Website handover checklist
The end-of-project checklist for taking full ownership: registrar, DNS, hosting, CMS, repository, database, email, analytics, backups, documentation — and why each is leverage.
A website you cannot leave with is not an asset — it is a ransom with a nice header image. This checklist is the end-of-project ritual that guarantees you own every register the site lives in: accounts, code, data, email, analytics and backups, each in your name with access you hold. Work through it top to bottom before final payment. Any item a developer hesitates on is the exact item you most needed to check — the ownership terms were agreed in the contract; this is how you verify they held.
The fields, with guidance
Registrar & domain
The domain is the single most valuable register — whoever holds it holds the address. Own the registrar login outright.
Example: Domain in your name, registrar account in your control, WHOIS set to your contact.
DNS & hosting
DNS is the keys to the kingdom; hosting runs the site. Both must be in your name so you can move without asking.
Example: Hosting account in your name, DNS access granted, nameservers and records documented.
CMS & admin access
Admin is how you run the thing. Hold owner-level access from the day work starts, not on exit.
Example: WordPress admin owner account, list of every admin user and role.
Repository & code
The code is the asset. Repo access from day one means "what you own" is never a negotiation.
Example: Git repository in your organisation, clone works locally, README explains the stack.
Database & media
Content and data live here. A backup you can restore is the difference between control and archaeology.
Example: Database export, media files downloaded, both tested on a local copy.
Email & routing
Forms and transactional mail route somewhere — that somewhere must be yours.
Example: Form-to-email routing in your inbox, domain email/DNS records, SPF/DKIM verified.
Analytics & tracking
The measurement layer is yours too — your ability to judge the site is leverage.
Example: GA4 and Search Console owner access, property and view list, event names documented.
Backups & restore testing
A backup no one has restored is a hope, not a backup. Proof of a tested restore is the real deliverable.
Example: Automated backups running, one restore performed and verified this quarter.
Documentation & runbook
A site nobody can operate is not delivered. The runbook is what makes handover real.
Example: One-page "how to run this site" note: logins, update routine, who to call.
Third-party accounts
Plugins, payment, forms, CDN — the smaller accounts are where access quietly dies. Collect them all.
Example: A written list of every account, its login owner, and its monthly cost.
Copy this block
WEBSITE HANDOVER CHECKLIST — [PROJECT]
[ ] Domain: registrar account in your name, WHOIS = your contact
[ ] DNS: access granted, nameservers and records documented
[ ] Hosting: account in your name, monthly cost known
[ ] CMS: owner admin account, list of all admin users and roles
[ ] Repository: repo in your org, clone works locally, README real
[ ] Database & media: export taken, download tested on a local copy
[ ] Email & routing: forms route to your inbox, SPF/DKIM verified
[ ] Analytics: GA4 + Search Console owner access, events documented
[ ] Backups: automated, one restore actually performed and verified
[ ] Documentation: one-page runbook — logins, updates, who to call
[ ] Third-party: every account listed, owner named, cost shown
[ ] Final walkthrough: every item above demonstrated, not promised
Plain text on purpose — pastes cleanly into email, docs and project tools.
Work through it in order and tick each line only when you have seen the access with your own eyes — demonstrated, not promised. It pairs with the launch checklist from the build side; when you are ready to start a project that ends this way, get in touch.
Quarterly, and only when the numbers move
Get the rate report before you negotiate.
Updated rate bands across the major stacks and regions, plus what changed and why. No other email.