Key Takeaways
- Reliable website operations depend on documenting five records per client site: hosting and panel access; domains with DNS and SSL; WordPress installs and licenses; subscription and edition details; and backups.
- One team member holding this knowledge alone is a handover risk that stalls onboarding and incident response.
- Your hosting panel already tracks part of this inventory. The domain registrar, SSL issuer, and backup destination still need their own record.
Your agency’s most senior developer just gave two weeks’ notice, and no IT infrastructure documentation shows which hosting account her client portal runs on, who owns the domain, or which Plesk edition it runs on. The next ticket waits while someone pieces together access from old emails and an outdated password manager.
This is the gap IT infrastructure documentation closes: a reference system for what you run. It spans hosting accounts, panel access, domains, WordPress installs, and the per-client records your SOPs assume exist: the ongoing work known as WebOps, short for website operations. This article covers those five records and how to start.
What Counts as Website Infrastructure Documentation for an Agency
For an agency, IT infrastructure documentation is the written record of every hosting account, panel login, domain, SSL certificate, WordPress install, and subscription tier your team manages, not the servers, routers, or switches a network team would document.
Most guidance on this topic targets sysadmins tracking hardware and network topology, not the panel logins, domains, and site records an agency needs.
The Core Records Every Agency Website Needs to Keep
Five records make up the core of an agency’s website infrastructure: hosting and panel access; domains with DNS and SSL; WordPress installs and extension licenses; subscription and edition details; and backup and recovery. Each answers a different question when something breaks or someone leaves.
Hosting Accounts & Panel Access
Record which hosting account and Plesk panel login each client site runs on, who has access, and at what permission level. NIST SP 800-53 Rev. 5 control AC-6 sets a useful principle for your access records: least privilege, not blanket admin rights. OWASP’s Secrets Management guidance covers the rest: rotate your credentials on a schedule and centralize secrets storage instead of hardcoding them.
Domains, DNS & SSL/TLS Certificates
Capture the domain registrar, DNS host, and SSL/TLS issuer for every site you manage, plus each certificate’s renewal date. This changes fastest of the five records: the CA/Browser Forum’s Ballot SC-081v3 set a step-down schedule for maximum certificate validity from 398 days to 47 days by March 2029; a 200-day interim cap has applied since 15 March 2026.
WordPress Installs & Extension Licenses
Log every WordPress install your agency manages, its extensions, licenses, and edition. WP Toolkit gives you one dashboard to mass-manage WordPress: bulk updates, one-click hardening, a vulnerability scanner. That dashboard already inventories every WordPress instance on Web Pro and Web Host; Web Admin’s WP Toolkit SE is manual-only.
Subscription & Edition Records Per Client Site
Record which Plesk edition each client subscription runs on; the edition sets your domain ceiling and available tools. The Plesk editions page lists three hosting editions relevant here:
Web Admin
- Domain Limit: Up to 10
- WP Toolkit: SE (manual Only)
- Service Provider View: Not Included
Web Pro
- Domain Limit: Up to 30
- WP Toolkit: Standard/Deluxe (auto-updating)
- Service Provider View: Included
Web Host
- Domain Limit: Unlimited
- WP Toolkit: Standard/Deluxe (auto-updating)
- Service Provider View: Included
Service Provider View is the subscription layer multi-site agencies need. Plesk’s docs don’t confirm a subscription-list export, so track that externally.
Backup & Recovery Details
Record where each client site’s backups actually live, not just that they’re scheduled. Plesk’s Backup Manager runs free scheduled and manual backups to local storage; remote cloud or SFTP storage needs a separate Backup to Cloud Pro license. Recovery is the other half: GDPR Article 32(1) requires restoring data access in a timely manner after an incident, so log how you’d recover a site, not just where its backup sits.
Your IT Infrastructure Documentation Template: What to Record, Where It Lives, and Why It Matters
Use this to map each website infrastructure record you keep to what to capture, where it lives, and why a gap costs you downtime or handover risk.
Hosting & Panel Access
- What to capture: Account Panel login, Access level
- Where it lives: Plesk panel, Password manager
- Why it Matters: Blocks response and onboarding if one person holds access
Domains, DNS & SSL
- What to capture: Registrar DNS host Issuer, Renewal date
- Where it lives: Registrar account, Certificate dashboard
- Why it Matters: Blocks response and onboarding if one person holds access
WordPress & Extensions
- What to capture: Install location Extensions, License keys
- Where it lives: WP Toolkit (Web Pro/Host), External tracker
- Why it Matters: Licenses lapse quietly and break sites
Subscription & Edition
- What to capture: Edition per site, domain limit
- Where it lives: Panel edition record, Spreadsheet (no confirmed export)
- Why it Matters: Wrong edition assumptions cause gaps
Backup & Recovery
- What to capture: Schedule Storage location, Restore check
- Where it lives: Backup Manager (local), Backup to Cloud Pro (remote)
- Why it Matters: Local-only backups don’t survive server failure; unchecked ones don’t survive use
How to Start Documenting Your Infrastructure
- Step 1: Inventory hosting accounts and panel logins. List every panel your agency accesses and who can log in.
- Step 2: Record domains, DNS, and SSL details. Log the registrar, DNS host, issuer, and renewal date per site.
- Step 3: Log WordPress installs, extensions, and edition per site. Start from WP Toolkit’s dashboard, then add what it misses.
- Step 4: Confirm where backups live. On-server or remote, and fix any gaps.
- Step 5: Set a fixed review date. CIS Control Safeguard 1.1 sets bi-annual review as the floor; treat that as a minimum.
Make the Documentation the System, Not a One-Time Project
Website infrastructure documentation only pays off if someone keeps it current. Hosting accounts, domains, installs, subscriptions, and backups change as clients onboard and roles change, so the documentation must change with your WebOps too. Build the five records on at least a six-month review cycle, starting with whichever you’re least confident you could produce today.
Ready to close this gap for your first client site?
