Access · Website & domain

Your website, your domain, and the handful of records we ask for.

Three CMS platforms, one DNS section your IT team can work from, what "we host it on a subdomain" means, and the legal footer without which no page can take paid traffic. Nothing here touches your main domain or your corporate email.

Webflow WordPress Shopify Domain & DNS Hosting Legal footer Common questions

One rule for every credential on this page. If a platform has no roles and a password must travel, it travels through a one-time link (onetimesecret.com or your password manager's share feature), never in an email or a chat. You change it when the work is done. If you have already emailed us a password, reset it now; we will ask you to anyway.

Webflow

You buy the site plan on your own Webflow account so the site, the domain and the billing stay yours. We build inside it. Two ways to let us in.

Option A: invite us to your workspace (preferred)

Sign in at webflow.com. Open your Workspace from the top-left dropdown.
Workspace settings → Members → Invite members.
Enter stephen@thegrowthbully.com. Role: Designer (full design and publish on sites in the workspace). Choose Admin only if we are also managing your domain and hosting settings.
Send. A seat may be needed on paid workspace plans; if Webflow asks you to add one, that cost sits with you and we will say so in advance.

How you know it worked. Our address appears under Members with the role you chose, and we confirm the site opens in our Designer.

If it fails. If Members is missing, you are on a Starter workspace, which cannot invite anyone. Use Option B or upgrade the workspace.

Option B: share the login through a one-time link

For Starter workspaces or a site that lives on a personal account. Keep two-factor authentication off during the build (it sends codes to your phone and stops us signing in), and turn it back on when we hand over. Send the email address in the reply and the password through a one-time link.

Which plan do you buy?

A Site plan on the site itself: CMS if the site has a blog, a portfolio or any list of items that updates; Basic for a static site. Buy it before development starts, because a site cannot go live on a custom domain without one. We tell you which in the kickoff email, without a price on this page; Webflow's own pricing page has the current figures.

WordPress

We need a user with the Administrator role. Editor is not enough: Editor cannot add plugins, insert the pixel or Tag Manager snippet, place a booking widget, or change page templates, and every one of those is something we will need to do. You do not need to send us a password: WordPress emails us a link to set our own.

Sign in to yourdomain.com/wp-admin as an existing Administrator.
Users → Add New (on newer versions Users → Add New User).
Username: growthbully. Email: stephen@thegrowthbully.com.
Tick Send the new user an email about their account (on some versions this is the default). Role: Administrator.
Click Add New User. Reply to us with the name of whoever looks after the site day to day, so we can tell them what we install.

How you know it worked. We receive a "set your password" email from your site and confirm we can sign in.

If it fails. If Role only offers Editor and below, your own user is not an Administrator; find one under Users. If the site sits behind a login page (a maintenance plugin, a hosting-level password), send that through a one-time link too. If the email never arrives, a security plugin may block outbound mail; the Administrator can set a temporary password and send it through a one-time link, and we change it on first login.

What we install, declared before it goes in: a Tag Manager container or the pixel directly in the header, a consent banner if you do not have one, and the landing pages or booking widget in scope. Everything is listed in a note to your site contact, and everything is removable.

Shopify

Shopify has a dedicated route for agencies: a collaborator account. It does not use one of your staff seats, it appears separately in your Users list, it only ever has the permissions you tick, and you can remove it in one click. That is why we ask for it instead of a staff login.

Give us your collaborator request code

Sign in to your Shopify admin. Settings → Users (older stores: Users and permissions).
Scroll to Collaborators. Under Collaborator access, choose Only people with a collaborator request code can send a collaborator request.
Copy the four-digit collaborator request code shown there and send it to us with your store's .myshopify.com address (top left of the admin, or under Settings → Domains).

Approve our request

We send a collaborator request from our Shopify Partner account using your code. You get an email from Shopify and a notification in the admin.
Settings → Users → Collaborators: our request shows as pending. Click it, review the permissions, click Accept request.
Reply "Done" to your onboarding email.

Permissions we ask for, and why: Online Store (themes, pages, navigation, blog) for the build; Products and Discounts for offers and add-ons; Apps and channels and Marketing for the Meta and Google channels; Analytics and Orders (view) for reporting; Settings → Customer events for the pixel. We do not ask for Billing, Payments or Store transfer.

How you know it worked. The Growth Bully appears under Collaborators with a green status, and we confirm the theme editor opens on our side.

If it fails. If the code is missing, collaborator access is set to "Anyone can send a request"; either setting works, just tell us which. If you are on a Shopify trial, some settings screens are locked until you pick a plan. Payment methods, business details and banking are set by the store owner and cannot be done by a collaborator; a store that has only PayPal enabled at launch is the most common thing we have to send back.

If we are building a new store for you: create it from your own Shopify account (top left, click the store name, Create store), complete the business details Shopify asks for, and send us the store address. The store is yours from the first minute; we join as a collaborator exactly as above. A preview link with a store password comes to you through a one-time link while the store is unpublished.

Domain and DNS

Your domain stays where it is, with whoever holds it today (your registrar, your hosting company, or Cloudflare). We never ask for the registrar login. We ask for a small set of records on two new subdomains, pasted by whoever manages your DNS, and we tell you exactly what each one is for.

Before any DNS: connect your mailbox first. If your email is on Microsoft 365 or Google Workspace, the CRM can send follow-ups from your real mailbox with no DNS at all. In the CRM click your initials bottom left → My Profile → Email, choose the direct Microsoft or Google sign-in, approve, done. That is now the recommended route and takes a minute. The sending subdomain below is for businesses on other mail systems, or for high volumes you want kept separate. It is Step 4, Option A versus Option B.

Who owns the domain, and who holds the DNS

Tell us on day one who can add DNS records: you, your IT department, a web partner or a hosting company. If it is a third party, give us their email and we send them the record set directly with you copied. Onboarding stalls most often here, waiting weeks for a web partner to reply. If they have not responded in 48 hours, a free Cloudflare account can host just the subdomain while the main domain stays exactly where it is; ask us.

What we ask for and why

Purpose	Type	Host (name)	Value	Why
Campaign pages	CNAME	`go`	`sites.ludicrous.cloud`	Makes `go.yourdomain.com` show the pages we host. TTL 3600 or Auto.
Sending: SPF	TXT	`mail`	`v=spf1 include:spf.leadconnectorhq.com include:mailgun.org ~all`	Says the CRM may send as `@mail.yourdomain.com`. On the subdomain only; your root SPF is untouched.
Sending: MX	MX	`mail`	`mxa.mailgun.org` priority 10 `mxb.mailgun.org` priority 10	Routes bounces and replies. Two records, same priority.
Sending: tracking	CNAME	`email.mail`	`mailgun.org`	Open and click tracking. The host is `email.mail`, not `email`.
Sending: DMARC	TXT	`_dmarc.mail`	`v=DMARC1; p=none; rua=mailto:it@yourdomain.com`	Reports only, no enforcement. Replace the address with your IT mailbox.
Sending: DKIM	TXT	`mx._domainkey.mail` (selector may differ)	Long key, sent to you after provisioning	Signs each email. The key pair does not exist until the subdomain is provisioned, so nobody can quote it in advance.
Verification (when asked)	TXT	`@` or a host we specify	A short token	Proves ownership to Google, Meta or the CRM. Harmless to leave in place.

Replace yourdomain.com with your domain. If your DNS provider asks for the full host name rather than the short one, mail becomes mail.yourdomain.com and email.mail becomes email.mail.yourdomain.com. The DKIM row arrives from us as a separate message once the sending domain is created in the CRM.

Forward the exact set to IT

Copy the block below into the ticket, replacing the domain and the DMARC mailbox. It contains the negative scope that IT departments ask about, so they do not have to write back to check.

DNS change request: scope statement, seven records, two questions for IT, rollback

Cloudflare: the three traps that cost a 25-minute call

Screenshot the DNS page before you change anything, so any mistake can be reverted.
Proxy status must be DNS only (grey cloud) on every record above. Cloudflare turns the orange proxy on by default for CNAMEs; with it on, the campaign subdomain and the tracking CNAME both fail verification.
The host is the full subdomain path. The tracking CNAME goes on email.mail, not on email. Every mail record goes on mail or something under it, never on the root.
"A record with that host already exists" means edit the existing record rather than adding a second one. Two records on the same host with different types (a CNAME beside a TXT or MX) is not allowed, which is why the sending subdomain and the campaign subdomain are different names.
Save, go back to the CRM, click Verify, wait five minutes, click Verify again. Set the new domain as the default sending domain and send one test to an address outside your company.

How you know it worked. The self-check above turns green for go.yourdomain.com, the CRM shows the sending domain as Verified, and a test email arrives in an external inbox, not in spam, with "signed by mail.yourdomain.com" in the message details.

If it fails. Send a screenshot of the whole DNS page in your provider and of the CRM's verification screen. Do not delete and re-add records to make the screen refresh; propagation takes from ten minutes to a few hours, and repeated changes reset it.

The lesson we learnt the hard way about root SPF

If your main domain's SPF record ends in -all (a hard fail) and the CRM is asked to send as you@yourdomain.com without an include for it, every automated email fails authentication and none of your workflows deliver: no confirmations, no reminders, nothing. It looks like the CRM is broken; it is the DNS doing exactly what it was told. The fix is never to loosen your root SPF. It is either the mailbox connection (Microsoft or Google sign-in, no DNS) or the sending subdomain, which has its own SPF and leaves yours alone.

Sending domains expire if unverified

The CRM deletes a sending domain that has not verified within thirty days of being added. If your records went in late and the domain has vanished from the CRM, nothing is lost: we re-add it, the same records still apply, and the new DKIM key is sent to IT. Tell us as soon as the records are live so the verification happens inside the window.

Hosting: when we build pages on a subdomain

For campaign landing pages we host the pages ourselves and show them on go.yourdomain.com (or another word you prefer, such as explore. or offer.). What that means in practice:

One CNAME record is all we need from your side. No server, FTP, CMS or hosting access.
Your main site is untouched. Nothing changes at www.yourdomain.com; we never point the root domain at our hosting.
The SSL certificate is automatic once the CNAME resolves. Nothing to buy or renew.
It is not temporary. The pages and the leads live there for the life of the engagement, and you can export the copy and images at any time. If we stop working together, the pages come down at the end of the notice period and the record is deleted.
Tracking fires only there. The pixel and analytics tags we place on hosted pages do not touch your corporate site.

If you are on Wix, Squarespace or another closed platform: none of this needs your website platform. The CNAME goes in wherever your domain's DNS is managed, which is often the same provider but on the Domains page rather than the site editor. Send us a screenshot of the DNS page and we will point at the field.

Legal footer: what every paid-traffic page must carry

Meta and Google reject ads whose landing page cannot be identified as belonging to a real business, and a form that collects a name and a mobile number is a legal requirement for a linked privacy policy. The footer is pre-built on every page we make; only your details are missing. Until they arrive the page cannot take paid traffic, and this single item has moved more launch dates than any technical step.

Registered company name, exactly as on the registry certificate (for Malta, the Malta Business Registry).
Registration number, for example the C 12345 format in Malta.
Registered address, the full postal address.
A business email address and phone number that are monitored.
Privacy policy URL on your own website. If you do not have one, tell us; a policy that names the CRM and Meta as processors is needed before the form goes live.
Terms URL, or terms of use for the offer if the page sells something.
Regulated sectors (insurance, financial services, health): the regulator line and licence wording your compliance team requires, supplied in writing. Its position on the page does not affect performance, so put it where compliance wants it.

Reply to your onboarding email with the seven items in one message. We paste them in the same day.

Common questions on this page

Do I buy the Webflow or Shopify plan, or do you?

You do, on your own account, so the site and the billing are yours from day one and stay yours if we part ways. We tell you which plan in the kickoff email and build inside your account as a member or collaborator.

Why Administrator on WordPress rather than Editor?

Editor can write posts and pages. It cannot install plugins, add the pixel or Tag Manager snippet, place a booking widget or change templates, and each of those is part of the work. Administrator is the role that avoids a second request a week later. Everything we install is listed to your site contact and can be removed.

Is the subdomain temporary while the work is going on?

No. It is where your campaign pages and the leads they generate live for the whole engagement. We use a subdomain to protect your main domain, not because it is a stopgap. Nothing on your main site changes, and at the end you can take the copy, the images and the contacts with you.

Will this affect our existing email?

No. Every sending record sits on a new subdomain that carries no corporate mail. Your apex MX, root SPF and DMARC are not touched, which is why the sending name is mail.yourdomain.com and not yourdomain.com. If your apex DMARC is set to quarantine or reject with a subdomain policy, tell us and we align the subdomain to it.

Can you add the DNS records yourselves?

Only if you give us access to your DNS provider, which we would rather you did not. Whoever holds the domain should paste the records: it keeps control where it belongs and takes about fifteen minutes. We send the exact set, sit on a short call if it helps, and check propagation from our side.

Will the pixel or tracking go on our main website?

For campaign builds, no: it fires on the hosted pages on your subdomain only. For website-led work, yes, but only after a written tracking note to your developer or site contact listing each tag, and usually through Tag Manager so you can see and remove it. Standard events only.

Our IT team wants a ticket, not an email thread.

Copy the DNS change request block on this page into the ticket. It states the scope, the seven records, the two questions we need answered and the rollback. If they need a fuller change-request pack with risk ratings, ask and we send one.

What does the page need before it can take paid traffic?

Registered company name, registration number, registered address, a monitored email and phone, a privacy policy URL and a terms URL. Regulated businesses add their compliance line. The footer is already built; the seven items are pasted in the day you send them.

Stuck? Email stephen@thegrowthbully.com with a screenshot of the whole window, DNS page included.