Your website went down. Who has the login?

The registrar, where the domain is renewed. DNS, where the domain is pointed. Hosting, where the site lives. The email service, which also receives every password reset. The contact form service, which actually delivers the leads. And analytics and ads, which tell you if any of it is working.

They are often spread across three or four companies and were set up by two or three different people over the years. When one goes wrong, the question is never what broke. It is which account, and who can get in.

An expired card on the hosting or domain account. The site vanishes or shows a parking page. Fix: update the card, wait an hour.

A renewal email sent to a former employee or the old web company. The domain lapses and enters a grace period, sometimes a costly one. Fix: get into the registrar fast, before the grace period ends.

An SSL certificate that did not renew. Browsers throw a full-page warning and nobody visits. Fix: usually one click at the host, if you can log in.

A DNS change made for email that quietly broke the website record. Fix: compare the records to what the host expects.

A contact form that stopped sending. The site looks fine and leads disappear silently for weeks. Fix: test the form monthly from a phone, not just the office.

A hosting plan that quietly stops because the company was bought, merged or shut down. Rare, but it happens to small hosts, and the warning email goes to whoever signed up years ago. Fix: know who your host is, and move before the shutdown date, not after.

The owner holds the registrar and the email admin. Those two are the business. Everything else can be shared with a manager role for whoever maintains the site.

Each account should have two-factor set up to a phone the business controls, not an employee's personal number. Recovery emails go to an address on your own domain that at least two people can read.

If a vendor insists on owning one of these accounts for you, ask why. There is rarely a good reason.

One page, printed, in the safe or wherever the insurance papers live. For each of the six accounts: the company, the login email, where the password is kept, who has two-factor on their phone, the renewal date and the card on file.

Not the passwords themselves. Those go in a password manager. The sheet is the map of where everything is, so the person standing in the office at 8 AM with a dead website knows who to call and what to open.

Update it whenever something changes hands. We fill this sheet out for every website we build or take over, and we hand it to the owner before launch.

When we hand a new website to an owner, the last thing in the folder is this sheet, filled in. Registrar, DNS, hosting, email, forms, analytics. Which company, which login email, where the password lives, whose phone gets the code, when it renews and which card pays. The owner reads it with us and signs off that the two accounts that matter most are in their name.

It takes twenty minutes and it is the part of a website project that nobody puts in a portfolio. It is also the reason none of those sites has gone dark over a lapsed card or a lost password.

If you already have a site and never got this sheet, you can still make one. Start with the WHOIS lookup, follow the DNS to the host, and list what you find. The gaps you cannot fill are the calls to make this week.

Once a quarter, open the sheet and actually log into each account. Confirm the card, confirm the renewal date, confirm the two-factor phone still works. Submit the contact form and watch for the email.

Fifteen minutes four times a year is the whole program. It is cheaper than any outage we have ever been called about.