Planning & Ownership · 4 min read
Website Handover: An Ownership and Access Checklist
Check domain control, code, hosting, billing, admin access, search tools, backups and support before signing off a business website.
The practical answer
A complete handover gives the business the agreed project files, control of essential accounts and the knowledge to operate the site. Verify access by completing real tasks, document renewals and support, and distinguish code ownership from third-party licences and subscriptions.
In this guide
Treat handover as a working session
A website handover is complete when the business can operate the agreed system and knows who controls its essential accounts. A zip file and a list of passwords leave important questions unanswered. Plan a short session where the owner or nominated operator signs in, performs common tasks and checks the delivery record against the proposal.
My website and software services include handover of the agreed project files and code, with GitHub ownership where applicable to a software build. The exact deliverables should be agreed in writing. Third-party themes, fonts, images, plugins and hosted services may have their own licences or subscription terms, so record those separately from custom work.
Confirm the domain and renewal contacts
Record the domain name, registrar, renewal date, billing owner and the account that can manage it. Check that the business controls the recovery email and can receive renewal notices. An account created for the project should have a clear owner rather than depend on a staff member's personal inbox indefinitely.
Also identify who manages DNS, the settings that connect the domain to the website and email services. Before changing those settings, document existing records and the reason for each change. Domain access and hosting access are separate items; having one login does not prove the business controls the other.
Verify the code and the way it is deployed
For a custom-coded site, check the agreed repository or source archive, its location and access rights. Include the instructions needed to install, build and deploy the project, along with the names of required environment settings. Secrets should be supplied through an appropriate secure channel or account, rather than written into a public code repository.
GitHub's transfer documentation explains that a repository transfer gives the new owner administrative control, while existing collaborators and certain settings can remain associated. Review collaborators, deployment connections, webhooks and credentials after a transfer. A successful code transfer is one part of handover; hosting and connected services still need their own checks.
Check hosting, data and paid services
Create an account register for hosting, databases, file storage, business email, payment services, analytics and automation tools actually used by the site. For each, record the business owner, admin contact, billing method and renewal or usage arrangement. Distinguish required services from optional tools that can be removed later.
Ask where customer submissions and uploaded files are stored, who can access them and how records can be exported. If a backup is part of the agreed service, confirm what it includes, how often it runs and how restoration is requested or performed. A database export alone may not include images, uploaded documents or service settings.
Prove the admin tasks work
Have the business operator update a service description, replace an image and locate a test enquiry where those actions are included. For a store, check the agreed product, order and payment-management tasks. Keep a short recording or written guide so the next staff member does not have to rediscover the process.
Test a fresh login and account recovery using the business's own details. Give staff individual accounts where the platform supports them, with access suited to their job. Decide who retains developer access during support and how that access will be reviewed when the engagement ends.
Keep search and measurement access with the business
If Search Console is included, confirm that a business-controlled account has appropriate ownership and can see the property. Google's documentation distinguishes owners from users and explains that verified ownership relies on a verification token. Removing a person's visible user entry may not remove an underlying ownership verification method, so review both when changing access.
Check analytics and any advertising or merchant accounts separately if they are in scope. Record what is being measured and how a successful enquiry or order appears. A report is more useful when the business can connect it to an actual customer action and understands who can change its settings.
Agree the support boundary and open issues
List any known issues, deferred work and the person responsible for each. Confirm the support channel, included maintenance period and the difference between correcting an agreed feature and requesting a new one. My published website packages include different maintenance periods, so the selected proposal should state which period applies and when it starts.
Finish by checking contact forms, key links, the agreed payment paths and the public business details on the live domain. Keep the account register, operating guide and final scope in a place the business can find. The handover record should make it possible to continue working with the original builder or brief another qualified person later.
Sources & further reading
Official references behind the technical guidance.