Who still has access to your business website? A practical access review

Start with ownership, not a password reset

Imagine a small business that has changed designers twice. Its current supplier can edit pages, but the domain renewals go to an old personal email address. Resetting the website password would leave that dependency untouched. This is an illustrative scenario, not a report about an Arczen client.

Choose one person in your business to own the review. Ask your current provider to identify each service and show who controls it. Record confirmed answers separately from assumptions. An unfamiliar account deserves investigation; its name alone is not evidence of misuse.

Make a map of the accounts that keep the site running

Use the worksheet below as a starting point. For every row, add the provider, account owner, current users, renewal contact, recovery method, reviewer, and next action. Store it in a restricted business folder. Record where credentials are managed, not the passwords or recovery codes themselves.

Keep the domain registrar and DNS provider as separate entries even when the same company supplies both. Include services used by forms or booking tools: their permissions may sit outside your website dashboard.

Match each permission to a current job

Ask each system owner to mark every person or integration: keep, reduce, investigate, or remove after approval. Write the business reason beside the decision. A designer updating text may need a different role from the person managing DNS or billing.

Cloudflare supports individual members with scoped permissions. Its effective permissions can include both direct assignments and group membership, so check both views when you use groups. Other providers have their own role models; verify the capabilities instead of judging by a role name alone.

Prefer named individual accounts where available. For a service that only supports one login, document the exception and a controlled handover process. Include service accounts, API tokens, connected apps, and deployment keys in the review; they are easy to overlook in a list of people.

References: Cloudflare: members and permissions · Cloudflare: policies and effective permissions

Protect the way back into the account

CISA recommends multifactor authentication, starting with sensitive and administrative accounts, and favors phishing-resistant methods. Check your registrar, cloud provider, email, and repository first. Use the strongest suitable option each provider supports.

Before changing recovery details, confirm the replacement email works and the authorized owner can sign in. Keep recovery codes in your approved secure storage, with a documented route for an authorized backup person. Do not make an unavailable former employee’s phone the only recovery option.

References: CISA: require multifactor authentication

Remove old access in a controlled handover

For a routine supplier change, agree on ownership and dependencies before removing permissions. If you suspect an active compromise, use an incident response process instead of treating this as ordinary housekeeping.

1. Have the business owner approve the exact accounts and permissions to change.
2. Verify the replacement administrator can sign in and perform the necessary tasks.
3. Transfer required assets and document any automation tied to the departing account.
4. Remove approved memberships and review related sessions, tokens, keys, and app connections using the provider’s controls. Replace shared credentials that the departing party knew, checking dependent services.
5. Confirm remaining permissions, then test publishing, enquiries, deployments, and security notifications as applicable.
6. Save the date, approver, completed changes, and unresolved items in the review record.

Keep evidence and assign the next review

Where available, review audit or security logs around important changes. GitHub, for example, provides a personal security log with filters and export options. Preserve relevant evidence before its provider retention period ends.

Finish with an owner and due date for every unresolved item. Repeat the review when staff or suppliers change, and set a recurring interval that suits your business. A completed worksheet gives you a clearer picture of control; it is not proof that the whole website is secure.

References: GitHub: reviewing your security log