This was the case for the website for an organization to which I belong. In fact, it happened twice, and we got very lucky each time.
I’ll review what happened to us, how I recovered, and what every website owner should do to prepare for exactly this scenario.
Become a Patron of Ask Leo! and go ad-free!
The site story
The organization centers around a large email discussion list. There’s an associated website, built and maintained by volunteers, that includes photos, a list FAQ, and other information related to the list. It’s not an uncommon use of a website to back up and maintain information for an online email community.
I volunteered to take on-site maintenance, including the transition from an old site, to a new, partially completed replacement.
Unfortunately, as part of the transition, which included moving to a new web host, we lost contact with the person who had been doing the work up to that point and the information to access the old site.
It was hosted on a small and fortunately responsive ISP. We were able to contact them and convince them that we were the folks responsible for the site. They then set up a redirection so that visitors trying to get to the old site reached the new site instead. In short, we were very lucky because the ISP was willing to help us out.
The transition to the new site went well, initially. Unfortunately, unbeknownst to us, there was a bandwidth cap in place. Only so much traffic (views of the website’s pages) would be allowed before the site would be disabled for a time. With the redirection from the old site, we reached that cap in under two weeks.
We were fortunate once again. The webmaster who I was replacing had prepared and shared with the organization’s administration important things like password, accounts, and access information … but not all of it worked. Enough of it did work that I was able to move the new site to a new location – one of my own servers, where I have total control and no bandwidth cap.
Lessons learned
In short, losing your webmaster could be a serious problem. Depending on many things, the worst-case scenario could be you lose access to your own website with little (if any) hope of retrieving it.
I got lucky. Twice. You might not.
If you have someone else who’s in charge of managing your website, you must have a contingency plan. I recommend that at a minimum it includes:
- The name of the registrar (if you have your own domain name) and the account name and password that would allow you to make changes to that domain, such as pointing it at a different server or even transferring it to another registrar.
- The name of your hosting provider. Ideally, that would include telling your hosting provider of backup contacts in addition to the webmaster.
- Accounts and passwords to your server’s management console. Not all sites have this, but ultimately, a management console is a common approach that web hosting providers offer to individuals so that they can control the configuration of their server or their part of it.
- The root or administrator account name and password, if you have a dedicated server.
- Account names and passwords to the appropriate login and ftp accounts used to manage the server or upload content to it.
- Account names and passwords to any applications. For example, the administration accounts used for blogs, forums, or other tools that have been installed on your server.
- An alternate contact. In many cases, your webmaster may have a trusted individual that, while not involved in your site, may be available to grant access or assist in an emergency.
But…but…but…
You may have a couple of reactions to that list:
All that information … those are the keys to my kingdom! If someone got all that, they could hack me to pieces!
Yes indeed.
Realize that you’re already relying on your webmaster to keep this same information safe already, but you’ll absolutely have to do the same. It doesn’t matter how you do it – written on a note you keep in a safe, kept in a spreadsheet in an encrypted filesystem, or something else entirely – you do want to keep this sensitive information secure.
But no matter how you do it, it’s critical that more than one person have it.
I wouldn’t know what to do with this information!
That doesn’t matter.
If you’re not familiar with website stuff yourself, you’ll be looking for someone who is. Once you find them, they’ll need this information in order to help.
A sudden or unplanned transition is always rocky, but with a little careful up-front planning, very often a total disaster can be averted.
I think you can make it much simpler than that and still be adequately protected: make sure the website is registered to the organization or business you have (domain owner) with proper address, and make sure you or an owner/director of the organization/business is listed as the administrative contact with valid e-mail address. (And put the registrar in your address book to make sure their e-mails don’t go in your spam folder). Your webmaster should only be listed as technical contact and perhaps billing contact if that’s the arrangement you have.
If the webmaster disappears, you can get the login to change the name servers quite easily if you’re the admin contact. Any new webmaster worth his/her salt will easily be able to get in contact with the webhost (via the nameservers) and have ftp/control panel info sent to you (domain owner/admin contact) which you can then send on to him. Should you desire to move to a new server, a competent webmaster likewise should be able to get the registrar to send you login info to manage the nameservers. And, since you are admin contact, no one can change that info without your consent.
So, in a nutshell, just make sure you’re owner and admin of your domain, and the rest can be handled by professionals. I am continually amazed how many organizations let their domain names be registered in the webmaster’s name.
ToeKnee: that’s a good observation … if you in fact *have* an organization or entity to assign it to. There are many less formal groups that don’t have that – my example list being one.
And even so, your registrar/isp/whatever may still require you to jump through hoops to prove that you are in fact an authorized representative of that organization.
Bottom line: I still feel it’s faster / safer to make sure that someone else besides your webmaster has the information readily available.
I do agree with ToeKnee – I set up all domain name/hosting arrangements at the same place for all my clients and I am only the technical/admin or in some cases billing info, but it is their package. I have taken over the management of sites -or rescued them – and had no difficulties overcoming access issues WITH REPUTABLE registries and hosts. I do keep up-to-date complete records and hand them over at the end of the relationship.
This is a problem that has plagued businesses for year. One person has all this knowledge. That person leaves. Doesn’t matter what the knowledge is; if that knowledge is known by only one person then you have potential problems. (Kinda sounds like “if your files exists in only place, they aren’t backed up.”)
Might be only one guy who knows how to tinker with the 100 year old punch press. Might be the one order taker who knows exactly how to talk to your best customer. Might be the one janitor who knows where the “extra” circuit breaker panel is.
The same thing can apply in your personal life; imagine what can happen if you are incapacitated. Who knows what medical or life insurance you have? Does anyone else know all your bank, brokerage, investments? Who has access to your safe deposit box? Have signed a Power of Attorney form for both Property and Medical?