A website handoff is not complete when someone sends an administrator password. The business needs to know which services keep the site running, who owns each account, and how routine changes are made.
Prepare an access inventory before the relationship or project ends. Treat it as an operational record, not as a place to store secrets in plain text.
Separate the accounts by purpose
List domain registration, DNS, hosting, website editing, source repository, form delivery, business email, analytics, and any booking or payment integrations. Some may share a provider, but they still perform different jobs.
For each service, record the account owner, billing contact, renewal date where relevant, and authorized administrators. Confirm that recovery messages reach a business-controlled address. An account created under a former contractor’s personal email can complicate later recovery.
Ask for the files and the publishing process
Identify where source files and uploaded assets live. Confirm how a change moves from editing to the public site and how the previous version can be restored. If a developer must run a build, ask for the documented command and required environment rather than relying on memory.
Clarify which assets the business may reuse, including fonts, photography, templates, and licensed components. Record the applicable licenses or agreements; possession of a file alone does not explain its permitted use.
Verify access without disrupting service
Have an authorized business representative sign in and confirm the necessary role. Read-only access may be sufficient for some staff, while publishing or billing tasks need different permissions.
Use secure account invitations or an approved credential manager. Do not exchange passwords in the handoff spreadsheet. Review access changes carefully so the transfer does not lock out the only person able to complete it.
Test one routine change
Ask the new maintainer to make an approved minor update in a test environment, preview it, and explain the publishing steps. This reveals missing permissions or undocumented dependencies before an urgent correction is needed.
Also walk through the backup restore plan. Knowing how to publish is different from knowing how to recover.
Close with responsibilities
Assign ownership for renewals, content updates, security maintenance, and form testing. Specify where support requests go and what work is included in any ongoing agreement. If responsibilities are split across vendors, name the first contact for an outage.
Keep the inventory current when a service or staff member changes. The best handoff document is short enough to maintain and detailed enough that a new person can identify the system, obtain authorized access, and carry out a normal update without guessing.