Only you can manage a service
The account is in your name and no one else can get in.
Fix: add the client or a trusted helper as an admin, or move the account into the client’s name.
guide
Write your first continuity plan in fifteen minutes
Everything you need to know to use Spare Key, whether you build websites or someone builds yours.
Builders map a client’s setup and write the continuity plan. Owners send a request to the person who looks after their website.
before you startThe 6 things to have to hand
None of these are required, and you can stop and come back any time: your work is saved in this browser.
- The client’s web addresses, including any old ones
- Access to the domain, hosting and email accounts, to check whose name each is in, who pays and when it renews. You won’t type any passwords here.
- For a site built from code: its
package.json, and where the code is kept - For WordPress: access to the dashboard, to copy the site information
- An email address for the client, and for an emergency contact you trust
- How the logins and backups are kept now
six stepsFrom domain name to continuity plan
-
People
Add the client, yourself, and an emergency contact: someone who could reach your accounts if you couldn’t, such as your executor.
-
Domains
Type each domain. Spare Key reads the public records: registrar and renewal date, DNS host, website host, email provider, who can send as the domain, and the certificate.
-
Services
Each finding becomes a service. Record whose name it’s in, who pays, and whether a second person can manage it. Add what the lookup can’t see.
-
Access and backups
Say where the passwords and backups are kept. Never type the passwords themselves.
-
Risks
See what would break without you, most serious first. Fix what you can and watch the list shrink.
-
Hand over
Download the Word document for the client and save the inventory file. Yellow highlights are gaps still to fill.
what the risks meanEach one, and how to fix it
Email on a privately run server
If whoever runs that server stops, email stops, often without warning.
Fix: move email to a service in the client’s own name.
An old address someone else now owns
It was registered again after you stopped using it, and may be using your old name to sell things.
Fix: open it and look, then follow the domain policy page on who to tell.
Expired certificate
Visitors see a security warning, and many leave.
Fix: ask the host to renew it.
Domain renewal
A lapsed domain takes the website and email down, and anyone can then buy the name.
Fix: turn on auto-renew and keep the card current.
Paid by you
When your payments stop, the service stops too.
Fix: move the bill to the client.
No SPF or DMARC
Mail is more likely to land in spam, or be spoofed.
Fix: add the records your mail provider gives you.
where the code livesIf you work on your own
If you build websites on your own, you may never have needed GitHub or anything like it. But the files that make up a website have to be somewhere the client can reach if you can’t, and on your laptop isn’t that place. What to do depends on how the site was made.
| If the site is… | What to do |
|---|---|
| Made with a site builder, such as Wix, Squarespace or Shopify | Nothing about code: there isn’t any to keep. Make sure the account is in the client’s name, with you added as a contributor. |
| WordPress, or another content editor, on hosting | The site lives on the hosting, with its content in a database. Put the hosting account in the client’s name and send backups to the client’s own storage (see backups). If you wrote a custom theme or plugin, keep a copy of that on GitHub too. |
| Built from code, such as HTML, Astro or Next.js | The code needs a home the client can reach: a free GitHub organisation in their name. The steps are below. |
What GitHub is
A website that stores code and every earlier version of it, so nothing is lost and any change can be undone. It’s free for this. Hosts such as Vercel and Netlify read the code from GitHub and publish the site whenever it changes. An organisation is a shared space on GitHub that belongs to the client, not to you, with people invited in.
Give each client their own organisation
The client makes a free GitHub account
At github.com, with an email address the organisation controls, such as office@. Their login goes in their password vault.
Create an organisation for them
On GitHub, click + at the top of the page, choose New organization and pick the Free plan. Name it after the client. If you create it, invite the client and make them an Owner, so there are two of you.
Move the code into it
In the repository, open Settings, scroll to the Danger Zone and choose Transfer ownership. Pick the client’s organisation. Old links still work.
Check the site still publishes
Reconnect the host to the new organisation. On Vercel’s free plan, a private repository owned by an organisation won’t publish directly: use a paid plan in the client’s name, or publish with GitHub Actions. Vercel’s free plan is also only for non-commercial sites, so a business should be on a paid plan anyway.
Turn on two-step sign-in
In the organisation’s settings, require two-factor authentication for everyone, and save each person’s recovery codes in the client’s vault.
Not ready to move it yet? At least add the client as a collaborator: in the repository, open Settings, then Collaborators. They can then see and download the code, though only you can change its settings.
If the files are only on your computer
Install GitHub Desktop. It does all of this without the command line. Add the site’s folder, choose Publish repository, pick the client’s organisation and keep it private. Leave out any file that holds passwords or keys, such as .env: GitHub Desktop lets you ignore it.
Your own sites
Code for your own projects can stay in your account. Name a successor under Settings, Account, Successor settings, who can take over your public repositories. For private ones, make sure your GitHub login and recovery codes are in your password manager, with emergency access set up.
jargon busterThe words you’ll see, in plain English
- Domain name
- Your address on the internet, like example.org. You rent it yearly from a registrar.
- Registrar
- The company you rent the domain from, such as GoDaddy or Namecheap.
- DNS
- The settings that point your domain at your website and email.
- Repository
- A folder of a website’s code, with every earlier version kept. Often shortened to repo.
- GitHub
- The best-known place to keep repositories. Hosts such as Vercel publish from it.
- Hosting
- The service that stores your website and shows it to visitors.
- MX record
- The DNS setting that says where your email is delivered.
- SPF and DMARC
- DNS settings that tell other mail servers who may send email as you.
- Certificate
- What makes the padlock appear. It must match your domain and be renewed.
- RDAP
- The public registry record that shows who a domain is registered with and when it renews.
- Inventory file
- The .json file Spare Key saves. It holds no passwords, so you can keep it anywhere and open it again next year.
templatesRather fill it in yourself?
The same continuity plan as blank templates. Nothing to sign up for, and nothing leaves your computer.