A company website goes offline on a Monday morning. The cause is not a hack or a bug: the domain expired on Saturday. The renewal reminder went to the inbox of a freelancer who left two years ago, and the card on file was cancelled with the old company account.
This is a common kind of problem and an avoidable one. Domains, hosting, social profiles, payment tools and marketing accounts accumulate over the years. Each was set up by someone for a good reason, and over time nobody remembers who. A single register fixes this and takes an afternoon to build.
What the register is, and what it is not
The register is a list of the places your business exists online and who is responsible for each. It answers three questions quickly: what do we have, who looks after it and when does it need attention.
It is different from other lists you may already keep:
- A contract renewal calendar tracks supplier and software contracts, notice periods and who decides. The register covers the accounts and domains themselves, which often renew by card and never appear in a contract.
- A monthly review of software subscriptions is about cost and unused tools. The register is about ownership and continuity.
- A register of who owns the data in each system covers information. This one covers the accounts that hold the keys.
- A password manager stores the credentials. The register must never contain them.
What to list
Start with anything whose loss would stop sales, email or customer contact. A reasonable first pass:
- Domain names. Every domain you own, including old ones that redirect and variants you registered to protect the brand.
- DNS and registrar accounts. The login that controls the domain is often separate from the website's login.
- Hosting and website platform. Server, website builder, shop platform, app stores.
- Email and calendar. The admin account of your email provider.
- Payment and banking tools. Card processors, invoicing tools, online banking admin rights.
- Marketing and social accounts. Social profiles, mailing tools, advertising accounts, business listings.
- Analytics and search tools. The accounts that hold your search and traffic data.
- Security-relevant accounts. The password manager itself, and any account that can reset others.
If you are unsure whether to include something, ask: "If the one person who knows this login disappeared tomorrow, how long would it take us to get back in?" Anything over a day belongs on the list.
Columns that make it useful
Keep the table small, so it actually gets maintained. These columns are enough:
| Column | Example |
|---|---|
| Item | company-name.com |
| Type | Domain |
| Provider | Registrar or platform name |
| Owner | Named person responsible |
| Backup owner | Second named person |
| Registered to | Company role address, e.g. domains@ |
| Renewal / expiry date | 14 March |
| Renews how | Auto, card ending 1234 / manual |
| Where the login is | "Password manager, shared folder" |
| Notes | Two-step sign-in enabled, recovery phone is the office line |
Three of these columns do most of the work.
Owner and backup owner. One name per row, never "the team". The backup owner exists so that holidays and departures do not leave a gap.
Registered to. Create a role address such as domains@ or admin@ that forwards to two people, and use it as the account email wherever you can. Many a business has lost control of a domain because the account was tied to one person's private address. For the domain itself, check that the registrant is the company and not an individual, because the registrant is the party that legally holds the name.
Renews how. Automatic renewal on a card that expires is not really automatic. Write down the card and its expiry month, and put the card's expiry on the same calendar.
How renewals are tracked
Put the renewal dates in a shared calendar, not only in the register. Two reminders per item work well: 60 days before, to check the payment method and decide whether to keep it, and 14 days before, to confirm that it has actually renewed. Send the reminders to the owner and the backup owner.
For domains, prefer renewing for several years at once, or enable auto-renewal and a lock against transfers, when the registrar offers it. Do not let a domain you still use run to its last day. After expiry, many registrars hold a domain for a grace period and then release it, and recovery can be slow and costly.
Keep secrets out of the list
The register is meant to be seen by several people, so it must not contain passwords, recovery codes or answers to security questions. Write where the login is kept, for example "company password manager, folder Marketing", and keep the credentials there. The UK National Cyber Security Centre explains why a password manager is the safer place in its password manager guide.
Switch on two-step sign-in for every account that supports it, starting with the registrar, email and payment accounts. The US cybersecurity agency CISA gives a short explanation of multifactor authentication. Note in the register which recovery phone or backup method each account uses; if it is one person's mobile, change it. Our guide to a two-step sign-in rollout covers lost phones.
Keeping it current
A register that is right once and wrong a year later is worse than none, because people trust it. Three habits keep it alive:
- When someone leaves or changes role, go through the rows they own and reassign each one before their last day. This fits naturally into the leaver steps of your access checklist.
- When you sign up for something new, add a row the same day. Make it part of whoever approves the purchase.
- Twice a year, the register's keeper reads the whole list, checks the dates and contacts and removes accounts that are closed.
A short start
This week, make a table with the columns above and fill in domains and email first, which usually takes about an hour. Create one role address for account registrations and move the registrar account to it. Choose a keeper for the register and book two calendar reminders per domain. By the end of the week, the next expiry date is on a shared calendar and two people know about it.