Make one list today of every domain, hosting plan, certificate, licence, subscription and paid listing, with its renewal date, the card it bills and the address that gets its reminders. Then fix whatever is out of date.

Renewals that arrive one at a time

The domain renews in March, the hosting in June, the security certificate in September. A plugin licence renews on whatever day someone bought it, and the directory listing in November.

Each bills a card. Some bill a card that expired last year, one a former employee's, and one the web designer's.

The reminders go to whoever signed up, which may be an address nobody reads any more. Nothing goes wrong until a renewal fails, and then the site, the email or the booking page stops.

This is the year's last working day, and a quiet one in most offices. It is a good afternoon to put every renewal on one list.

What belongs on the list

The fourth has a hidden cost. A lapsed licence on a premium plugin or theme usually keeps working but stops receiving updates, including security fixes, and nobody notices the silence.

Four facts for each renewal

For each item, write down what it is, when it renews, what pays for it and who receives the reminders. Add where to log in, but keep the passwords somewhere else.

Note whether it renews automatically. Automatic renewal is only as reliable as the card behind it, and a manual one depends entirely on someone acting on an email.

Keep the list in a shared document or spreadsheet that at least two people can open. A list on one person's laptop fails in the same way the reminders do.

The card on file

Every card expires eventually, and some are replaced early after a loss or a fraud alert. Each replacement quietly breaks every renewal that used the old number.

The list turns that into a task. When a card changes, go down the column of things it pays for and update each one the same week.

Renewals on a staff member's personal card are worth moving to a business card now, before that person leaves. Otherwise the first sign of their departure may be a renewal that fails on a card they have cancelled.

Who receives the reminder

Renewal notices go to the address on the account, often that of whoever set it up years ago: a former office manager, the first web designer, an old internet provider's mailbox.

Registrars also email domain owners asking them to confirm their contact details, and a domain whose details go unconfirmed can be suspended. An unread address turns that routine email into an outage.

Change each account's contact address to one at your own domain that two people read, such as accounts@ or admin@.

Notices that are not from your suppliers

Official-looking letters and emails arrive offering to renew domains you never registered with that company, or listings in directories you never joined.

Many are sales offers dressed as invoices. Paying one can move a domain to a company that charges far more for it.

With the list beside you, the question answers itself. If the sender is not on it, the notice is not a renewal.

A worked example

A personal shopper takes clients on shopping trips and does wardrobe edits in their homes, with a part-time assistant who handles bookings and the website.

The site had grown piece by piece: a domain, yearly hosting, a certificate for the booking page, a booking service billed monthly, a premium theme with its own licence and a wedding directory listing.

In April the booking page stopped taking appointments. The booking service had tried three times to charge a card that expired in March, and its warnings went to an address from her old internet provider, closed when she switched.

For ten days clients who tried to book saw an error, and several emailed to ask whether she was still working.

The same card sat behind the hosting, the certificate and the domain, all due later in the year.

Her assistant made the list in an afternoon: each service, its date, the card it billed and the address its reminders reached.

Every account now bills a current card, every reminder goes to a shared address they both read, and each date sits in the calendar a month early.

Certificates and the end of SHA-1

Certificates need more than a date. Certificate authorities stop issuing ones signed with the older SHA-1 method after today, and browser makers plan to stop trusting the rest in about a year.

Chrome already flags SHA-1 certificates whose expiry date falls next year or later. If yours is one, note it on the list as a replacement due now, not a renewal due later.

A certificate issued from tomorrow uses the newer method anyway. The risk lies only in leaving an old one in place until browsers refuse it.

Dates that are not renewals

A few other dates belong in next year's calendar for many small businesses.

From January 12, Microsoft will support only the latest Internet Explorer available on each Windows version. On the Windows 7 computers in most offices, that means Internet Explorer 11.

Support for Drupal 6 ends on February 24. Chrome will stop supporting Windows XP and Vista in April, and the free upgrade to Windows 10 ends on July 29.

Each marks the day something stops being looked after, the same risk a lapsed renewal brings.

The counter-case

A business with one domain and one hosting plan, both renewing automatically on a card that expires years from now, needs a short list, not a project.

Where a web company manages renewals for you, the list may already exist on its side. Ask for a copy, and check that every account is in your business's name.

Either way the list takes an afternoon: every renewal, its date, its card and its reminder address, kept where two people can find it.

Before the office closes today

  1. Search this year's email for renewal receipts.
  2. List each renewal with its date.
  3. Note the card each one bills.
  4. Note the address each reminder goes to.
  5. Replace expired cards on every account.
  6. Move reminders to an address two people read.
  7. Put every date in next year's calendar.

Step five is the one that prevents the next failure. Automatic renewal fails silently on a dead card, and updating every account at once closes that gap before any of next year's dates arrive.

What visitors see when a hosting plan or domain does lapse is covered in the host's default page showing instead of yours.

Frequently asked questions

What should a renewal list include?

Every domain, hosting plan, certificate, plugin or theme licence, subscription and paid listing, each with its renewal date, the card it bills and the address receiving its reminders.

Why do automatic renewals still fail?

Usually the stored card has expired or been replaced. Automatic renewal is only as reliable as the card behind it, so update every account when a card changes.

Where should renewal reminders go?

To an address on your own domain read by two people or more, not to a former employee, the first web designer or an old internet provider's mailbox.

What happens when a plugin licence lapses?

The plugin usually keeps working but stops receiving updates, including security fixes. Nobody notices until a flaw an update would have fixed is used against the site.

How do I spot a fake renewal notice?

Check the sender against your list. A notice from a company that is not on it is a sales offer, not a renewal, however official it looks.

What changes for certificates after today?

Certificate authorities stop issuing certificates signed with SHA-1. Renewals will use the newer method, but an existing SHA-1 certificate running past this year already draws warnings in Chrome.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure what renews when?

Send us your domain names. We will list every renewal we can find and where each reminder goes.

Start a Conversation