A website handoff checklist is the email that makes sure you end up owning your site. It lists the domain, DNS, hosting, CMS, analytics and every other login or account the site depends on, with a named owner for each. Without it, the site works until the day someone asks “who has the password?” and the answer is a freelancer who moved on.
Below is a handoff list you can send in one email, and what to verify before you call the project finished.
What belongs on a website handoff checklist?
Everything the site cannot run without, grouped by where it lives. Domain registrar: who owns the account, whose email is on it, when it renews. DNS: where the records are managed. Hosting: the account, the plan, and who can reach the server. CMS: admin accounts for you and for the studio. Email: where the site’s mail is sent from. Analytics and Search Console: who holds owner-level access.
Add the supporting pieces people forget: premium plugin and theme licenses, form and booking tools, CRM or email marketing connections. Include any third-party scripts, such as chat widgets. Note the renewal date for each. A site can survive a missing license for a while, but not forever.
For each item, write three things: what it is, who owns it, and where the login is stored. A password manager shared with the right people is better than any spreadsheet.
Why does ownership matter more than access?
Access lets you use something. Ownership lets you control it. The common trap is a domain registered by the developer under their own account “for convenience.” The site then belongs to the business in every way except the one that matters.
Check that the domain, hosting account and analytics property sit under an account you control, with a recovery email you own. Give the studio a collaborator role instead of the other way around. If any of these are in the vendor’s name, ask for a transfer before the final payment, not after.
Two-step login deserves a line in the email. Turn it on for the registrar, hosting and CMS admin accounts, and store recovery codes somewhere the business, not one person, can reach. That also lines up with the basics in our piece on online data security and customer trust.
What should you verify on the last day?
Actually log in to each account. This sounds obvious, and it catches the most problems. A shared password that has been changed, a login tied to a former employee’s email, or an account that asks for a verification code sent to someone’s old phone will all surface in five minutes of trying.
Then check the safety net. Confirm a backup exists and where it is stored. Confirm the site’s SSL certificate renews automatically. Check that the domain renewal is on and not set to expire next spring on a card that is about to be replaced. Save the DNS records somewhere as a plain list, so you can rebuild them if a mistake wipes them out.
Finally, have one person on your team try to make a small change, like editing a phone number on a page. If they cannot do it without help, the training is not done. The staging checklist covers what to review before launch, and this one covers who holds the keys afterward.
How should you send it, and what happens next?
Send it as a single email, with the checklist in the body rather than an attachment. Reply on the same thread as items get confirmed. That thread becomes a record you can find in a year. Ask the studio to confirm each line in writing, and keep the final version somewhere the business owns.
After handoff, agree on what support looks like. If you will stay with the studio, the support service describes the options. If you are going it alone, set a calendar reminder to check renewals and logins every quarter. A handoff is not the last step. It is where maintenance begins.
Copy-ready list
- Domain registrar: account owner, recovery email, renewal date.
- DNS: where records are managed, plus a saved export.
- Hosting: account owner, plan, backup location.
- CMS: your admin account and the studio’s collaborator account.
- Analytics and Search Console: owner access for the business.
- Licenses and third-party tools: owner and renewal date.