Your Site, Your Keys: Assembling a Website Handover Pack Before the Split
Most small business website relationships do not end with a dramatic falling-out. People get busy, budgets change, a freelancer goes travelling, or an agency gets bought. The site keeps running, so nobody thinks much about it. Then a renewal card expires, a form stops sending enquiries, and you discover the domain is registered in someone else's name. That is a bad week.
The fix is not complicated. It is a handover pack: a clear, documented set of access details and ownership records for everything that keeps your website alive. Think of it as the exit interview for your site. You would not hand over the shop keys without knowing who has the alarm code. The same goes for your web presence.
Start before the goodbye email
Do not wait until the relationship is ending. Ask for a handover pack as routine admin, ideally when work begins. If you are already mid-exit, send a calm request rather than a legal threat. Most designers and agencies will hand things over without fuss. The awkward ones are the reason this article exists.
A useful framing is business continuity, not suspicion. You need the information for insurance, accountancy, GDPR requests and the unglamorous reality of someone leaving the business. That sounds far more reasonable than 'give me everything before I ring my solicitor'.
The absolute basics: where the site lives
Start with the domain. You need the registrar name, the account login, the registrant email address, the renewal date and whether auto-renew is on. For .uk domains, check the registrant details are your business, not the designer's. If the domain is held in their account, ask for a transfer or for the registrant contact to be changed to an email you control. Do this early. Domain transfers can take days.
Next, hosting. Get the provider, account login, plan name and renewal date. If the site sits on a managed platform, note who pays the bill and what happens if that payment stops. Ask whether there are any server-level restrictions or staging environments you should know about.
Then the CMS. That means the admin URL, the main administrator account and how to reset the password. If you use WordPress, Squarespace, Shopify or Wix, confirm which account owns the site. A designer having editor access is fine. A designer being the only owner is not.
DNS, email and the plumbing
DNS is the bit everyone forgets until email breaks. Ask where DNS is managed, whether it is at the registrar or a separate service, and request an export of the records. You do not need to understand every entry, but you do need a copy. Check which records handle email, because moving DNS without them is how a quiet Tuesday becomes a lost quote from a customer.
Email deserves its own line. Is it hosted with the website, with Microsoft 365, Google Workspace or somewhere else? Get the account owner details and confirm that password resets go to an address you control. If your email is tied to the designer's account, fix that before anything else.
Also ask for analytics and search console access. For a UK small firm, that usually means Google Analytics and Google Search Console, plus any Bing tools if they are used. You want property-level access, not a screenshot of last month's numbers.
The commercial bits people argue about
Plugin and theme licences are easy to overlook. Premium WordPress plugins, fonts, stock image subscriptions and booking tools often renew annually. Get the licence keys, the account email and the renewal dates. If a licence is in the agency's name, ask whether it can be transferred or whether you need to buy your own.
Payment links and checkout accounts matter even more. If you take deposits through Stripe, PayPal, GoCardless or a booking platform, confirm who owns the account and where payouts land. A payment link connected to someone else's email is a business risk, not a convenience.
Finally, backups. Ask where they are stored, how often they run and how a restore would work. A backup you cannot access is not really yours.
How to ask without turning it into a row
Keep it short and specific. Say you are updating your business records and need the access pack for continuity. Give a reasonable deadline, offer to pay for time if the contract says handover is chargeable, and ask for a screen-share if that is easier than writing everything out. Confirm what you receive by email afterwards.
Never request passwords over WhatsApp or in a normal email thread. Use a password manager's sharing feature or a secure note with an expiry. If the other side insists on email, change the passwords once you have logged in.
Red flags worth acting on
The big one is a domain registered in the designer's personal name with no transfer offered. Others include being told you cannot have admin access 'for security', finding that analytics is only visible through their account, or discovering the payment account is tied to their email. Less dramatic but still annoying: no export of content, no list of plugins, and a vague promise to 'sort it later'.
If you hit resistance, stay factual. Ask for the registrar and account details in writing, confirm what you have paid for, and mention that you need the records for your own compliance. A polite paper trail is surprisingly effective.
Store it like you mean it
Put everything in a password manager owned by the business, not by one member of staff. Use a business email address for account recovery, switch on two-factor authentication, and keep the recovery codes somewhere sensible. Tell at least two trusted people where the pack lives. Review it when a contract ends, when a staff member leaves, or once a quarter if you are organised.
The one-breath checklist
Domain registrar and registrant email. Hosting account. CMS admin. DNS records. Email accounts. Analytics and Search Console. Backups. Plugin and theme licences. Payment and booking accounts. Brand assets and image licences. Contract and invoice history.
None of this is glamorous. But owning your own keys is the difference between a website that works for your business and one that works for somebody else's filing cabinet.
