The Website Handover Checklist: Everything Your Developer Should Give You When the Project Ends

When a web project ends, the handover is what decides whether you actually own your website or just rent it from your developer. A clean handover means you walk away with full admin access, a complete backup, the source files, and documentation. A bad one means a single login, a quick walkthrough, and a problem six months later when your developer has moved on and your SSL certificate is about to expire with nobody tracking it.

This is the checklist of everything your developer should hand over, and everything you should ask for if they do not offer it first. It applies whether your project is wrapping up now or you are planning a build and want ownership baked in from day one. If your developer pushes back on any of it, that is worth treating as a warning sign about the relationship.

What is a website handover?

A website handover is the formal transfer of everything you need to own, operate, and maintain your site independently of the person who built it. At minimum that means admin access to your domain, hosting, and CMS; a full backup of files and database; the design source files; documentation on how the site works and how to update it; and any API keys or third-party credentials moved into accounts you control.

The difference between owning and renting your website comes down to this list. Without it, you cannot move the site, fix it, or hand it to a new developer without going back to the original one, and that is exactly the dependency you want to avoid.

What access should your developer give you?

Your developer should give you full administrator access to every account your site depends on, registered under your own name and billing wherever possible. Shared access can be revoked; ownership cannot. This is the foundation of everything else.

Your domain registrar is the single most important asset. Whether it sits with GoDaddy, Namecheap, or Cloudflare, the domain should be registered under your own account with your own email and payment method. If it is under your developer's account, transferring it to yours is part of the handover. Without domain control you can lose your entire web presence.

Your hosting control panel, whether cPanel, Vercel, or another platform, needs independent admin access billed to you, not your developer. Your CMS (WordPress, Shopify, Webflow) needs the top-level administrator account, not an editor or contributor role. If your developer set up business email through Google Workspace or Microsoft 365, you need the admin credentials for the platform, not just your own mailbox.

Your analytics and search tools matter just as much. Google Analytics, Search Console, and Tag Manager should be set up under your own Google or business account. If your developer created them under theirs, they need to transfer ownership, not just grant access. Finally, ask for a short document explaining your DNS configuration, what each record does and where your email points, so a future change does not accidentally take the site or your email offline.

What files and code should you receive?

You should receive an independent copy of everything your website is made of: the complete source code, a full database export, all media files, and the original design files. Files alone are not always enough, a database-driven site like WordPress also needs the database export, which holds your content, settings, and configuration.

The source code is every file that runs your site. If the project uses version control, you should get full access to the repository with its commit history; if it does not (a red flag for custom work), you need a downloadable archive of all files. Media files (images, video, PDFs) are often stored separately and should come in original, full-resolution form.

Design source files, the Figma, Photoshop, or Illustrator originals, are easy to overlook and painful to lose. Without them, even a small design change can mean starting from scratch. If your site uses premium fonts or licensed stock photography, confirm which licenses were bought, under whose name, and whether they renew. And if the site uses a modern build process (Next.js, React, Vue), you need setup documentation so any competent developer can install dependencies, build, and deploy without reverse-engineering your setup first.

Should third-party accounts be in your name or the developer's?

Third-party accounts should be under your business name wherever possible, not your developer's. Modern sites connect to payment processors, email tools, CRMs, and CDNs, and every one of those connections is a place where control can quietly end up with the wrong person.

Your payment processor matters most. In the Philippines that usually means PayMongo, GCash, Maya, Stripe, or PayPal, and the account should be in your business name with your own bank details and API keys generated under your account. Your email marketing tool (Mailchimp or similar) holds your subscriber list, one of your most valuable assets, so it must be under your control. Your CRM integration should be documented with accessible credentials. Any CDN or caching service like Cloudflare needs to be accessible to you, since it can take your site offline if it lapses. And you should know where your SSL certificate comes from and when it expires, because an expired certificate makes browsers warn visitors that your site is "Not Secure," which hurts both traffic and trust.

What documentation should a handover include?

A professional handover includes technical documentation, a content management guide, a maintenance schedule, emergency procedures, and notes on SEO and analytics setup. Documentation is what separates a professional handoff from a "good luck, figure it out," and it is the thing most commonly skipped.

The technical documentation is a short README explaining how the site is structured, what it is built with, how to run it locally, and how to deploy. It does not need to be a novel; a clear two or three pages saves your next developer the first several billable hours they would otherwise spend just figuring out how the site works. The content management guide is a walkthrough, ideally with screenshots or a short video, of common tasks: updating pages, adding posts, changing images, managing menus, and handling form submissions.

The maintenance schedule lists what needs doing monthly, quarterly, and annually, core and plugin updates, security patches, backup checks, SSL and domain renewals. Emergency procedures answer the questions you do not want to research during an outage: what to do if the site goes down, who to contact, and how to restore from a backup. SEO and analytics notes cover how tracking is configured, what conversions are set up, the sitemap URL, and any robots.txt rules. If you ever switch web designers, this is what makes the SEO transition smooth.

What about support and warranties after launch?

The handover is not the end of the relationship. Most professional developers offer a bug-fix warranty period after launch, typically a set window during which genuine bugs are fixed at no charge. Make sure it is in writing: what counts as a bug versus a change request, the response time, and what happens after it expires. This belongs in your web design contract.

If your developer offers ongoing maintenance, get the terms in writing too, what is included, what costs extra, and the response time. It is also worth agreeing now, while the relationship is good, on what happens if you part ways later: a full handover as described here, and a knowledge-transfer period. Finally, if several people on your team will use the site, ask for a training session. A short walkthrough saves everyone hours of confusion later.

When should you ask about the handover?

You should ask about the handover before the project begins, not on launch day. Raise it in your first conversations and make sure it is referenced in the contract. A professional designer will welcome the question because it shows you are organized and serious about the project.

If a developer seems uncomfortable or evasive about handing over full access, treat that as a warning sign, and as a reason to confirm whether you are actually getting custom work rather than a template with limited transferability. For larger builds, schedule a dedicated handover meeting separate from launch, and record it so you can refer back to every item.

Frequently Asked Questions

What access should my developer give me at handover? Full admin access to your domain registrar, hosting control panel, CMS, email platform, analytics and search tools, and any third-party service the site connects to. Wherever possible these accounts should be registered under your own name and billing, not your developer's, so access cannot be revoked.

Why do I need the source files and the database? The source files and database let you rebuild, move, update, or repair the site if something goes wrong. For a database-driven site like WordPress, the files alone are not enough, the database holds your content, settings, and configuration, so you need both.

Should third-party accounts be in my name or the developer's? They should be under your business name whenever possible. Payment gateways, email marketing tools, CRMs, CDNs, and API keys should be accessible to you and not controlled by the developer, since these accounts hold assets and access you cannot afford to lose.

What documentation should be included in a website handover? Technical documentation, a content management guide, a maintenance schedule, emergency procedures, and notes on SEO, analytics, sitemap, and robots.txt setup. Together they let you and any future developer operate the site without reverse-engineering it.

Do I need all of this for a simple brochure website? Yes, though the specifics are simpler. Even a basic five-page site needs domain access, hosting access, CMS login, a backup, and basic documentation. The checklist scales with complexity, but the core items are non-negotiable at any size.

What if my developer refuses to hand over source files? This depends on your contract. If your agreement says you own the deliverables, which it should, they are obligated to provide them. Without a written contract, default copyright law may assign ownership to the creator, which is why a written agreement matters. A formal written request, escalated if needed, usually resolves it.

What if my developer has gone silent and I never received a handover? That is a different and urgent situation. If your designer has disappeared mid-project, secure whatever you can access independently first, then follow a recovery process and consider engaging a new developer to rebuild.

A professional web designer should want you to own everything about your website and offer documentation, credentials, and source files without being chased. If you are starting a build and want the handover designed into the process from day one, with full access and ownership as the baseline, book a call with Studio Aurora.