your Google Business Profile, ask them to make you the primary owner. If you can't reach them, Google has a request ownership process. The current owner is emailed and has 3 days to respond. If they don't, you may be able to claim it. One thing worth knowing for trades: if you don't have a shop or office customers visit (Google calls this a service-area business), Google's help page says you need to contact Google support instead of using the normal request form.
If your old web person won't hand anything over, keep things calm and in writing. Ask for the domain, the website files and a backup. Say a heating engineer in Chichester gets back only their domain and a copy of their site. They can still be up and running on a new host quickly, on the same web address customers know.
If you can't get the website back at all, the domain name is what matters most. Keep the domain and your Google profile, and a new site can be built on the same address without losing the reviews and listing that bring in your calls.
Common mistakes
- Using a personal or old email for important logins. If you lose access to that inbox, you lose your way into everything else. Use an address you'll always have.
- Letting your agency be the primary owner of your Google profile. Make them a manager. It's all they need.
- Paying for the domain on a card that's about to expire. Domain lapses are one of the most common and most avoidable outages.
- Assuming backups exist. Ask where they are and when one was last tested.
- Paying someone to "upgrade" you after a scary news story. Ask your current provider first. Most security fixes are routine updates, not a new website.
Want a second pair of eyes on it?
If you'd rather not untangle this yourself, we can help. On a free 30-minute call we'll look at your Google presence and website together, spot where enquiries might be leaking and point out anything that isn't in your name. You can read how it works, or see what we do for website design and build, Google Business Profile management and trades marketing across Surrey, Sussex and Hampshire.
Show me where I'm losing enquiries
Prefer to learn first? Join our free Thursday Lunch 'N' Learn, or call us on 01306 480440.
