Reviewed July 2026. This article was substantially updated to reflect current web standards and practices.
A website is more than its visible pages. Domains, DNS, hosting, source code, content, analytics, email, third-party accounts, and billing relationships all need clear ownership and recovery access.
Keep critical accounts under business control
Register the domain, hosting, analytics, search tools, repositories, and major services with organization-controlled accounts. Use a password manager, multi-factor authentication, named administrators, and a documented offboarding process.
Back up what cannot be recreated
Maintain automated off-site backups of files, databases, configuration, and essential content. Retain multiple restore points and test restoration. A backup is only useful when the team can access and use it during an incident.
Document dependencies
Record DNS, redirects, forms, email delivery, APIs, licenses, scheduled jobs, analytics, cookie controls, and renewal dates. Keep source code in version control and document how production is deployed.
Monitor and rehearse
Use uptime, certificate, domain-renewal, error, security, and form-delivery monitoring. Assign incident contacts and rehearse a restore or provider handoff before a real emergency.
Create an ownership register
List every critical service with its business owner, technical owner, billing contact, renewal date, recovery method, and approved administrators. Include the domain registrar, DNS, hosting, content system, repository, email delivery, analytics, advertising, tag manager, consent platform, forms, payment tools, and major integrations.
Keep a deployment and recovery record
- Where the authoritative source code and content backups live.
- How a change moves from development to production.
- Which environment variables and secrets are required.
- How DNS, redirects, scheduled tasks, and certificates are configured.
- How to restore files and databases to a clean environment.
- How to verify forms, email, payments, analytics, and search after recovery.
Protect continuity during vendor changes
Contracts should state ownership of design files, code, content, accounts, licenses, and data. Require documentation and credential transfer at project completion. Avoid domains, hosting, analytics, or repositories that only a departing contractor can access.
Run an annual continuity exercise. Confirm that two authorized people can reach critical accounts, renew the domain, retrieve backups, deploy the site, and contact vendors. Record what failed and correct it before an outage, compromise, or staff departure makes the gap urgent.