Somebody Hand You the Keys to a Website? Here's Your First 48 Hours

Somewhere in America right now, a business owner just realized they don't actually know where their website lives.

Maybe they bought the HVAC company from a retiring owner. Maybe the marketing guy who "handled the website thing" left for a job in Denver. Maybe the agency relationship ended the way agency relationships sometimes end — abruptly, over an unpaid invoice, with all the logins going with it.

Whatever the story, the situation is the same: a live business asset, generating real leads, running on infrastructure nobody in the building understands. And the scary part? Most people don't think about it until something breaks.

Don't be most people. Here's what to do in your first two days of ownership — before disaster picks its moment.

Figure Out Who Owns the Domain First

Everything starts with the domain, because the domain is the one asset that's truly irreplaceable. Servers can be rebuilt. Content can be recovered from archives. But if you lose control of yourdomain.com to an expired registration or a bitter former partner, you're in a world of hurt.

Run a WHOIS lookup — there are free tools everywhere — and check two things: the registrar (GoDaddy, Namecheap, Google Domains, whoever) and the expiration date. If the registrant contact is the guy who left, that's problem number one. If the domain expires in three weeks, that's problem number one with a countdown timer.

Your move: create your own account at the registrar, initiate a transfer, and turn on auto-renew with a credit card you actually monitor. Domain transfers take a few days, so start this before anything else.

Find the Hosting (It's Rarely Where You Think)

Next question: where do the actual files live? Common answers include a shared host like Bluehost, a platform like Squarespace or Wix, a cloud setup on AWS or DigitalOcean, or — and this happens more than you'd believe — a personal account belonging to someone who no longer works with you.

A few detective tricks:

• Check the DNS records. Free lookup tools will show you which nameservers the domain points to, which usually reveals the hosting provider.
• Look at the page source. Right-click, view source, and search for telltale strings like "wp-content" (WordPress), "squarespace," or "shopify."
• Ask the bill. Somebody's paying for this monthly. Find that credit card statement and you've found the account.

Once you know the provider, the goal is simple: get the account into your name, or at minimum get an admin-level user created with your email. If the current account holder won't cooperate, hosting providers have recovery processes — slow ones, but they exist. Another reason to start early.

Take a Full Inventory Before You Touch Anything

Here's where most people get it wrong. The instinct is to start fixing — update the design, rewrite the copy, finally get rid of that photo of the old logo. Resist that instinct.

First, document everything. Screenshot every page. Export the contact form entries. Download a full backup if the platform allows it. If it's a WordPress site, grab both the files and the database. This is your "before" picture, and if anything goes sideways during a change, it's your rollback plan.

Then make a simple spreadsheet: what the site runs on, where it's hosted, who has logins to what, and when renewals hit. Boring? Absolutely. But this spreadsheet is the difference between a business that survives a developer departure and one that starts over from scratch.

Bring in the Robots for the Boring Parts

This is where modern tools earn their keep. You don't need to hire anyone to do a first-pass audit anymore.

AI assistants can review your exported code or page source and flag red flags in plain English — outdated plugins, suspicious scripts, hardcoded credentials that should never have been in there. Free security scanners can check for known vulnerabilities and malware. Automated uptime monitors will email you the moment the site goes down, which is how you find out about hosting problems before your customers do.

You can even paste your page content into an AI tool and ask it to summarize what the site actually does, page by page. If you inherited fifteen pages of mystery, that's a fifteen-minute orientation instead of a weekend of reading.

None of this replaces a professional developer for serious work. But as a diagnostic layer? It's free, it's fast, and it gives you the vocabulary to hire the right help when you need it.

Lock the Doors and Change the Locks

Final step: access control. Every login the previous owner, developer, or agency ever had should be reset. That includes the CMS, the hosting panel, the domain registrar, FTP accounts, form-notification email addresses, and any connected services like Google Analytics or Search Console.

Turn on two-factor authentication everywhere it's offered. Create individual accounts for anyone who legitimately needs access — no more shared passwords saved in a sticky note. And set up an email address like [email protected] that routes to you, so future form submissions and password resets come to the company, not to a Gmail account that walked out the door in 2021.

You Don't Have to Understand It All Today

Here's the good news: you don't need to become a developer. You need to become an owner. Owners know what they have, where it is, who can touch it, and what it costs. Everything else can be delegated, automated, or learned slowly.

The worst outcome isn't an ugly website. It's a functional one that evaporates because it lived in somebody else's account. Spend two days on this checklist, and you'll never be that person — the one googling "how to get my website back" at midnight.

The keys are in your hand now. Make sure they actually open the doors.