First, a disclaimer: The majority of web design agencies and freelancers are honest, decent folk who wouldn’t dream of holding their clients to ransom – myself included.

However I’ve now worked with a number of small business owners who have found themselves in awkward, uncertain situations where they had little control over their data and intellectual property.

As a small business your website is the centre of your universe (or at least, it should be), so it pays to do a bit of planning before entrusting your website to a new supplier.

A cautionary tale: ‘Too good to be true’ is usually just that

A few years ago, a now client of mine purchased what seemed like the deal of the century from a company online: a WordPress website, G-Suite accounts, hosting, social media accounts, logo design, business cards and more for a little over £1500. It sounded too good to miss, but turned out to be too good to be true.

After months of poor communication, a poorly designed “custom” website and logos, the company disappeared off the face of the earth. Half of the work was complete, but what’s worse is the company Gmail accounts stopped working and they were left without access to their emails and no one to contact for support.

A this point, the client came to me for help moving their entire G-Suite and website over to a new domain, which this time they wisely purchased themselves. Thankfully, they were a very new company so no lasting damage had been done, but it could have been disastrous for their business.

When it’s so easy for anyone to setup a legitimate-looking website, it becomes increasingly hard for busy business owners to tell the good from the bad.

Do your homework.

A good way to protect yourself is to do some research. This could include:

  • if they’re a registered company, check them out on Companies House
  • see if they have a website (what web designer doesn’t? A dodgy one)
  • speak to them over the phone, rather than just email
  • ask for proof of their previous work
  • suss them out on social media
  • ask for testimonials or references

Always have a contract.

If everything looks kosher, ask the website designer to provide you with a contract to cover the work they are undertaking for you.

Make sure you understand all the terms – don’t sign it if you don’t understand it! Seek independent legal advice if there’s anything you’re not sure about.

Even you do find a reputable supplier and have a solid contract in place, I still recommend retaining control over your digital assets and accounts.

Get access.

Before signing anything, tell your website designer that you will need them to provide you with the login details for:

  • your website hosting account, if they are setting this up for you
  • your FTP
  • the backend of your website, if built on a content management system such as WordPress
  • access to your cPanel account

You could also ask them to provide you with a list of any themes, plugins or third-party tools they purchased as part of the build that may require you to login and renew the license in future. Premium WordPress themes and plugins often have a licence that needs to be renewed annually – if your designer has purchased a licence in their name but you go your separate ways, then you will be required to pay the renewal costs.

Your website designer may state that they retain control of the website until the final invoice is paid, and this is an entirely reasonable request. However, you could ask them to put something in the contract that states that they will send you the login info within X days of final payment being received.

Own your own domain name.

This is essential. Even if you happen to lose control of your site and hosting, if you own the domain name you can simply point it elsewhere and get back online in no time.

If you’re entrusting someone else to purchase it for you, make sure it’s in your name. If your relationship goes awry and the domain name isn’t registered in your name, there’s nothing you can do to take control of your site – or worse, they could hold it to ransom and demand payment in return for access.

Setting up a new website on a new domain is a huge hassle and you could lose out on the SEO authority and traffic you’ve worked so hard to build.

If you’re not sure who owns your domain name, you can look it up on iCann.

Don’t stress.

Small business owners are often stressed and busy, making them vulnerable to dodgy suppliers who know they may not take the time to check the small print.

Never be too trusting, and never assume your relationship with a supplier will always be healthy. Relationships can go wrong for many reasons beyond your control; the supplier might quit, go out of business, fall ill (or worse). Things can – and do – go wrong on both sides, so make sure you’re protected and in control of your accounts so you can easily give control to another supplier if needed.

Stay calm and stay in control!

More tips for keeping control of and protecting your data

Sharing and collaborating on files

Setup a shared Google drive or Dropbox folder where you and your supplier can share and collaborate on specific documents, while limiting access to others.


Make sure everyone who needs access has their own separate user login. Consider what level of access they really need – for example, someone who is only adding blogs will only need Editor access, not Admin.

Social media

If a supplier is setting up a social media profile for you, make sure you are still the owner (ditto email marketing tools). If they are only going to be posting on your behalf, set them up as a page admin.


If you do need to share any passwords with a supplier, it’s advisable to change those passwords after you have finished working together. Likewise when members of staff who had access to your digital accounts leave the business. I recommend using a password manager such as LastPass to help manage and update your company passwords.

Google Analytics and AdWords

This is essential data, so if you fire the supplier there’s nothing stopping them from deleting your website from their analytics account and removing all your data in the process. I advise setting up the account yourself and giving them Manage Users and Edit permissions at the account level. The same applies to Google Search Console.
If you need to give them your personal login, make sure you trust them, and don’t owe them any money! Then change the password after they’ve done what they needed to do.

Website backups

Always keep a copy of your website on file – preferably in your cloud storage account, as well as physical storage such as an external hard drive – and make sure it’s updated at least once a month. Talk to your developer about setting up scheduled backups to automatically sync with your cloud storage.