A website handover is complete when your team can access, understand and safely operate the site without relying on one person’s inbox. Before a designer or agency closes a project, collect the accounts, files, documentation and recovery details below. Keep them in a business-controlled password manager and test access while the project is still active.
The website handover checklist
- Domain registrar: Confirm the registered business or owner, renewal date, billing contact, recovery email and two-factor method. Record the registrar and the process for changing DNS. Never rely only on a designer’s personal account.
- Hosting and server: Get the hosting provider, account owner, renewal date, support route, control-panel access and server details. Ask where staging lives and which environment is live.
- WordPress and administrator access: Confirm that a business email controls the main administrator account. Remove temporary vendor access when the handover is accepted, and create named accounts instead of sharing one login.
- Backups and restore steps: Ask for a recent database and file backup, where backups are stored, how often they run, and how to restore them. A backup is only useful if someone can retrieve it and knows the recovery path.
- Theme, plugins and licences: List paid themes, plugins, fonts and other licensed assets, who owns each licence, renewal dates, and what stops working if a subscription ends. Transfer or replace licences before access is removed.
- Source files and brand assets: Collect the logo and editable design files, fonts, custom code, image originals, and any child theme or repository. Note which assets are stock or licensed and their usage limits.
- Email and DNS: Document MX, SPF, DKIM and DMARC records if they are configured. These records often support business email. Keep a copy of the current DNS zone before making changes.
- Forms and lead routing: List every form, notification recipient, WhatsApp link, booking tool and CRM integration. Submit a real test enquiry and confirm it reaches the right inbox or system.
- Analytics and search accounts: Confirm business ownership of Google Analytics, Search Console, Tag Manager and the relevant advertising accounts. Record which measurement IDs are installed and where access is managed.
- Operating notes: Request a short guide for editing key pages, publishing a post, updating contact details, adding users and handling routine updates. Include known customisations and support contacts.
Test the handover before signing it off
Use a private browser session to sign in with the business-controlled accounts. Check that the homepage and key service pages load, the site works on a phone, and forms send a test enquiry. Verify that a backup exists and that your host’s restore documentation is available. Confirm the renewal dates on the domain, hosting and paid licences.
Change or remove vendor access only after your new administrator can log in and the agreed deliverables have been received. Keep a record of what was transferred and the date. If an agency still provides support, give it a named, least-privilege account rather than the only administrator login.
What if the designer will not transfer access?
Start with the service agreement and ask in writing for a handover date, account ownership details and an export of the work you paid for. Do not make abrupt DNS changes before you know where the domain, email and hosting are managed. If the domain is registered to the vendor, follow the registrar’s documented ownership-transfer process and keep correspondence.
Frequently asked questions
Should my web designer keep administrator access?
Only if ongoing work requires it. The business should retain its own working administrator account and recovery method. Give external partners separate accounts that can be removed individually.
Do I need the website source files?
For WordPress, you should at least know how to obtain a complete copy of the site files and database, including uploads and custom code. The exact source files depend on the scope and contract.
When should I remove the old agency?
After verifying account control, backups, forms, licences and agreed files. If support continues, keep a limited named account and define how it will be revoked later.
For a broader launch review, use the small business website launch checklist. If you want a second set of eyes on the live site, start at the Bennie Studio app.
Last reviewed: October 2026. Account transfer and licence terms vary by provider and contract; check the relevant provider documentation and your agreement.