This is the article most agencies would rather not write. We write it because a client who knows what they own is a better client — and because every month someone comes to us whose website guy has vanished and nobody has a single password.
The six credentials
- 1. The domain — the registrar account, in YOUR name with YOUR email. This is the most important: the domain is your identity. If it is registered to someone else, the site is not yours.
- 2. The hosting — the cPanel user and password (or at least your own account with the host)
- 3. The site admin — a WordPress administrator account with your email
- 4. Google Analytics and Search Console — you as Owner, others with permissions. Otherwise your data history lives in someone else's Gmail.
- 5. The Facebook/Instagram page — you as Admin of the page and the Business account
- 6. Email on the domain — at least the main address and the ability to create new ones
The one-sentence test
If I changed developer tomorrow, could I grant them access to everything myself? If the answer is no — something is missing.
How to ask (without awkwardness)
It is not distrust — it is normal business hygiene. A line that works: please send me the credentials for our records; I want everything in our name for continuity. Any serious professional hands them over without a word. If someone gets annoyed or stalls — that is your answer.
Where to keep them
Not in a chat thread and not on a sticky note. A password manager (Bitwarden is free), or at worst a locked document in two places. And crucially: the recovery email on every account should be yours, not an employee's who may leave.
Our position
With us everything is in your name from day one: the domain, the hosting account, the admin. If tomorrow you decide to go elsewhere — you take them with you, no negotiation. That is not generosity, that is how it should be.