Website handover checklist: accounts, code, data, domains

What "handed over" means

A website is handed over when two tests pass. The ownership test: every account is registered to your company, billed to your company, and you can add or remove people yourself. The rebuild test: someone who has never seen the project can get the code running and push a change live using only what you hold.

Having the passwords is not the same thing. A login shared by the agency still belongs to the agency. If their email address is the account owner, they can reset your access the day the relationship turns sour, and the provider will side with them because their name is on the account.

This list is the one we work through when we take over a website or system from another team. It is written for the person who signs the contracts, not the developer. You don't need to understand every item, only to get a clear yes or no for each one. It belongs to our guides on takeover.

The checklist

Go through it group by group. Each line says what to get and how to check that you really have it.

Domain and DNS

start here

Registrar account in your company's nameLog in yourself. The registrant contact should be your company, not the agency or a former employee.
Renewal date and payment cardAuto-renew on, billed to a company card. An expired domain takes the site and your email down together.
A full export of the DNS recordsEvery A, CNAME, MX and TXT record. Some of them quietly run your email and verifications.
Know where DNS is hostedIt is often not the registrar but a CDN or the hosting provider. That account needs moving too.

Hosting and infrastructure

Hosting or cloud account owned and billed by youNot a sub-account inside the agency's own hosting plan.
A list of every running serviceServers, databases, file storage, CDN, scheduled jobs, staging copies. Ask what would stop working if any one of them were switched off.
Environment settingsThe configuration values the site needs to start. Stored somewhere you can read, not only on a laptop.

Code and deployment

The repository, with full history, in your organisationOn GitHub, GitLab or similar, under an organisation you own. A zip file is a snapshot, not a handover.
The deploy pipeline and its secretsHow a change goes from the repository to the live site, and the stored keys that make it work.
Paid themes, plugins and licences in your nameLicences bought on the agency's account stop receiving updates once the agency stops paying.

Data and backups

Where backups go, how often, and how long they are keptBackups should land in storage you own.
The date of the last restore testA backup nobody has restored is a hope. Ask for one restore into a test copy.
Uploaded files and customer dataImages, documents, form submissions and orders, and where each is stored.

Analytics, consent and search

Analytics with you as AdministratorIn Google Analytics 4 that is the Administrator role on the account or property, so you can manage users yourself.
Tag manager containerIf tags are managed through one, you need admin rights there too.
The cookie consent tool accountThe consent banner is often a separate paid service with its own login and settings.
Search Console with your company as verified ownerVerify a domain property through a DNS record you control. Then remove owners you no longer work with.
Merchant Center and Bing Webmaster ToolsIf you run a shop or use these, the same rule applies: owner, not guest.

Email sending

The service that sends order and form emailsTransactional email usually runs through a separate provider with its own account and API key.
SPF, DKIM and DMARC recordsDNS records that prove your emails are really from you. Large mailbox providers now expect them, and mail without them tends to land in spam.
Who receives notificationsForm and order alerts sometimes still go to someone at the agency.

Third-party services and keys

A list of every connected servicePayments, shipping, marketplace or warehouse sync, maps, spam protection, chat widgets.
Keys issued under your own accountsA key created in a freelancer's personal account dies when that account does. Re-issue and swap them.

Documentation and page addresses

A short architecture noteWhat the parts are, how they connect, and how to run the site locally.
A list of scheduled jobs and integrationsAnything that runs on a timer: imports, feeds, reminders, reports.
A map of page addresses and existing redirectsEvery live URL and every redirect rule. You will need it for any future rebuild.
The XML sitemap and robots.txtWhere they are generated and who changes them.
A list of known problemsEvery team has one. Getting it in writing saves the next team weeks.

How to ask for it without a fight

Most agencies hand over cleanly when the request is specific. Put the list above in writing, ask for a date, and handle it in this order:

Get admin access for your own company address on every account, alongside the agency's.
Check each one yourself: log in, open billing, look at the user list.
Move ownership and billing to your company where the provider supports it.
Once everything is in your hands, change passwords, rotate keys and remove the old team's users.
Only then sign off the final invoice or end the contract.

What a good answer looks like
You ask for	Good answer	Warning sign
The code	An invite to a repository moved into your organisation	A zip by email, or "it lives on the server"
The domain	A transfer to a registrar account you own	"We'll keep renewing it for you"
Analytics	You become Administrator, or the property moves to your account	A read-only viewer invite
Backups	Storage you own and a restore you watched	"The host does backups"

Where handovers usually go wrong

The failures are rarely dramatic. They are small things that nobody wrote down.

The domain was registered by the agency. It renews on their card until the day it doesn't. Many registrars also lock a domain against transfer for 60 days after the owner details change, so this one takes the longest. Start with it.
A freelancer created accounts with a personal email. When they move on, so does your password reset.
A scheduled job nobody mentioned. A nightly stock import or feed runs on a server you didn't know about. It stops when that server is switched off, and you find out from a customer.
Backups that were never restored. They existed, but they were incomplete.
Search Console under someone else. You lose years of search data and the place where Google reports problems with your site.

How we run a handover

When a business moves its site or system to us, this checklist is the first piece of work. We ask the previous team for ownership transfers, check each item ourselves and record the result in a handover document that stays with you. We have taken over and finished systems built by other teams; those projects are under NDA, so we describe the method rather than the clients.

One rule doesn't change: you own the code, the data and every account. The same checklist works when you leave us. Everything on it is already in your company's name, so there is nothing to hand back.

What this guide doesn't cover

Contract and IP terms. Who legally owns the code depends on your contract. A lawyer should read it if it's unclear.
Disputes. If the agency refuses to cooperate, this list tells you what to ask for but not how to force it.
Moving to a new platform. That is a rebuild, with its own risks. See the rebuild guide.

Questions owners ask

Can an agency refuse to hand over my website?

It depends on your contract. Many contracts say the client owns the code and content once invoices are paid, but some agencies license a platform to you instead. Read the contract first. If ownership is unclear, ask a lawyer before the relationship ends, not after.

Do I need the source code if the site works fine?

Yes. A working site with no code you control can't be fixed, moved or extended by anyone else. Ask for the repository with its full history, plus written steps to run and deploy it.

How long does a website handover take?

With a cooperative agency, most accounts can be moved in a week or two. Domain transfers between registrars can take several days, and a recent change of owner details can lock a domain for up to 60 days, so start with the domain.

Should I change every password after the handover?

Yes, once you have confirmed that you hold admin access everywhere. Also rotate API keys and remove the old team's user accounts, so access ends when the contract ends.