ο»ΏBusiness Fire Drills | Season 1, Episode 11
Fire Drill 10: Before You Lose Access to Your Website
Speaker: Tamsen Horton
Tuesday morning. You are about to send the email for your best-selling offer. You type in your website address to grab the link, and instead of your sales page, you get an error, or a parking page, or a notice that says your domain has expired. You quickly go check your email. The renewal notices have been going to an old address you stopped checking years ago.
Nothing malicious happened. Nobody hacked you. A card expired. An email went to the wrong inbox. And your entire storefront goes dark.
I'm attorney Tamsen Horton. Business moments like this are predictable. Panic is optional. This is your Business Fire Drill: Before You Lose Access to Your Website. Short and practical. Let's get going.
Here is what this fire alarm looks like. A domain that quietly lapses because the renewal notice went to an inbox nobody is currently checking. A hosting account suspended over a billing issue that never found its way to you. Or, my personal favorite, and by favorite I mean my least favorite, and the one that truly happens far more than I think people realize: the person who built your site, or that you hired to help you on your site. They are the one you gave your login to, and they've stopped answering your messages, or they hold your account hostage. Yes, it happens.
You may be thinking, "Well, my website person handles all of this. I don't need to worry about it." Okay. Quick question. Could you log in to your domain registrar right now? Do you know which company that even is?
Here is why this drill matters. Your website is the storefront for everything else. Your checkout, your opt-ins, your sales pages, your blog posts, your podcasts. You could have everything in your store, and you've given the keys to somebody else. That's not good. When the website goes down, your sales could stop that exact same hour. Your panic is going to go through the roof, and it's not an easy one to untangle.
So before we run the drill, a question for you. Why do you have a smoke detector in your house? I'm guessing it's to warn you before there's a fire. That's the entire job of a smoke detector. Well, I built a free one for your business. It's called, very original, the Smoke Detector. Eleven questions, takes about three minutes, and it tells you which smoldering fires your business is most likely to have right now. If you're not sure who holds the keys to your website, go take it today. The link is in the show notes. Go use the Smoke Detector.
Are you going to react or respond to this fire alarm?
Reacting may look like this. Your site goes down and your panicked scramble starts with, "Oh crap, where's the login for that?" Or, "Who has the login for that?" You try one recovery option and then another. You message the developer or the virtual assistant who's now ghosting you or has gone quiet. You post on social media asking if anyone knows what to do. Meanwhile, you can't do anything. You are literally at a dead stop because you can't get into your store.
Responding looks different. You already know exactly where your domain, your hosting, and all your tech logins live. You know who has access and how every single one gets recovered. A lapse or a suspension is not a mystery you're frantically trying to solve. It's simply a support ticket.
Now it's time to run the drill. D-R-I-L-L.
D: Don't react. Don't hand a contractor, a virtual assistant, anybody other than yourself, full exclusive access without keeping your own admin login. And if something is already broken, don't just sit and wait for the "we'll fix it" without also starting recovery yourself. Also, do not go crazy on social media. Do not put the panic on social media. Do not accuse the person you were working with if you can't get in. You are just going to stay calm.
R: Record everything. Keep a master list of every critical login: your domain registrar, your hosting, your site platform, every single piece of your technology home. Write down where the login lives, who has access, and how it gets recovered.
Now, here is an old-school tip for you. I heard this from Warren Buffett decades ago. He was being interviewed when digital password managers were starting to become prevalent, and he pulled out a small spiral notebook. I remember him vividly saying, if it could shut down my life or my business, I keep it in this paper copy. This paper copy stays protected, because if it could shut me down, I'm not letting someone else have the power of that. That has stuck with me.
I was born in 1975, so there may be some of you out there who also remember this. Do you remember the old address books with the alphabetical tabs down the side, with two or three letters on each? That's where you wrote down everyone's phone number and address. It's how we knew who to send Christmas cards to. I have one of those in my house. And if it can shut down our lives, our bank accounts, or my business, those passwords are in that paper address book. So if my password manager goes down, if my authenticator app blitzes out, if my phone goes down, I'm still okay. This is a big issue.
For future fire drills, let me know if you would find this interesting, because I would love to do a limited series on how detrimental passwords are in our world. It's why I do not use facial recognition. The estate planning attorney in me just can't do it. There are other ways to approach this, and if you would find that interesting, let me know, and I could probably blend it in.
But when you are recording everything: yes, I have a digital password manager. I don't know how you exist in today's day and age without one. And if it could shut down my life, including my family's, my finances, or my business, it is also in an old-school paper address book. It's what I remember from my childhood.
I: Identify the real risk. Is this a billing lapse, a policy or technical suspension, or a real loss of access that means identity verification? Each one has a different fix, and identifying which one you're dealing with is going to save you precious time.
L: Lead with calm. When you know the issue, you know who to contact. Contact the platform's actual support channel with proof that the business is yours. Not a public post. Not blame. Proof. That is all we are doing in Business Fire Drills: we are the ones who are calm. We are the ones calmly walking down the hallway, calmly going to the clearest and closest exit. You are leading with factual calm.
L: Lock in the lesson. Once it's fixed, make sure you personally have direct, working access to everything in your business and your life. We'll rope that one in too, at the moment. Not access that's routed through another person.
This is really important, and it's one of the reasons I am firmly in the camp, and have always been in this camp, of team humans and team tech. I've watched way too many team humans think they're doing the boss move, or the smart business move, by outsourcing before they understand what they're outsourcing. I'm all about it: you can delegate, you can move things away from you. But you need to fully understand what keys you are giving a person. I personally never share logins. The password manager that I use has a way to share a login such that the person never gets the actual key. So if something does go wrong, it's easy to close down their access without you also getting locked out of your house.
Now, we've gone through the five steps of the drill, D-R-I-L-L. And you may be starting to think, "Huh, I honestly don't know where all my logins are." Or you know all your logins are in your digital password manager, and now you hear Warren Buffett's voice haunting you, like it did me. That is exactly why the Smoke Detector exists. It is why I made it. It is how you can easily and immediately stop guessing. Is there smoke in my business? If there's smoke, it means there's a smoldering fire. You don't need to wonder. It is free. It is eleven questions. It takes about three minutes. It is going to immediately alert you to where there is smoke in your business, because smoke is only present when there is a fire. The link is in the show notes. Go use the Smoke Detector.
Now, just like in our houses, we want to have a fire extinguisher before the fire starts. So we are going to build the fire extinguisher before the fire starts in our business.
Number one, own your domain registration yourself, under a business email and a business entity that you control. Not under your developer's account. Not under your freelancer's personal email. If that is how you started, I want you to immediately migrate it. There's a term in the law that we like to use, which is "dominion and control." You want to have dominion and control over all aspects of your domain.
Number two, keep a master access document. A digital password manager works well for the everyday practicality of "I've got to log in, I've got to use an authenticator." You cannot bypass that. Our world is too connected. Every account, the emails that are there. I personally have mine in Notion. I use Notion as my content infrastructure. I keep every tech employee listed there: what it's used for, what the login is, whatever needs to go with it. And we have the paper for anything that could shut down lives, finances, or business.
Number three, make sure at least two people have real admin access to your hosting and your site platform. Two people can be you and a trusted team member. It can also be you and your trusted spouse, you and your trusted child, you and your trusted whoever. Trusted does not mean someone you met in a group of 10,000 entrepreneurs last week. That is not trusted. No way, no how. It can't be just one person, and it can't be only someone else. This is really important.
And when we move into life fire drills, preview, coming attractions, there will be life fire drills. I originally started as an estate planning attorney, so you're always planning for the worst-case scenario, and usually it involves someone's death or incapacity. In 2019, I almost died. I legitimately almost cashed in all the chips. Thank goodness it didn't happen. But we have the documents. We have the instructions, such that there is someone other than me who can access the business bank accounts and knows where to start. So that's what you want to have. And it can simply be: this is the starting point. If something goes down, here is how you get into the triggering domino account, the watershed account, maybe. I'm trying to think of a term, but something that can kick off the other places. That is really, really important.
Number four, set your domain and hosting billing to auto-renew, with a current card and a backup payment method. An expired card is the most boring way to lose anything, but especially anything having to do with our businesses. And it's also incredibly common. Cards get hacked and you have to replace them, and there's that one outlier you totally forgot about. With so many emails coming in, and how they get sorted, you might completely miss it, through pure accident, and never see it. So having things on auto-renew is good. I keep track of that information in Notion, too. Tied to each tech entry, it always has the renewal date, and I set reminders for a week before. Those are built into my systems, and that is another way it helps us stay in control.
Number five, confirm that you can actually log in yourself, today. Not "I think I can," but actually log in. I've had this with clients: I ran their entire Kajabi business, and I had the login. Now, I know I'm a trusted person, and I know I'm never leaving them in a lurch. But there were people to whom, if I had said, "Hey, you need to be able to log in, can you do it?", the answer wasn't a sure yes. That's why part of my process when I worked with people was that we ran login drills. Something has happened, you need to log in, can you do this? So you want to make sure you can log in. If it involves your life, your money, or your business, could you get in the front door? That is important to know.
If the fire is already on, check your billing and renewal status first. It's often that simple. Contact official support with any proof they require. If a contractor has gone quiet, start account recovery directly with the provider instead of waiting. And write down what happened and when, in case you need to tell your customers.
Which brings us to: what's your next right decision? You have three options.
One, do nothing. You own your domain. You know where everything is. You have a documented backup. You have full dominion and control of all of the things you should. You're good.
Two, run the fire drill. If you've not logged in, or you've outsourced the keys to someone else, start there. You need to maintain the master set of keys, and find ways of sharing access where the person never gets the actual password. Log in. Make sure email addresses are up to date. Make sure credit cards and billing information are up to date. Make sure you have that information going forward. That's where you want to start.
Three, you thought of a friend. Anyone whose website was set up by someone else is really one lapsed renewal away from this exact morning. Send them this. They are also one step away from getting locked out of things.
Any of those choices is valid. Choose one, two, or three.
Here's your free homework. Open a note. And when I say this, it can be digital. For myself, it is Notion. I want you to keep track of these three things to begin with: where your domain is registered, where your site is hosted, and whose email is on each account. If you can't answer all three of those, you just found the starting point of your drill.
You want to do this for any tech that could shut down your business. My entire business is on Kajabi. It's been there since 2015. I have no plans to move it. Why I went with something that holds everything is a topic for a different day. And I have backups outside of Kajabi for any critical pieces I would need to restart the business. Notion, which has login information, I would consider the same level as getting locked out of my website, because it holds so much of my content infrastructure, and "content" is a very broad definition there.
Keeping track of where our access is, the email addresses, the billing and payment, is honestly a very boring task. But it feels really necessary when you can't log in to the places you need to log into. Losing access to whatever makes up your site matters, because your site is what allows you to run your business. It could be landing pages. Your site could be that you sell strictly through social media. So your social media accounts are your site, and we will talk about that in a different fire drill. When I'm saying "site," it is where you are able to sell. That's an easy way to remember it.
The link for the Smoke Detector is in the description, in the show notes. Use it. It will tell you if there is smoke. If there is smoke, there is fire. If there's fire, we run the fire drill before this thing kicks off into a five-alarm fire. Because business moments are predictable. Your panic is optional. And we are going to run the fire drill before the fire alarm goes off.
