Before you startDo not put IC numbers, bank details, passwords, or personal details about the people you help into any message or AI tool. Read everything before you use it.
How this page works. Press Copy under any box. Paste it into WhatsApp, Word or your AI chat. The highlighted [brackets] are the parts you fill in. Part 1 is for now, before you ever need it. Part 2 is for if you are already locked out.
Part 1 · Before you need it
Who can get in?
About 20 minutes. Write names, never passwords.
- Fill in the table below, one row for each account the NGO uses.
- Next to each, write who can log in today.
- For the domain name, write whose name it is registered in. It should be the NGO's. You can look it up at mynic.my/whois (.my) or lookup.icann.org (.com, .org, .net), though the personal details are often hidden.
- Where only one person can get in, add a second person you trust as owner or administrator.
- Check that each account's recovery email and phone number belong to the NGO, not to one person's own phone.
- Keep proof in one folder: your registration certificate and the receipts for the domain and hosting. Keep passwords in a password manager or a sealed note with the chairperson, never in a shared document.
Your table
Press Download for Word to get it as a Word file, or Copy to paste it as text.
[NGO name], checked on [date]
| Account | Who can log in today | A second person added? | Recovery email and phone belong to the NGO? |
|---|---|---|---|
| Email (the one used for sign-ups) | |||
| Domain name (also: whose name is it registered in?) | |||
| Website login | |||
| Hosting account | |||
| Facebook page | |||
| WhatsApp group | |||
| Google listing (Business Profile) | |||
| Bank (online banking) |
Where to click to add a second person
Read on the services' own help pages. Menus change, so follow the screen if it differs.
- Facebook page: switch into the page, open its settings, then Page access, and give someone Facebook access with full control. Full control includes managing everyone else's access, so that person can remove others, including you. Give it only to someone you trust.
- WhatsApp group: open the group, tap its name, tap a member, then Make group admin.
- Google Business Profile: Business Profile settings, then People and access, then Add, and invite by email as Owner or Manager. Each person needs their own Google Account. There is one primary owner, who must transfer primary ownership before leaving.
- Domain, hosting, email and banking: each company is different. Look for words like “users”, “administrative contact” or “authorised person”, and ask the company if you cannot find them.
Part 2 · Already locked out?
Work through it in this order
Start with what to gather, then find out who holds each account. Do not send passwords by email or WhatsApp.
- Gather your registration certificate (for a .my domain, MYNIC lists these forms under Supporting Documents at mynic.my/faq: companies Borang 8, 9, 13, 19, 83 or 83A; businesses Borang D; societies Borang 3), the receipts for the domain and hosting, emails from the person who built the site, and the names of everyone who may have had access.
- Search the domain at mynic.my/whois (.my) or lookup.icann.org (.com, .org, .net) to find who holds it. Write down the registrar and the expiry date. For a .my domain, a change of registrant must be submitted before the domain expires.
- Contact the registrar first. It is on the search result. For a .my domain, if the registrar does not help, write to MYNIC Customer Care at customercare@mynic.my with your certificate and receipts. MYNIC says a change of registrant can only be submitted by the Administrative contact, who must be an authorised employee of the organisation. For a .com, .org or .net domain, ask the registrar for the transfer (auth) code; the table below says what to expect.
- To get into the website, find the hosting company, then send it the email below. We read the terms of four Malaysian hosts and none publishes a process for this, so ask in writing and keep the reply.
- For Facebook and Google, use the table below.
- If you cannot reach the person, or they cannot help, write down the dates, what you asked for and what they said. Keep the receipts. For a contract or money dispute, talk to a lawyer. You can also ask the Legal Aid Department (JBG): 03-8885 1827 for civil matters, advice for Malaysian citizens for a RM10 registration fee. Or ask the Bar Council Legal Aid Centre in your state: the list is at malaysianbar.org.my under Find Legal Aid Centres (Kuala Lumpur: 03-2691 1121). Their pages do not say whether they help an organisation, so ask first. We cannot give legal advice.
Who to contact
| The problem | Who to contact first | What to bring |
|---|---|---|
| You do not know who holds the domain | For a .my domain, search it at mynic.my/whois. For .com, .org or .net, search it at lookup.icann.org. Either shows the registrar and the expiry date. The owner's personal details are often hidden. | The domain name |
| A .my domain: it is not in the NGO's name | The registrar from the search. If that does not work, MYNIC Customer Care: customercare@mynic.my. A change of registrant can only be submitted by the Administrative contact, before the domain expires. | Registration certificate, receipts (step 1 lists which form) |
| A .com, .org or .net domain | The registrar, found at lookup.icann.org. Ask for the transfer (auth) code. It must be given to the registered owner and must not be refused only over a payment dispute. The registrar does not respond: icann.org/compliance/complaint (this does not cover .my). | Proof you are the owner, receipts |
| Website login lost | WordPress “Lost your password?” only works if you can open the inbox on the account. Otherwise the way in goes through the hosting company. | The domain name, the hosting receipts |
| Hosting account: you do not know who or how | The name servers in the domain search often show the host. Open a support ticket from the email the account was registered with. | Registration certificate, receipts, the email below |
| Facebook page | Anyone who ever had full control: ask them to add you. If a Business Account owns the page, use “Request release” (Page setup, then Page access). Facebook gives the business account 30 days to respond. | The page name and link |
| Google listing | business.google.com/add, find your business, select Request Access. The owner has 3 days to respond. If they do not, you may be able to claim the profile. Google says this option is not always available. | The business name and address |
| Search Console or Analytics | Prove ownership with a file, tag or DNS record on the website. Whoever controls the domain and website can do this. | Access to the domain's DNS or the website files |
Emails to send
To the hosting company
Send it from the email address the hosting account was registered with, if you can still open it.
Subject: Request for access to our hosting account, [organisation name] Hello, I am writing for [organisation name], a [registered society / company] in Malaysia (registration number [number]). Our website [domain name] is hosted with you. The account was opened by [name of the person who set it up], who can no longer help us. Please tell us what you need from us to give the organisation access to the account, or to move the account into the organisation's name. We can send our registration certificate and the receipts for the hosting. Could you tell us: 1. Which documents you need. 2. Whose request you will accept. 3. How long it takes. Thank you. [Your name, role and phone number]
To the person who set it up
Keep it friendly. You are asking for details, not blaming.
Subject: Our website and account details Hello [name], Thank you for setting up our website. We are moving all our accounts into the organisation's name, and we need your help with a few details. Could you please tell us: 1. Where our domain name [domain] is registered, and whose name it is in. 2. Which company hosts our website. 3. Who has an administrator login for the website. Please add [name and email of the NGO's person] as the owner or administrator, or tell us how to move each one. If you have a copy of the website files and the database, please send them to us. Thank you. [Your name, role and phone number]
So it cannot happen again
Put this in place
- The domain is registered in the NGO's name, with an NGO employee as the administrative contact.
- Hosting and email accounts are opened with an NGO email address, not a personal one.
- At least two people can log in to everything.
- The proof folder from Part 1 is kept up to date.
Where we read this
Sources, read on 7 and 9 November 2026
- MYNIC: mynic.my/whois, mynic.my/faq, mynic.my/resources/domains/managing-a-domain.
- ICANN: icann.org/resources/pages/transfer-policy-2024-02-21-en and icann.org/compliance/complaint and lookup.icann.org.
- WordPress: wordpress.org/documentation/article/reset-your-password.
- Facebook: Help Centre articles on Page access and on requesting release of a Page from a business account.
- Google: Business Profile “Request ownership”, Search Console “Verify your site ownership”, Analytics “No one has administrative access”.
- Hosting terms: DataKL, Exabytes, Shinjiru and Hostinger.
- Legal aid: jbg.gov.my (Hubungi Kami, Khidmat Nasihat, Kelayakan) and malaysianbar.org.my (Find Legal Aid Centres), read on 9 November 2026.
- No company paid to be here, and there are no affiliate links. This is general information, not legal advice.