Do you have to give your web designer your hosting password?

I see business owners ask this online all the time. One of them put it like this: "I've never done this before. If I build a website, do I have to give the login and password for my web hosting to the guy designing the website? Or can they build it without going into my hosting and my domain?"

A while back a company came to me that could have used the answer a lot earlier. Their website was completely down, and they assumed it was something to do with WordPress, so that is where everybody was looking. It had nothing to do with WordPress, it was the domain.

Once I started pulling the thread behind that domain, it turned out they had different agencies handling different parts of the business, none of them talking to each other, though they all had some connection to the domain. So I have a site that is down, I need to get into the domain to fix it, and nobody inside the business can tell me who has what.

After shipping tens of websites this year, I can tell you this is common. A domain looks like one thing and is really three, and those three can each sit at a different company. Once you know what the 3 parts are and where yours live, you can give anybody building your site what they need without handing over the part that controls your business name.

Part one, the account that owns the name

When you register a domain, you are renting a name from a company called a registrar, like GoDaddy, Namecheap or domain.com. It is usually a one year contract at around ten to twenty dollars. If you are paying thirty, check you are not being overcharged.

The registrar keeps track of which name belongs to which owner, and as far as the registrar is concerned, the owner is an account. The domain belongs to whoever can log into the account it was registered in. It is not the person who paid for it, and it is not the business whose name is on it, it is whoever has the login.

That was exactly the problem with the company whose site went down. They had worked with so many agencies that their domain sat in an account owned by one they used to work with in the past. On paper it was their business name. In practice they could not get into it, the agency was flaky and hard to contact, and it took a long time before they got their own domain back.

So if an agency registers the domain for you, make sure the ownership actually comes to you at handoff. Either they create an account for you and buy the domain inside it, or they transfer the domain into your account.

When a new web designer or somebody setting up your email asks for access, you still do not give them that login. A lot of these platforms let you add a user, often called a service account, so they get their own login and you remove them when the work is done. Search your registrar's name plus "service account" to find how.

Keep this login to yourself above everything else, because it can undo anything that happens in the next two parts. Adding a user is one way to let somebody work on your domain, and the second way goes through the nameservers.

Part two, the nameservers that answer for it

Nameservers are the computers that answer questions about your domain. Register a domain at Namecheap and nine times out of ten the nameservers are left on Namecheap's default. If you just run a service business you have no reason to change them, and you manage everything from your Namecheap account.

So why would anybody change them? Registrars are built to register domains, and their tools for the day to day are really basic, so agencies point the nameservers at a platform with better tools. The most popular is Cloudflare, because it is essentially free, and cPanel is common as well. When an agency asks you to repoint your nameservers, that is all it wants, and it is a completely normal request.

Whoever runs the nameservers is in charge of the domain's settings from that moment on. Your registrar account still owns the name, but where the domain points and how it is set up belongs to wherever the nameservers point. If your domain is registered at Namecheap and the nameservers point at Cloudflare, Cloudflare is where you go to change anything.

This is also what makes nameservers the safe way to work with somebody. As long as you have the registrar login, you can change the nameservers whenever you want, so if you fall out with an agency that will not give you access to its dashboard, you point them at a different platform and you are still the owner.

So ask which platform they are pointing it at and whether you get a login there. An agency that runs a lot of domains from one account may not be able to give you one, but the more common way is a dedicated account for each client.

Whatever platform the nameservers point at holds a file, and that file is what everybody means when they say DNS.

Part three, the records that say where everything goes

DNS stands for domain name system, and all it really means is the settings that say where your domain sends people. The file is called the zone, so if you cannot find the DNS settings on a platform, look for zone settings. The lines inside it are called records, and every record has a name and a value. The value is where it sends people, and the name is the address you are creating.

A lot of those values are IP addresses. Every machine on the internet has one, four numbers with dots between them, like 216.198.79.1. Your website sits on a computer somewhere with one of those numbers, and your domain only carries directions to it. There are four types of record worth recognising.

The A record points a name at an IP address. Its name is usually @, which means the domain itself, so an A record named @ sends your domain to the server hosting your site. That is what a hosting company means when they tell you to point your domain at them. One name gets one value, and if a platform does allow two A records with the same name, visitors get sent to one or the other at random. There is also a hard rule that the same name cannot have an A record and a CNAME at the same time.

The CNAME points a name at another address instead of a number. A common one is a CNAME named www pointing at your domain, so www.yourdomain.com goes to your domain, and its A record sends people on to the IP.

The other use is subdomains, and I use this all the time building landing pages. Say a client has their main site on WordPress, with the A record pointing there. I host the landing page on Vercel, which gives me a CNAME value, and I add a CNAME with the name landing and that value. Now landing.yourdomain.com shows the landing page, and because the names are different, the main site carries on as it was. If you already have a site and want a new page built, ask for it on a subdomain.

The MX record is how email finds you. MX stands for mail exchange. When somebody emails you, their mail platform only has the bit after the @, which is your domain, so it asks DNS which server accepts mail for that domain. The MX record is the answer.

If your email is on Google Workspace or Outlook, your MX points at their servers. But when your email comes bundled with your hosting, the MX usually points back at your own domain, so your email is following the same A record as your website. When somebody building your new site changes that A record, your email loses the server it relied on and stops working, and you might not notice.

Before anybody changes an A record, check where your MX points. If it points back at your domain, sort the email out first. The usual fix is another A record or CNAME with a different name, pointed at the server that handles your email, and then the MX pointed at that.

The TXT record is just text, mostly used so another platform can verify the domain is yours, or to stop people sending email pretending to be you. The names you will see there are SPF, DKIM and DMARC. You do not need to set them up yourself, but they sit in the same file as your website records, which is why an email agency asks for domain access and why it needs to know about your web agency.

What to do with this

So, to the question at the top, no, you do not have to give anybody your password. Give them a user on the platform they need, and keep the registrar login for yourself.

Then check your own setup before anybody touches it. Log into the account your domain is registered in, and if you do not know which registrar that is, a Whois lookup on your domain will tell you. Look at where your nameservers point and make sure you have a login there too. Then look at your MX record, so you know whether your email is riding on your website's server.

After that, you are the person inside your business who can say who has what.