.png)
.png)
.png)
What to Check Before Giving a Marketing Agency Website Access
By Blackbird Marketing
Before giving a marketing agency access to your website, confirm who owns each account, what permissions are needed, how the site can be restored and how access will be removed later. A named user with limited permissions is usually safer than sharing one administrator password.
In short: keep ownership of your domain and core accounts, grant only the access required for the agreed work, record the starting position and agree how changes, approvals, backups and offboarding will be handled.
1. Confirm who owns the website and connected accounts
Start with ownership rather than technical settings. Your business should be able to identify who controls the domain, website platform, hosting, analytics, advertising accounts and business listings.
These assets may be held with different providers, particularly if a previous employee or supplier set them up. Create a simple record showing:
the provider or platform;
the account owner and recovery email;
which business email address controls it;
who has administrator access;
whether your business can add or remove users;
renewal dates, invoices and recovery details.
Pay particular attention to the domain registrar. Domain settings can affect the website and business email, but an agency needing to make a DNS change does not necessarily need the domain transferred into its own account.
Keep ownership separate from supplier access
Ask in writing: “Will the website, domain, analytics and advertising accounts remain owned by our business, with our own administrator access throughout?” This distinction makes it easier to change suppliers, recover an account or bring another specialist in later.
2. Match permissions to the agreed work
Access should reflect the actual job. Someone reviewing search performance may need different permissions from someone editing pages, while a paid advertising specialist may not need full access to the content management system.
For every requested permission, ask:
Which system needs access?
What task requires it?
What can the user view, change or delete?
Is an administrator role essential?
How long will access be needed?
Who will approve significant changes?
Keep systems separate where possible. Website editing, Google Business Profile, analytics, search tools, social accounts, email software and paid campaigns should not automatically come as one package of unrestricted access.
If you are considering Local SEO for Trades or Digital Marketing for Tradespeople, ask which parts of the proposed work require access and which can be completed through a lower-level role. The permissions should follow the agreed service, not determine it.
3. Use named users and proper security
Avoid sending one shared username and password by email or message. Shared credentials make it harder to identify changes, remove access cleanly and investigate a security problem.
Where the platform allows it, invite named user accounts instead. Keep at least one owner-level account under a business-controlled email address, with recovery notifications going to someone who will review them.
Before access is granted, check that:
administrator accounts use unique passwords;
multi-factor authentication is enabled where available;
recovery email addresses and phone numbers are controlled by the business or an agreed account owner;
former staff, suppliers and unused applications no longer have access;
security alerts are sent to an active contact.
Do not weaken normal security controls simply to make access easier. If a requested role does not work, ask what specific limitation is causing the problem and whether there is a safer alternative.
4. Record the starting position and backup arrangements
Before changes begin, establish what can be restored and what the site currently contains. A backup is useful only if it is available, recent enough for the risk involved and capable of being restored.
Depending on the platform, record relevant items such as:
website files and database, where applicable;
themes, plugins, extensions and integrations;
DNS records and email-related settings;
forms, tracking codes and conversion settings;
important page content and metadata;
current analytics and search data;
advertising settings, audiences and billing arrangements.
Ask who is responsible for backups, where they are stored, how long they are retained and who can restore them. If a copy sits only in a supplier’s account, ask whether your business will receive an independent copy or retain its own access.
Screenshots or exports of important settings can also provide a useful reference if a page, form or tracking setting changes unexpectedly.
5. Protect email, forms and other connected services
Website work can affect more than page content. Changes to hosting, DNS, redirects or integrations may affect business email, contact forms, booking systems, payments, call tracking or customer records.
Ask the agency to identify any proposed change that could affect:
email delivery and mailboxes;
contact forms and enquiry routes;
booking, quotation or payment systems;
customer relationship management software;
tracking, analytics or security certificates;
redirects and other domain settings.
Give DNS changes extra scrutiny
DNS settings control how a domain connects to websites, email and other services. Ask whether the required change can be made through a restricted role, or whether your business can make it with clear instructions.
If nameservers are being changed, ask which connected services will be checked before and afterwards. A website can appear to work while another service has been disrupted.
6. Agree how changes will be checked
Decide how edits will be proposed, tested and approved before access is issued. This matters especially for changes to service information, prices, coverage, contact details, legal wording and technical settings.
Ask whether work will be made on the live site or tested elsewhere first. A staging or preview environment can reduce the risk of publishing a broken layout, missing form or incorrect redirect, although the available controls vary by platform.
Record:
which changes need approval;
who supplies accurate business information and images;
who checks telephone numbers, forms and enquiry routes;
how urgent corrections are reported;
where significant changes are logged.
Blackbird’s published website design information describes a review, plan, build and launch or improve approach. If you are discussing a new site or major rebuild, ask what access is needed at each stage and when you can review the work before launch.
7. Check access to customer information
A website login may expose names, telephone numbers, email addresses and enquiry details. Before granting access, establish what information can be seen, why it is needed and how it will be protected.
Ask:
Will existing enquiries be visible, or only future submissions?
Will personal data be copied or stored outside the website platform?
Which people or subcontractors can access it?
How will information be returned or deleted when the work ends?
Which party is responsible for relevant privacy, cookie and tracking settings?
Check the contract and privacy arrangements rather than assuming that a website login answers these questions. The same applies to analytics, email marketing and advertising audiences.
8. Put scope and responsibilities in writing
Record the agreed services, platforms and responsibilities. “Marketing access” can mean very different things, from content updates to technical settings, listings, advertising or a complete rebuild.
Also record:
who can request and approve changes;
what information the business must provide;
how technical problems or suspected security incidents are reported;
what updates or reports will cover;
how disagreements about changes will be handled.
Be cautious about promises of rankings, leads or advertising returns. A permissions agreement cannot guarantee those outcomes; its purpose is to make the work, responsibilities and controls clear.
If you are unsure which type of support fits the job, the published article How to Choose the Right Blackbird Marketing Service for Your Trade Business is available as a related reference.
9. Plan offboarding before onboarding
Agree how access will be removed before the work starts. The business should know how supplier users will be deleted, how recovery details will be changed and how reports, backups and working files will be handed back.
Include questions such as:
Who removes user accounts and connected applications?
Will the business receive copies of backups, reports and working files?
Will access to analytics, advertising, social and listing platforms be revoked?
Who remains responsible for renewals and billing?
What happens to content or website work created during the engagement?
At the end, review named users, administrator accounts, recovery details, connected applications, forwarding rules and billing contacts. Changing one shared password is not enough if several systems were involved.
Final pre-access checklist
Before providing access, your trade business should be able to answer yes to these points:
We know who owns the domain, website and connected accounts.
Our business retains owner-level access and recovery control.
The requested permissions match the agreed work.
Named users and multi-factor authentication are being used where possible.
A usable backup or restoration plan is in place.
Email, forms, payments and DNS risks have been identified.
We know which changes need approval and how they will be tested.
Customer information and data handling have been discussed.
Scope, responsibilities and reporting are written down.
There is a clear process for removing access.
Access may be necessary for SEO, web design or paid marketing, but it should be controlled access rather than a transfer of ownership. If the agency can explain each permission and is comfortable with your business retaining control, you have a safer basis for starting the work.
Ready to discuss the right service? Explain the marketing work you are considering and ask which access would be needed for it. Contact Blackbird Marketing about its listed SEO and marketing services.
