Keep Your Web Hosting Separate from Your Web Development

Every year, a steady stream of small business owners discover they cannot access their own website. The credentials are with a former developer who left on bad terms, the hosting account is in the agency’s name, and the domain registration expired into a third party’s hands. The fix takes months and sometimes a legal letter. The setup that prevents the situation costs nothing if it is done from the start.

This article covers the operational separation that keeps a business in control of its own site, regardless of which developer or hosting provider is in the picture at any given moment.

The Lock-In Problem with Bundled Setups

A bundled setup is one where a single provider sells the hosting, owns the codebase, registers the domain, and holds the only logins. It feels efficient on day one. The provider can quote a single monthly price, the operator does not have to manage multiple vendors, and updates seem to happen quickly because one party controls every piece.

It breaks the moment the relationship ends. A widely reported 2024 case described a mid-sized company that needed months to recover control of its own site after a developer refused to release codebase access. Marketing campaigns missed their windows. The product roadmap went on hold.

Lock-in develops gradually. Quick fixes accumulate without documentation. Custom plugins replace standard ones. The technical debt becomes vendor-specific, and the cost of leaving rises with it.

Ownership Setup Done Right from Day One

Setting things up correctly takes one afternoon. The business owner opens accounts in the legal name of the business at each vendor, creates a shared password manager (1Password, Bitwarden, Dashlane), and grants the developer scoped access through that vault rather than handing over the master credentials.

The business owner remains the account holder of record. The developer is a delegated user. When the relationship ends, access is revoked at the password manager level, with no need to change every credential under pressure.

The same setup applies even when the developer is a friend or family member. Personal trust does not protect the business from a personal-life event that ends the relationship abruptly.

Accounts and Assets in the Owner’s Name

Five categories of accounts have to be in the business owner’s name. The domain registrar (where the domain itself is registered). The hosting account. The DNS provider, if separate from the registrar or host. The email provider, especially when it is tied to the domain. Any third-party service the site depends on, such as analytics, CDN, payment processor, and email delivery.

The single most-overlooked one is the domain registrar. ICANN, the nonprofit that oversees domain name policy, publishes Registrants’ Benefits and Responsibilities, and the guidance is unambiguous. The legal name of the business is recorded in the Registrant Organization field. Personal email addresses and developer email addresses do not belong in the registration record.

Hosting Decisions on Their Own

The hosting provider is a vendor decision the business owner makes once and revisits annually. Independent of whoever builds the site, secure website hosting needs to deliver predictable uptime, fast support response, regular automated backups, and the technical capacity to handle the traffic the site actually receives.

The trap is letting the developer pick the host because the developer prefers a particular control panel. The owner inherits the choice. The choice should be made on its own merits.

Selecting Developers for Portable Output

Some developers build with portability in mind. Others lean into proprietary platforms, undocumented custom code, and one-off integrations that only they can maintain. The first kind costs slightly more upfront. The second kind costs much more later.

Vetting questions help. Is the site built on a widely-used CMS the owner can hand to another developer? WordPress powers about 43% of all sites on the open internet, according to W3Techs’ usage statistics on content management systems, which means the labor market for WordPress developers is deep. A site built on a single-shop proprietary platform will be hard to maintain when that shop disappears.

Other portability signals to look for include code committed to a Git repository the owner has access to, plugins and themes that come from established sources, and documentation that another developer could pick up without a long handoff.

Migration Steps for Existing Coupled Setups

A site that is already locked in can be unwound, though it takes work. The first step is taking inventory. List every credential, every account, every plugin license, every third-party service. Identify which are in the developer’s name versus the business’s name.

The second step is opening parallel accounts in the business name where they are missing. Domain registrar, hosting, DNS, analytics. Have them ready, but do not transfer yet.

The third step is requesting transfer in writing, citing the vendor lock-in consequences if the request is refused. Most relationships handle this professionally. A refusal confirms the business owner picked the right time to leave.

The fourth step is the actual migration. Transfer the domain. Move hosting. Update DNS. The downtime, when planned, is usually under an hour.

Documentation for Personnel Continuity

The work that survives any single developer is the documentation. A one-page reference at minimum, kept current and stored where the business owner can find it without help.

The reference should include the registrar URL and account holder, the hosting account URL and account holder, the DNS provider URL and account holder, the CMS admin URL, the location of the codebase repository, the location of automated backups, the third-party services in use, and the contacts for each. WordPress’s own project documentation is a useful template for the format and depth of an internal runbook.

Update the reference whenever a vendor changes, and review it annually. The 30 minutes it takes is the cheapest insurance a business website can buy.