What the site looks like is only one layer. Underneath it sit a domain, DNS records, hosting, a security certificate, backups and admin passwords. When one of them is not in order the site can go down, and sometimes the company's email goes down with it.
Responsibility for the site after launch
Your designer or studio is responsible for the look, the experience and the messaging. After launch, some questions are left that nobody took on: who renews the domain, who checks that the backup works and who gets the alert when the site goes down on a Saturday morning.
Often the answers only come out once the site is already down. That's when it turns out, for example, that the domain is registered to the personal account of an employee who left two years ago, and a check that should have taken half an hour drags on for a week.
- Who the registered owner of the domain is, and when it renews
- Where the site is hosted and who pays for the hosting
- Who holds the admin passwords and the backups
- Who is responsible for system and plugin updates
- Where the contact form submissions go
The answers should be recorded in one document that the company holds. With documentation like that, a website issue gets resolved faster.
Domain and DNS: who is the registered owner
The domain is your business's address on the internet, and your email's address too. If it is registered in a provider's name rather than the company's, switching providers requires their approval. When the domain is registered to the company, the transfer is a ten-minute technical task.
- Check the registration records for who is listed as owner and who is the contact
- Make sure the email address registered there belongs to the company
- Move the registration to a company-owned account, with at least 2 contacts
- Turn on auto renewal and put the expiry date in the calendar
- Save a snapshot of the DNS records table before every change
DNS records determine where your website and email go. A small change there, such as a record pointing to a different server, can take both down. That's why every change is made after backing up the previous table, by someone who knows the settings.
Keep a list of all the company's domains, including ones bought once for a campaign. An expired domain is available for anyone to buy, and some people buy domains like these for the name.
Website hosting, backup and recovery
Ask your provider: if the site were deleted today at noon, which backup would it be restored from and how long would it take. If there's no clear answer, there probably isn't a proper backup. Also ask for the date of the last test restore.
| What needs to be in order | Who actually owns it |
|---|---|
| Design, content, and page development | Your designer or studio |
| Domain, DNS records and renewals | MO-TECH, with the domain registrar |
| Hosting, backup and recovery | MO-TECH, together with the hosting provider |
| Security certificate and system updates | MO-TECH, with continuous monitoring |
| Business email and employee mailboxes | MO-TECH, inside Microsoft 365 |
For every client we build IT management dashboard that brings together domains, mailboxes, software subscriptions and equipment per employee. Each domain's renewal date appears there.
Agree in advance how long a full restore takes, who updates customers during the outage and who confirms at the end that the site is back up.
Certificate, updates and admin passwords
Without a valid HTTPS certificate the browser shows a warning, and many visitors leave the site. Certificates renew automatically in most cases, but renewal can fail after a hosting move or a record change. That is why you need monitoring that alerts before the certificate expires.
- Update WordPress and all plugins, and delete plugins that no longer receive updates
- Updates are tested in a staging environment first, and only then on the live site
- A personal admin user for everyone who works on the site
- Two-factor authentication on every admin account, including at the hosting provider
- Edit-only access for content writers
If the site's admin password currently sits in a WhatsApp chat with a freelancer, change it. Admin passwords belong in the company's password manager, and anyone who leaves loses access the same day.
If the site also takes payments, every payment plugin, unnecessary permission or exposed password is a direct risk to your revenue.
Speed, accessibility and form privacy
Loading speed depends mostly on images. A rich design saved in heavy files loads slowly on mobile. Properly sized images, in a modern format with the right compression, improve speed while the design stays exactly as it is.
Website accessibility is a legal requirement in Israel: color contrast, full keyboard navigation, alt text for images and an accessibility statement on a separate page. It pays to settle this with the designer at the planning stage, because fixing it afterward costs more.
Every tracking pixel or chat widget you add to the site loads another company's code. That code slows down loading and passes visitor data to a third party. Go through the list once a year and remove whatever isn't in use.
Every inquiry that comes in through the site is someone's personal information. Find out where it's stored, who can read it and how long it stays there. The privacy policy page should describe this accurately.
Company email lives on the same domain
The website and email sit on the same domain, but are set up in separate records. A provider who moves hosting and rewrites the table without paying attention can take down email for the whole company.
That's why whoever manages IT should be in the loop before any hosting migration. For clients of managed IT services we look after the email DNS records, permissions and backups, answer every request within 10 minutes, and handle a critical outage within 30 minutes.
We also manage your staff's equipment and mailboxes. We have a computer repair lab, and you can order IT and mobile equipment through us at importer prices.
If you are not sure who holds your website's domain, backups and admin passwords today, we will check it with you in a 30-minute IT and security assessment, no cost and no commitment.
FAQ
Who should be registered as the owner of the website's domain?
The company itself, always. The registration should sit in an account with a company email address and more than one contact. If the domain is currently registered to a vendor or an employee, request a transfer before any new project.
Our site is built on WordPress. What is the risk there?
Plugins. Every plugin is third-party code running on your site, and a plugin that isn't updated is open to attack. We keep the number of plugins down, test updates in a staging environment first and monitor file changes.
Does MO-TECH build or design websites?
Yes. We build fast static websites for businesses, accessible under Standard 5568, with SEO and in multiple languages. If the design and build are with a designer or studio, we manage everything around them: domain, DNS, hosting, certificates, backups, information security and business email.
How often should you verify that the website backup works?
At least once a quarter, and always after a major change. You test by doing a full restore to a separate environment. We record the date of the last test in the dashboard.
More on this topic: Managed IT services for businesses · IT management dashboard · What business IT services include · IT and security assessment