Owning a website, answered plainly.

Usually four separate things: the domain name, which you rent each year from a registrar; the hosting or website-builder plan that keeps the site online; the content, meaning your words, images and code; and the accounts that control them. Whoever controls those accounts controls the website, so make sure they’re in your name. Full answer →

The domain is your address, such as yourbusiness.com. Hosting is the computer that stores your website and shows it to visitors. A website builder such as Squarespace, Wix or Shopify bundles hosting with design tools. You can buy them from one company or several, and a domain can always be pointed somewhere else. Full answer →

In your name, or your business’s. The registrant, the person or company recorded as holding the domain, is the one who controls it. If your designer or agency registered it under their name or in their account, ask them to move it into an account you own. Moving it is usually free and protects you if you ever part ways. Full answer →

Search for your domain at ICANN Lookup (lookup.icann.org). It shows the registrar, the company you rent the domain from, and the expiry date. Then search your email for that company’s name to find the account and its renewal notices. Full answer →

Look on your card or bank statements for a hosting or website-builder charge, search your email for their welcome messages and invoices, or ask whoever built the site. Free online “hosting checker” tools can also read your domain’s DNS, but the bills show who you actually pay. Full answer →

Your website and email on that domain stop working, but you can usually still get it back. For .com and other generic domains, your registrar must give you at least 8 days to renew after switching the site off, and then there’s usually a 30-day redemption period where you can restore it for an extra fee. After that, anyone can register it. Full answer →

To move registrars, unlock the domain, get its transfer code (also called an auth or EPP code) from the current registrar, and start the transfer at the new one. It usually takes up to about five days and, for most domains, adds a year to the registration. To hand a domain to another person at the same registrar, use that registrar’s account change or “push” option instead. Full answer →

Usually not. SSL (the padlock and “https” in the address bar) comes free with almost every website builder and host, mostly through Let’s Encrypt. A paid certificate rarely adds anything for a small business website. If you’re being charged for one, check your site already shows the padlock before cancelling it. Full answer →

It isn’t required, but you@yourbusiness.com looks more trustworthy than a free Gmail or Outlook address, and the address stays with the business when people come and go. Google Workspace and Microsoft 365 charge per person per month; some hosts include basic mailboxes, and email forwarding is often free. Full answer →

For anything your business relies on, yes, as long as the card on file is valid and you’ll notice the charge. Auto-renew prevents an accidental expiry. Turn it off only for services you plan to cancel, and put the cancellation date in your calendar so a forgotten trial doesn’t turn into a bill. Full answer →

One year with auto-renew suits most small businesses. Registering for several years, up to 10 for most domains, cuts the risk of a missed renewal and fixes the price for that period, but costs more upfront. Registering for longer doesn’t improve your search ranking. Full answer →

DNS is the internet’s address book. Your domain’s DNS settings tell browsers where your website is, and tell other mail servers where to deliver your email. Whoever controls your DNS can redirect your website or your email, so protect that login like a bank login. Full answer →

Keep one list per website: every service it uses (domain, DNS, hosting, email, payments), who controls each account, what each costs, when it renews, which card pays, and where backups and logins are kept — but never the passwords themselves. That list is what you need when something breaks, when you change web designers and when you sell. Full answer →

Write down every service’s renewal date, price and the card that pays it, and set a reminder a week or two before each one. After each renewal, check the next date has moved on a year or a month. SlopDox does this for you: it shows what renews in the next 30, 60 and 90 days and, on paid plans, emails you 7 days before each renewal. Full answer →

The next renewal charge fails. Most providers retry and email you, but if the card isn’t updated, the service can be suspended and a domain can expire. Put your new card on every provider account before the old one expires; a replacement card from your bank doesn’t always update itself everywhere. Full answer →

Invite them as a user on each account, with their own login, instead of sharing your password. Give only the access they need, keep yourself as the account owner, and remove their access when the work is finished. Registrars, hosts, website builders and email providers all support this. Full answer →

In a password manager, such as 1Password, Bitwarden or the one built into your browser or phone, with two-factor authentication turned on. Keep account recovery codes somewhere safe offline as well. Don’t keep passwords in spreadsheets, documents or email. Full answer →

Make sure you control the essentials: the domain, the hosting or website-builder account, DNS, email and a full copy of the site. Ask the designer to move any accounts in their name into yours, then remove their access and change passwords and recovery emails. Do it while you’re still on good terms if you can. Full answer →

Set the website up at the new host first and test it, then change your domain’s DNS records or nameservers to point at the new host, and cancel the old host only after a few days. Move email separately and carefully, because DNS changes affect email too. Full answer →

Match every website charge on your card statements to something your website actually uses. Look for a domain you pay for twice, paid SSL or privacy add-ons you could get free, trials that became bills, unused servers and databases, and renewals still charged to a personal card or a card that is about to expire. Full answer →

Usually because your website builder, such as Squarespace or Wix, bills you for a domain or a “custom domain” while you also pay a registrar like GoDaddy or Namecheap to keep the same name. You only need one: point the registrar’s domain at your builder and cancel the builder’s charge, or move the domain into the builder and stop paying the registrar. Full answer →

For most small business websites, no. The free DNS from your registrar, host or a service like Cloudflare is fast and reliable. And if your domain’s nameservers point somewhere else, a registrar’s premium DNS add-on isn’t being used at all, so it can be cancelled. Full answer →

Things nothing depends on: add-ons you don’t use, trials you never set up, servers or databases from finished websites, and duplicates. Before cancelling, check what connects to the service, take a final backup, and find out whether cancelling ends it straight away or at the end of the period you’ve paid for. Full answer →

Often not. Many registrars include domain privacy free for .com and other generic domains, and hide personal details by default. Country domains have their own rules: .au domains don’t allow privacy services at all. If you’re paying for privacy or a “protection” bundle, check for a free option before it renews, or move to a registrar that includes it. Full answer →

Turn on two-factor authentication at your registrar, keep the domain’s transfer lock switched on, keep the account’s email address current and on an address you control, and don’t share the login. For a domain your business couldn’t survive without, ask your registrar about a registry lock. Full answer →

It might be. Some companies send official-looking renewal notices that are really an offer to transfer your domain to them at a higher price, and some emails are phishing that steals your login. Don’t pay from the message or click its links. Sign in to your registrar directly and check the expiry date there. Full answer →

At least two: the automatic backups your host makes, and your own copy kept somewhere else. Check you can actually restore one, and take a fresh backup before any big change. Some website builders don’t let you download a complete copy of your site, so keep your own copies of your text, images and product data. Full answer →

Yes. Start with your domain registrar, your hosting or website builder, your email and your payment accounts. Two-factor authentication means a stolen password alone isn’t enough to get in. Use an authenticator app or a passkey where offered rather than text messages, and keep the backup codes somewhere safe. Full answer →

Almost certainly, if it collects any personal information: contact forms, newsletter sign-ups, orders, accounts, or analytics and advertising tools. Privacy laws such as the GDPR, the UK GDPR, the Australian Privacy Act and California’s privacy laws require you to explain what you collect, why, who you share it with and how people can exercise their rights. Full answer →

It can. The GDPR applies to businesses outside the EU when they offer goods or services to people in the EU, or monitor their behaviour there, for example with tracking or profiling. Simply having a website people in Europe can visit isn’t enough on its own; selling to them, targeting them or tracking them is. Full answer →

Usually not if your annual turnover is A$3 million or less: most small businesses are exempt. But the exemption doesn’t cover businesses that provide a health service and hold health information, and there are other exceptions. If the Act applies, you must follow the 13 Australian Privacy Principles and report serious data breaches. Full answer →

Only if you’re a for-profit business that meets one of its thresholds: annual revenue over US$26,625,000, buying, selling or sharing personal information of 100,000 or more Californians, or earning half your revenue from selling or sharing personal information. Many small businesses fall below all three. Full answer →

Contain it first: change passwords, revoke leaked keys and fix the hole. Then work out whose data was exposed and how serious the risk is, because many privacy laws set deadlines for telling the regulator and the people affected — 72 hours under the GDPR and UK GDPR, for example. Keep a written record of what happened and what you did. Full answer →

Yes. In the US, COPPA requires verifiable parental consent before collecting personal information from children under 13 on sites aimed at children or that knowingly collect it. Under the EU GDPR, children under 16 need a parent’s consent where you rely on consent (countries may lower this to 13); in the UK the age is 13. Full answer →

PCI DSS is the card industry’s security standard for anyone who accepts card payments. The simplest way to keep it manageable is to never let card numbers touch your own systems: use a hosted checkout or payment form from a provider such as Stripe, Square or PayPal. Websites that do this can usually complete the shortest self-assessment, called SAQ A. Full answer →

Stricter ones. Health information is treated as especially sensitive almost everywhere: in the EU and UK it’s a special category of personal data that needs a specific legal basis; in Australia, health service providers are covered by the Privacy Act whatever their size; and in the US, HIPAA applies to healthcare providers, health plans and the businesses that handle health data for them. Full answer →

If people in the EU use your website and it sets cookies or trackers that aren’t strictly necessary, such as analytics and advertising tools, you need their consent first, and a cookie banner is how most websites ask. The UK now lets some analytics and preference cookies run without consent if you tell people and let them object, but advertising cookies still need consent. Full answer →

Increasingly, yes. The European Accessibility Act has applied since 28 June 2025 to many online shops and services sold to consumers in the EU, with an exemption for the smallest service businesses. In the US the ADA covers businesses open to the public, and UK and Australian equality laws cover websites too. WCAG 2.2 level AA is the usual benchmark. Full answer →

Get permission first wherever the law requires it (the EU, UK, Australia and Canada generally do), always say clearly who the email is from, include a working unsubscribe and act on it quickly, and never use misleading subject lines. The US CAN-SPAM Act lets you email without prior consent but still requires an opt-out, your postal address and honest headers. Full answer →

No law requires every website to have terms and conditions, but if you sell online they’re strongly recommended, and some information is legally required: who you are, prices, delivery and customers’ cancellation and refund rights. Terms can’t take away rights consumer law gives customers, such as a remedy for faulty goods. Full answer →

It depends on the country and how your business is set up. As a guide: 5 years in Australia, 6 years for UK companies and in Canada, 7 years in New Zealand, and generally 3 years in the US, longer in some cases. Keep your domain, hosting and software invoices with your other business records. Full answer →

It can, if people in the EU use it — for example, people may need to be told they’re talking to an AI. For what the EU AI Act means for your business, use GlassBots’ EU AI Act questions and answers and its AI assistant, which are kept up to date for small businesses. Full answer →

Check what you’d take over and what it costs to run: who holds the domain, every hosting plan and paid service, the real traffic and income with proof, any legal duties from the data it collects, and exactly what transfers with the sale. Ask the seller for evidence, and pay through an escrow service rather than directly. Full answer →

Transfer each account to the buyer one at a time: the domain, the hosting or website builder, email, payments and any other tools. Give the buyer a written list of what’s included and when each item renews. Change passwords and replace keys as you go, and keep your own records of the sale for tax. Full answer →

SlopDox is free for up to 3 websites and 15 services, and every new account starts with a 14-day free trial of Pro Plus. Pro is $15 a month for up to 10 websites, Pro Plus is $49 a month for up to 30 websites and Business 50 is $99 a month for up to 50 websites. For more than 50 websites, talk to us and we’ll reply with a price. Full answer →

No. SlopDox asks plain-English questions — where you bought your domain, who hosts the site, how you send email — and explains every term as you go. If you’re not sure of an answer, each question tells you how to find out, and SlopDox looks up what it can from your domain’s public records. Full answer →

Never. SlopDox records where each login lives and who controls it, not the password or key itself. If you paste something that looks like a password or key, SlopDox refuses to save it. Keep the secrets themselves in a password manager. Full answer →

By how many you’re looking after right now, not how many you’ve had in a year. When you sell a website, or decide not to buy one you were researching, it moves to your archive: kept for your records and tax, and never counted. Websites you’re researching before buying do count while you research them. Full answer →

Up to 3 websites and 15 services, with the dashboard, the clean-up scan and its step-by-step guides, compliance assistance and the spending report on screen. Upgrade for an email before every renewal (not just domains), printing and downloading reports, unlimited services or more websites. Full answer →

Talk to us. Business 50 covers up to 50 websites; above that, we price a plan for the number of websites you look after and the people who need access, so agencies pay only for what they use. Choose Talk to us, then “More than 50 websites, or a bigger team”, fill in the short form, and we’ll reply by email with a price. Full answer →

Nothing is deleted, and you can still see and edit everything. You can’t add websites or services beyond the Free plan’s limits until you remove some or upgrade again. Emails for renewals other than domains, and exports, pause; domain renewal emails carry on. Full answer →

No. It’s compliance assistance: plain-English notices about the laws that may apply to your website, the exact legal references behind them, and a printable pack to take to your lawyer or accountant. For questions about the EU AI Act, SlopDox points you to GlassBots. Full answer →

Once the buyer has paid, send it to them with “Send to new owner” on its Handover tab: they get a copy in their own SlopDox account (free), and your copy becomes a read-only record of what you handed over. Or just change its status to Sold. Either way it moves to your archive with all its records, its bills stop counting from that day, and it no longer counts towards your plan. Full answer →

Open the website’s Handover tab and use “Send to new owner” with the buyer’s email (for several websites, choose “Send several to one new owner” on the Websites page). The buyer accepts with a free SlopDox account and gets a copy of every service, the logins to take over, the bills (without your cards), the map and the handover plan. Then you both tick off each service in the Transfer Room until the buyer signs it off. Full answer →

Open the link in their email, sign in or open a free account with that email address, and press “Accept these records”. The websites arrive complete in your own account, even beyond your plan’s limits, with a welcome package listing the logins to take over and the bills to move onto your card. It costs you nothing, and a new account still gets its 14-day free trial of Pro Plus. Full answer →

Seven days before an automatic renewal, plus a heads-up when a free trial is about to turn into a bill or when the card on file expires before the renewal date. Every plan, including Free, gets emails before domains renew; paid plans and the free trial get them for every renewal. Full answer →

Anything in a website’s ledger: a domain, a DNS host, a hosting plan, a database, an email service, a payment provider, or the place a key is kept. Charges and add-ons on a service don’t count separately. Full answer →

A printable due-diligence report for a website you’re thinking of buying: record what the seller tells you, and SlopDox shows what you’d take over, the next 12 months of costs, savings you could make, the laws that apply and the questions to ask the seller. Full answer →

Yes. Under Websites, choose Import domains from a file. With Porkbun or Cloudflare you can connect your account with a key that SlopDox uses once and doesn’t keep. With Namecheap, GoDaddy, Name.com and most others, download your domain list as a CSV file and upload it. You check every domain, date and price before anything is saved. Full answer →

Yes. When you add a website, or later with Edit details at the top of its pages, fill in “Who is it for?”. Websites with the same client are grouped together on your Websites page and in the menu, and the spending report download has a Client column, so you can see what each client’s websites cost. On Pro Plus and above, you can also invite a client as view-only and let them see only their own websites. Full answer →

Yes. Open the website, go to the bottom of its Overview, choose Delete website and type its name to confirm. Deleting removes its services, charges, map and notes for good. If you sold it or decided not to buy it, change its status to Sold or Didn’t buy instead: it keeps its records and doesn’t count towards your plan. Full answer →

Yes. On a phone, SlopDox has tabs for Today, Websites and Cards, and a More menu for everything else, so you can check what renews next, fix a card warning or look up who controls an account from anywhere. Long reports and printing are easier on a computer. Full answer →

All of them: you can add any company by name. SlopDox already knows common ones such as GoDaddy, Namecheap, Cloudflare, Squarespace, Shopify, Vercel and Stripe, explains what each does and spots their common billing traps. Domain lists can be read straight from Porkbun and Cloudflare accounts, or imported from a Namecheap, GoDaddy, Name.com or any other CSV file. Full answer →

The SlopDox assistant answers questions about SlopDox and about owning, organising and protecting websites, at any hour. It finds the best answer in this help catalog, shows the parts that match your question and links to the full answer. Check anything important with the full answer or a professional. It never needs your passwords or card numbers. Full answer →

Yes. Under Account → People, invite them by email as View only or Editor. Every plan includes at least one view-only person — right for an accountant — and paid plans include editors who can change things: 2 on Pro, 3 on Pro Plus and 5 on Business 50, counting you. On Pro Plus and above, a view-only person can be limited to the websites for one client, and you can choose whether they see costs. On any paid plan, an extra editor is $15 a month and an extra view-only person $5. Everyone signs in with their own email, and you can remove anyone at any time. Full answer →

Yes, on every plan. Copy your SlopDox address from AI connections, add it to Claude, ChatGPT or another AI app that supports MCP, then sign in to SlopDox and choose Allow. Your AI can then look up your websites, renewals, costs and findings and answer questions about them. It can’t change anything, and SlopDox doesn’t charge for it. Full answer →