# Who Still Has Access to Your Business Website?

Website security starts with knowing who can change your site and recover its accounts. Irish SMEs should review their website, hosting and domain access together, remove accounts that are no longer needed, and give each person only the permissions required. Digital Bridge in Gorey explains a practical, recorded access review.

Written by Joey Bray, Founder & Lead Strategist, Digital Bridge. [Author profile](/about/joey). Last updated: 8 November 2026.

## Why does an old account still matter?

A former employee or previous supplier may no longer work on your website but still have access to its control panel. That account can remain a route into content, customer enquiries or account recovery. The issue is not whether you trust the person. It is whether the permission still has a business purpose.

Start with the systems that keep the website running: the website editor, hosting account, domain registrar, DNS settings, form provider and connected shop or booking tools. Write down the business owner of each account. If nobody knows, record that as a question to resolve rather than guessing.

The [NCSC SME guidance](https://sme.ncsc.gov.ie/advice/) recommends identifying the assets a business relies on. An access inventory applies that advice to your website. It is a working record, not a certificate that the website is secure.

## Which accounts should you check first?

Review administrator accounts first because they can often change other users or important settings. Then review editors, shop managers, agencies and integrations. Some integrations use a separate credential rather than a visible user account; ask your developer to identify those connections without sending secret keys by email.

For each account record its purpose, responsible person, permission level and recovery route. Ask whether two-step login is enabled where supported. Keep the actual passwords and recovery codes in an appropriate password manager, not in your review spreadsheet.

A useful review asks:

- Does this person still need access?
- Does their permission match their current work?
- Is the recovery email controlled by the business?
- Can the business regain access if its supplier is unavailable?
- Who approves changes to accounts and permissions?

## How do you remove access without breaking something?

Do not delete every unfamiliar account at once. A supplier account may own an integration or scheduled task. Identify what it does, transfer ownership where needed and test the affected workflow before removing it. Ask the supplier to explain unclear access in writing.

Give each team member an individual account where the platform supports it. Shared logins make it harder to attribute changes or remove one person's access. Use the least powerful role that can do the required job, but check that the person can still complete their actual work.

Protect yourself against lockout. Confirm that at least one accountable business owner has a working recovery route before changing administrator permissions. A sensitive change should have a rollback or recovery plan agreed with the developer.

## What would a small-business review look like?

Consider a fictional shop with an owner, a staff editor and a previous designer. The owner checks domain and hosting control, the editor keeps content-only access, and the designer's account is reviewed after the handover is complete. The business tests order notifications and website editing before closing the review.

This is an illustrative example, not a Digital Bridge client result. It shows why reviewing roles is more useful than simply counting accounts. One unexplained administrator can matter more than ten properly limited editors.

## What should your team record afterwards?

Record the review date, owner, unresolved questions and changes made. A short decision log helps the next person understand why an account was retained. Repeat the review when someone leaves, when you change agency, or when an important integration is added; a quarterly review can catch access that has quietly become unnecessary.

[ENISA's SME guide](https://www.enisa.europa.eu/publications/cybersecurity-guide-for-smes-12-steps-to-securing-your-business) encourages clear responsibility for cybersecurity. For a website, that means assigning an owner to the review rather than assuming the host or designer handles everything.

## How can Digital Bridge help with website access?

Digital Bridge builds websites and business platforms from Gorey, Co. Wexford. Printhouse's custom web-to-print platform is a real example of the agency's application work; it is not presented as a penetration-test result or evidence of a security certification.

A scoped website review can identify access questions and agree practical configuration work. It does not replace a full company identity audit. If your website holds sensitive information or needs independent assurance, discuss the appropriate specialist assessment as a separate requirement.

## What is the next step for your website?

[Get an instant estimate](/#ai-estimator) or [discuss a scoped website security review](/contact). Call [085 224 1848](tel:+353852241848) or [email Digital Bridge](mailto:info@digitalbridge.ie). Scope and responsibilities are agreed before work starts. For an example of our development work, see the [published portfolio](/our-work).

Read our [website security service](/website-security-ireland), [Irish SME security overview](/blog/small-business-website-cyber-security-ireland), or [professional website services](/services/professional-websites).

## Frequently asked questions

### How do I know if my website is secure?

You cannot establish security from its appearance or HTTPS alone. Review access, software, application behaviour and recovery, then obtain an appropriate assessment for the risks involved.

### Should an agency keep administrator access?

Only while it has an agreed purpose. Confirm the scope, who owns recovery details and how access will be removed or reduced at handover.

### How often should we review website access?

Review after staff or supplier changes and after adding important integrations. A quarterly routine is a useful planning choice, not a universal legal requirement.