Take over or hand over a website with confidence

Map what the team must take over

Separate the domain name, DNS, hosting, code, database, media, email, forms, analytics and third-party services. For each item record its contractual owner, administrator, provider, renewal date and dependencies. Domain management and website hosting can belong to different organisations.

Add important URLs, redirects, languages, media licences and scheduled jobs. Ask for a live demonstration of editing a page and processing an enquiry. The migration guide covers changes to URLs or platforms.

• Inventory of components and providers.
• Named owner for every item.
• Content, URL and external-dependency list.

Verify ownership and responsibilities

Confirm with the people concerned who holds the domain and subscriptions and who can request a change. Procedures depend on the registry, registrar and contract. ICANN guidance for registrants helps distinguish the holder from a service provider for relevant domains.

Record who decides, who acts and whom to contact during an incident. Avoid reliance on one person or a personal mailbox. Handle access methods through authorised internal procedures; the handover record can name their owners without exposing secrets.

For a WordPress handover, inventory human logins and integrations separately. An application password authenticates programmatic access, including REST API requests over HTTPS; it does not open a human session on wp-login.php. Its descriptive name does not prove restricted permissions: check the associated account, its capabilities and the called operation’s checks. Control of a WordPress account does not establish control of hosting, DNS or the domain contract.

For an integration being transferred, record its owner, account, purpose, revocation method and credential reference without copying the secret into the handover file. Validate the replacement access in an authorised environment before the planned withdrawal of the old access. WordPress allows individual application passwords to be revoked; then verify that old access fails and the transferred service works. This targeted check alone does not close human sessions, other keys or provider access: review those entries separately.

Scroll the table horizontally to read every column. With a keyboard, focus the table area and use the arrow keys.

Test exports and recovery

Obtain the files and data specified by the agreement and verify that they are readable. A content export is not necessarily a restorable copy of the application: WordPress export documentation illustrates the scope of one such tool. Check themes, plugins, media, configuration and database separately as appropriate.

Have a capable person run a restoration or staging setup and document the steps. Check key pages, images, links, forms and automated jobs. The restoration guide explains this test.

When code is held in GitHub, examine the repository, any Git LFS objects and the wiki separately. A mirror clone includes Git history, but LFS files require an additional fetch and the wiki has its own repository. Include these items in the handover inventory.

Also describe what stays outside the repository: active data, media storage, hosting settings and linked services. Test isolated recovery with authorised access. The useful result is a working website within the agreed scope, rather than merely an archive that opens.

• Verified export and documented format.
• Recovery trial completed.
• Gaps and non-transferable elements listed.

Close with an observable acceptance test

Ask the receiving team to publish a draft, correct an error, locate a backup, read a test enquiry and name the owner of a renewal. Record results, limitations and remaining actions with dates and owners.

Monitor essential journeys and deadlines for an agreed period after handover. Keep concise documentation current; a delivery-day screenshot is not a procedure that survives a change of staff.

Decide in a concrete situation

Fictional example: a supplier delivers code while the domain and subscriptions remain in its accounts. Distinguish file possession from control of essential services; handover should enable independent operation.

Inventory each service's holder, administrator, renewal and recovery process. Test access through a secure channel; put no passwords in shared reports or public documents.

• Manage accounts, permissions and access recovery

  Prepare a permissions matrix, test sign-in and recovery, manage departures and emergency access without sharing secrets.

Five capabilities to demonstrate at handover

The handover pack describes what exists; acceptance checks show what the receiving team can actually do. These five capabilities provide a working method to adapt to the agreement and website architecture, without an automatic score.

Separate what was delivered, what was demonstrated and what remains unknown. Receiving an archive does not verify restoration. Website access does not establish control of the domain, renewals or email.