Here's a question worth asking at your next staff or deacons' meeting: if the person who set up the church website moved away tomorrow, could anyone else log in?
For a lot of churches, the honest answer is "I'm not sure." The site was built years ago by a faithful volunteer, a member's nephew, or a former youth pastor. It worked, so nobody thought about it. The logins live in one person's head, or in an email inbox the church can't open.
That's fine until something needs to change. Then a simple job, like updating Easter service times, turns into weeks of tracking people down. In the worst case, the website disappears.
This isn't about blame. Volunteers are a gift, and most of them did exactly what was asked. It's simply a gap worth closing before you need to. Here's what to gather and how to keep it.
The four things that make up a church website
Most church websites depend on four separate accounts. They're often with different companies, and each one has its own login.
- The domain name. This is your address, like yourchurch.org. It's rented by the year from a company called a registrar.
- The hosting or website builder. This is where the pages actually live and get edited.
- The church email, if your addresses use your domain ([email protected]).
- The connected services: online giving, sermon audio or video, event sign-ups, and your Google Business Profile.
The domain matters most. If the hosting account is lost, the site can be rebuilt. If the domain is lost, your address, your email, and every printed bulletin and sign that points people to it can go with it.
Why the domain is the one to watch
Domains renew on a schedule, usually once a year. Registrars are required to send reminders. ICANN, the organization that oversees domain names, requires registrars to notify the registered owner at least twice before a domain expires: about a month ahead and again about a week ahead (ICANN Expired Registration Recovery Policy).
Those reminders go to whatever email address is on the account. If that's the inbox of someone who left three years ago, nobody at the church sees them.
When a domain does expire, the same ICANN policy says the registrar must interrupt the address so it stops working normally, which usually means your website goes dark and church email can stop arriving. There's still a window to renew after expiration, and most domains get a further 30-day period after deletion when they can be restored. But recovery is much harder when you can't prove the account is yours.
All of this can be avoided with a renewal reminder that reaches someone who's still at the church.
A simple plan for getting the keys back
You don't need technical skill for this. You need a free afternoon and a little patience.
Make a list. Write down each of the four pieces above and, for each one, the company name, who has the login, and when it renews. If you don't know the company behind your domain, a "WHOIS" or domain lookup tool on the web will usually show the registrar's name, even if the owner's details are hidden.
Ask kindly. If a former volunteer still holds a login, reach out with thanks, not frustration. Most people are glad to hand it over. Ask them to add the church as an owner or change the account email, rather than just sending you a password.
Use a church-owned email address. Put every account under an address the church controls and that doesn't belong to one person, such as office@ or admin@ at your own domain. When staff change, the address stays.
Have two people with access. The pastor and one trusted administrator or deacon is a good pair. Many services let you add a second user, and that's better than sharing a single password.
Turn on two-step sign-in. Many registrars, hosts, and giving platforms offer multifactor authentication, where signing in needs a code from a phone or app in addition to the password. The Cybersecurity and Infrastructure Security Agency recommends it as an extra layer that protects accounts even if a password leaks (CISA: More than a Password). Just make sure the codes go to a church phone or to both people, not to one volunteer's personal number.
Turn on auto-renew, and keep the card current. Auto-renew does no good if the card on file expired. Put the renewal dates on the church calendar a month ahead as a backup.
Store it somewhere safe. A password manager that two people share is ideal. At minimum, keep a sealed written record in the church safe. Don't keep it in a document anyone can open.
Put it on the calendar once a year
Ownership slips back over time. Volunteers rotate, cards expire, and someone signs up for a new service with their own email "just for now."
Pick a regular date, maybe the start of your church year or the week you approve the budget, and spend twenty minutes checking the list. Is every login still working? Is every account still under a church address? Is anything about to renew? That small habit is what keeps the website in the church's hands.
If you're starting fresh
If you're planning a new website, this is the best time to set it up right. Whoever builds it, ask before you begin: "Who will own the domain and the accounts when you're done?" The answer should be the church, with your people able to log in on day one.
Journey Digital is a small, owner-run church web studio in Wilson, NC. When we build a site, the domain and accounts stay in the church's name, and we walk your team through where everything lives. If you'd like a second set of eyes on what your church has today, we're happy to talk.