Plenty of ExpressionEngine and Craft CMS sites run on a single relationship: a freelancer who built the site years ago and has quietly maintained it since, or an in-house hire who set everything up and never wrote any of it down. That works fine for years. Then that person goes on holiday during a launch, gets a new job, or stops replying to emails, and the business finds out how much depended on one inbox.
It rarely starts as a decision. A freelancer gets hired for a one-off project, does good work, and becomes the default person to call whenever something needs changing. Three years later they’re managing hosting renewals, domain registration, addon licenses, and a list of custom code changes that only exist in their memory. Nobody sat down and chose this. It happened one small request at a time.
The same pattern shows up with a single in-house hire. One developer builds the site, configures the server, and picks the tools. If that person is the only one who ever touches the CMS, the business has the same single point of failure as it would with a freelancer, just with a payslip instead of an invoice.
Most businesses in this position don’t know how exposed they are, because the arrangement has never been tested. A few things tend to surface at the worst possible moment: hosting and domain accounts registered under the developer’s personal email rather than the company’s, addon licenses tied to their account, no record of what custom code exists or why, and login credentials that only live in one person’s password manager.
This is the default outcome of any relationship that works well enough that nobody ever asks for anything to be documented.
The trigger is rarely dramatic. It might be a family emergency, a new job that keeps them too busy to reply, a rate increase the business can’t absorb without notice, or someone deciding to leave web development altogether. Whatever the reason, once that one person can’t or won’t help, the site keeps running exactly as it was until something needs to change, and that’s when the business finds out it’s stuck.
Fixing it under pressure costs more than fixing it in advance. A new developer taking over a site with no documentation and unclear access has to reconstruct months of decisions before they can safely touch anything, and that reconstruction gets billed by the hour.
Reducing this risk doesn’t take much, mostly a handful of habits set up before they’re actually needed. Hosting, domains, and addon licenses should sit under a company email address, not a personal one. Access credentials should be stored somewhere the business controls, not just in one person’s head or password manager. A short written record of what the site does, which addons are installed, and why any custom code exists saves hours later, even if it’s only a page long.
This doesn’t mean changing who does the work day to day, only making sure the business isn’t starting from zero if that person becomes unavailable.
If you’d like a second opinion on how exposed your site currently is, get in touch with Karl.
Related Services
Most businesses with an ExpressionEngine site didn’t choose ExpressionEngine themselves. A web agency built the site, recommended the CMS, and handled everything from launch onward. That arrangement works well until it doesn’t, and there are several ways it can stop working.
Most clients come to us when their site has started to feel like a risk rather than an asset. Whether the agency relationship has ended, an upgrade has been delayed, or the site has simply grown beyond what it can handle, a conversation costs nothing.
Get in touch with KarlTrusted by established businesses and growing brands across the UK
Expression 37 works with a small number of clients at any one time. These are some of them.
Karl founded Expression 37 in 2007 and has worked exclusively with ExpressionEngine and Craft CMS ever since. He does not take on work in other platforms and does not hand work to other developers. Expression 37 is deliberately small, because the kind of support that matters to clients with business-critical sites is specific to their site, not something that scales in the conventional sense. If you work with Expression 37, you work with Karl.
Find out how we workKarl was very helpful in providing us with essential insights into the inner workings of our ExpressionEngine driven site. His knowledge level with the ExpressionEngine platform is very impressive and we look forward to dealing with Karl again in the future.
Tim Cullum - Digital Comms Media
David H. Murdock Research Institute