How to Check Website and Hosting Access Before Buying

Check the domain, hosting, website administration, backups, and business email separately. Access to edit a website does not establish control of its domain or hosting, or prove that its data can be recovered. If you are considering a small-business purchase, use the five steps below to identify what is included, who controls each account, and what still needs confirmation before handoff.

The Small Business Administration’s Manage Your Business guidance notes that domains are registered through registrars and require renewal, and identifies websites and domain names as business intellectual property. Confirm which assets are included using the appropriate transaction materials or advisers; do not assume an account, license, domain, or data transfers automatically.

Use due diligence as a method, not a checklist

NIST SP 1326 was published in final form on July 8, 2026. It addresses due diligence for information and communications technology (ICT) suppliers and is written for cybersecurity supply-chain risk management (C-SCRM) practitioners—not as a small-business acquisition checklist or requirement. Its useful general idea is to research and verify relevant information, and to validate findings against multiple sources when possible, as explained in the full publication. Adapt that approach to the assets and risks relevant to this handoff; it is not a complete audit.

1. List the digital assets included

Start with a separate row for each item. Ask the seller or the appropriate transaction adviser to confirm whether it is included; do not interpret purchase documents yourself.

Domain registration and registrar account
Web hosting account and any related services
Website platform and administration access—for example, WordPress
Backups and any associated storage
Business email service and its administration

Depending on the business, you may need to list other vendor accounts, software licenses, or customer data separately. Their inclusion and transfer arrangements depend on the transaction and provider. Record an item as “not confirmed” rather than assuming it is part of the handoff.

2. Identify the account and its controller

For each listed asset, record the provider and the person or business that currently controls its administrative account. Then note what evidence you actually inspected. Keep these questions separate:

Domain: Request registrar account or registration records and the renewal date. Identify who can administer the registrar account. Do not treat website editing access as evidence of registrar control.
Hosting: Request the hosting provider, account details, and a current invoice. Identify who administers that account, separately from the website.
Website: Arrange a buyer-authorized administrator login and confirm that it works for the specific administrative task you need to check. A successful login demonstrates access for that task; it does not establish independent account recovery or control of the domain or host.
Email: Identify the email provider and the account controller. Do not infer that control of a domain or website also gives you control of the email service.

Record the evidence and the limits of what it shows. For example, an invoice can help identify a hosting provider and billing relationship, but it does not by itself establish that the buyer can administer or recover the account.

3. Request renewal, maintenance, and support details

Ask for the domain renewal date, hosting billing details, and any renewal or support dependencies for the other listed services. Request the current provider process for account transfer or recovery rather than relying on a seller’s general description; steps vary by provider.

Also ask who is responsible for website management and software updates, and request available maintenance and support terms. Note whether work is handled by the seller, an employee, a contractor, or a provider, and what support—if any—is documented. These details help identify a person or service you may need to contact after handoff; they do not establish that a service or contract transfers.

4. Inspect available security and recovery evidence

The FTC’s Cybersecurity for Small Business guidance recommends asking hosting providers about TLS, email authentication, software updates, website-management responsibilities, and whether account access supports multi-factor authentication (MFA). Use those topics to guide questions, not as pass-or-fail proof that a site is secure.

Access: Ask whether MFA is available for relevant accounts and how the buyer can obtain authorized access. An MFA option alone does not establish who controls an account or how recovery works.
Website and hosting: Record whether you inspected the site’s TLS configuration and what the provider or manager says about software updates. A protected connection or an update policy does not prove complete site security or that updates are being performed.
Email authentication: Review available provider documentation or settings for SPF, DKIM, and DMARC. Record which settings or records you inspected. Their presence alone does not prove they are correct, that email administration transfers, or that messages will be delivered as intended.
Backups: Request the documented backup schedule and storage location, and identify who can access them. The FTC recommends backing up important files, but a schedule or backup file does not prove the backup is complete or restorable. Any restoration test needs suitable authorization and a safe test environment.

For each check, write down the date, evidence reviewed, and the specific question it answered. If you could not inspect a setting or record, mark it “not inspected”—do not fill the gap with an assumption.

Hypothetical example: WordPress access, unclear domain control

A buyer can log in to the WordPress site and edit a page, but the seller says a former contractor controls the registrar account. Record website administration as checked for the page-editing task. Record domain control as unresolved. Ask for registrar records to verify who controls the account. If control is not established, request the registrar’s current transfer or recovery process and document the steps needed; a documented process is a path forward, not proof of current control. Do not mark the domain verified merely because the site is editable.

5. Record gaps and assign follow-up

Use a handoff record like this. “Verified” should mean the evidence confirmed the particular access or detail you checked—not that the asset is secure, legally owned, or independently recoverable. This is an operational aid, not a substitute for transaction documents or professional review.

Asset	Evidence inspected	Status	Next action
Domain	Registrar record; renewal date	Unresolved	Verify control with registrar evidence; if unresolved, document the provider-confirmed transfer or recovery steps
Hosting	Account details; current invoice	Not inspected	Request details and confirm authorized access
Website administration	Buyer-authorized login; task tested	Not inspected	Test the intended administrative task
Backups	Schedule; storage location	Not inspected	Confirm access; consider an authorized safe restore test
Business email	Provider settings or documentation; SPF, DKIM, DMARC	Not inspected	Record what was reviewed and confirm administration path

Use statuses such as verified, unresolved, and not inspected, and make every next action specific: name who will request or confirm what, and when it needs follow-up. Before handoff, bring unresolved access, inclusion, renewal, and recovery questions to the seller, the relevant provider, or an appropriate adviser. Which item in your handoff record remains unresolved: registrar control, hosting access, backup recovery, or email administration?

Sources

Editorial note: AI assists with research, drafting and automated checks. Sources are linked so you can verify the guidance. Platform requirements can change; confirm the details that apply to your setup.