Leaving Your Web Agency? A Safe Handover Checklist for Your Website
Changing agencies shouldn't put your website at risk. What to collect, which accounts to move and how to secure them — a practical handover checklist.
Web Zosh Team3 min read
On this page
Many businesses discover, only when they want to change agencies, that they don’t really own their website. The domain is registered in someone else’s account, the code lives on a developer’s laptop, and the server bill goes to an email address nobody at the business can open.
We recently moved a café and private-theatre business’s platform from its previous agency into its own accounts. The steps below are the checklist we follow — use it before you switch, or even if you’re happy with your agency today.
Ask your current agency for these, in writing:
- Source code — the complete project, ideally as a repository (for example on GitHub), not just a zip of today’s files.
- Database backup — the most recent full export, so orders, enquiries, users and content aren’t lost.
- Media files — images and documents, wherever they are stored (on the server or in cloud storage such as Amazon S3).
- Admin access — logins for the content management system (WordPress, Strapi or similar), with you as an owner, not a guest.
- Third-party accounts — anything the site depends on: email sending, payment gateway, maps, analytics, CRM.
Check each item before you say goodbye: open the backup, browse the media, log in to the admin.
The rule is simple: every account that runs your website should belong to an email address your business controls.
- Domain name — transfer it to a registrar account in your name. This is the one asset you can never afford to lose.
- DNS — manage it in an account you own (your registrar or a service like Cloudflare).
- Hosting / cloud — the server or cloud account (AWS, Hostinger, others) should be billed to you.
- Code repository — the project should live in your organisation’s GitHub (or similar), with the agency invited as a collaborator rather than the owner.
- Email and business tools — mail, CRM and support tools under the same business email.
Moving accounts is the perfect moment to lock them down:
- Turn on two-factor authentication everywhere, using an authenticator app.
- Save backup codes somewhere safe and offline — not in a shared folder or a screenshot.
- Add a recovery email and phone number that belong to the business.
- Remove old users and agency logins you no longer need, and rotate any passwords or API keys they had.
A password manager makes this painless and gives you one place to hand over access when people change roles.
Once you own everything, decide where the site will run and how it will be updated:
- Pick hosting that fits your size and budget, and note what it costs every month.
- Keep the code in version control, so every change is tracked and can be undone.
- Put a security and performance layer in front of the site where it helps (for example DNS-level protection and caching).
- Schedule the switch for a quiet time, lower DNS TTLs a day before, and keep the old site running until the new one is confirmed.
Finish with a one-page record: which accounts exist, who owns them, where backups are kept and how to restore them. It takes an hour and saves days the next time something changes.
| Before you switch | Make sure you have |
|---|---|
| Code | A full repository in your organisation’s account |
| Data | A tested database backup and all media files |
| Domain & DNS | Transferred to an account you own |
| Hosting, email, tools | Billed to and owned by your business |
| Security | Two-factor authentication and safely stored backup codes |
If you’d like help with a handover — or just a check of who owns what today — talk to us. It’s usually a few days’ work and it protects the most important digital asset your business has.