Account Access Maps: Who Can Reach Your Hosting When Staff Change
Most hosting problems that stall small teams are not technical. They are administrative: nobody can find the login, the billing email points to a former employee's inbox, or the person who set up the account left without writing anything down. A hosting account is an asset that a team relies on, and like any asset it needs a record of who holds it, how access is granted, and what happens when people move on. This article walks through a method for building an access map for your hosting setup, focusing on the questions to ask and the documents to keep. It does not assume any particular feature set from a provider. Instead, it helps you check what your own account actually allows and build your records around that.
Start With an Inventory of Accounts, Not Servers
Before you can map access, you need a complete list of the places where access exists. Small teams often think of hosting as one thing, but a typical site touches several separate accounts: the hosting control panel or dashboard, the domain registrar, the DNS provider if it differs from the registrar, the email service, the code repository, the content management system login, and any payment method on file. Each of these can lock you out independently. Write them down in a single table with columns for the service name, the account owner's email, the login method, and the person or people who can currently act on it.
Be specific about what each entry means. An account owner is the email address the provider uses for notices and recovery. An administrator is someone who can change settings. A billing contact is whoever receives invoices and payment failure notices. These roles are often held by different people, and a lapse in any one of them can cause trouble. A renewal notice sent to an unmonitored inbox is a classic way a site goes offline, so billing contacts deserve as much attention as passwords.
Ask the Questions Your Provider Should Answer Clearly
Once you have the inventory, go through each account and answer a fixed set of questions. Can the account be accessed by more than one administrator, or is it tied to a single login? Where does the recovery email go, and is that address a shared mailbox or a personal one? How are invoices delivered, and who is notified when a payment fails? Is there a way to add a second contact without sharing a password? If you cannot answer these from the dashboard or the provider's documentation, write that down as an open item. Gaps you have noticed are more useful than gaps you assume are fine.
Also ask what the provider requires to verify identity if you lose access. Some accounts recover through email, others through a phone number or a support process that asks for account details. Record the verification method and store the details needed to pass it somewhere the team can reach, not only in one person's head. The goal is that losing one person does not mean losing the ability to prove you own the account.
Build a Handover Record for Every Login
An access map becomes valuable when someone new has to use it. For each account, create a short handover record that answers: what this account controls, who owns it, where the credentials are stored, how to reach the billing contact, when it renews, and what breaks if it lapses. Keep the record short enough that someone will actually read it during an incident. A paragraph per account is usually enough.
Store credentials in a shared password manager that the team controls, with at least two people able to unlock it. Avoid keeping passwords in chat threads, personal notes, or spreadsheets with broad sharing. Review the handover records every quarter or whenever someone joins or leaves. A short calendar reminder works well here, since access records decay quietly as people change roles.
A Practical Checklist for Your First Pass
Use this list to run a first audit in an hour or two. Confirm that every hosting-related account appears in your inventory, including the registrar, DNS, email, code, and CMS. Confirm that at least two people can sign in to each one or reach someone who can. Check that billing notices go to an address that a current team member reads. Verify the recovery email and phone number for each account are current. Note the renewal date and payment method for each, and make sure the payment method is not tied to an expired card or a departed employee's personal account. Finally, record any account where you could not answer one of these items. Those open items are your priority list.
When you compare plan types or providers later, bring this same map with you. Ask prospective providers how multiple administrators are handled, how billing contacts are changed, and what the recovery process looks like. Treat vague answers as information. An access map is only as good as the answers behind it, and writing it down early is what lets a small team keep control of its own site as people come and go.