You cannot prepare account recovery after being locked out. That single sentence is the whole article. An expired domain, a lost authentication device, a password reset email that never arrives — every one of these is discovered after the door has already closed behind you. What you need at that point is not skill; it is another door you opened in advance.
Happily there is not much to prepare. There are only three doors, and half an hour today covers all of them.
Three doors that can lock
The order matters. When a domain stops, the email addresses on that domain stop too — and the recovery address for your hosting and your site is usually one of them. The top door holds the keys to the two below it, so preparation starts at the top.
The commonest trap — recovery email on the domain you just lost
Registrar accounts with a recovery address of me@mydomain.com are extremely common. Nothing is wrong day to day; it even looks tidy. Then a renewal fails, the domain stops resolving, and you are in a position where the only way to receive the recovery message is through the very account you are trying to recover. The door has locked from the inside.
The fix is trivial. Point the recovery route for your domain, hosting, payment and site administrator accounts at an address that has nothing to do with that domain. A personal address or a separate free account is fine; the one requirement is that it is an inbox you genuinely read today. Renewal reminders and unusual-login alerts arrive there too.
Domain — start by writing down where it lives
A surprising number of owners do not know which registrar holds their domain. An agency bought it on their behalf, or it came bundled with a hosting order, or it was transferred in from somewhere else years ago. In that state you can neither renew it nor move it.
Finding out is easy: look your domain up in any whois service and the registrar name is right there. Writing that name and the login route down solves half the problem on its own. Three things are worth confirming while you are there: is auto-renew on, is the card still valid, and is the registration in your own name.
The last one matters most. A domain registered under an agency account takes time to recover once the relationship ends, and the site and the email stop together in the meantime. If that is your situation, today — while nothing is wrong — is the easiest time to move it.
Hosting — billing access and server access are separate doors
Hosting really has two doors: the billing and management account that pays for the service, and the server access that reaches files and the database (SSH, a control panel, database credentials). With only one of them you can do only half of anything.
There is a further reason this door matters. If you can get into hosting, you can restore a WordPress administrator password — by changing it in the database directly, or with a command-line tool. So a locked site is recoverable while hosting is open. The catch is the reverse: if both are tied to the same mailbox, they lock together.
If you have two-factor authentication switched on, take the backup codes. Losing or replacing a phone and losing the authenticator app with it is the most common accident in this family. Keep the codes somewhere that is not that phone — printed, or in a password manager.
Site administrator — make two, and leave one unused
A single administrator account is a single point of failure. Email addresses change, reset messages get filed as spam, accounts get deleted by mistake. All of these happen.
Create a second administrator and then do not use it. Give it a different password from the first, a different recovery address, and two-factor authentication. Adding accounts generally widens your attack surface — this one earns its place as a recovery route precisely because it is never logged into day to day, strongly protected, and known only to you.
One more check if someone built the site for you: sometimes the only administrator is the agency’s account. When you take handover, create an administrator in your own name first, then tidy up the agency account once the work is finished.
A thirty-minute checklist
Half an hour is enough to walk the list, and what it protects is not really the website — it is the enquiries and the revenue that arrive through it. A domain that stops for a day stops that day’s mail as well.
Accounts, logins and backups are handled together in the before your first security incident series, and the wider subject lives in the Security archive. To have access, permissions and server configuration reviewed as one job, see our optimization program.