Website handover checklist: what to receive and test
A website handover should include the agreed domain, hosting and WordPress access; usable content files; a recoverable backup; a license and renewal record; and instructions your team can follow. Test the access and recovery arrangements before marking those items complete.
Use this checklist when your business is accepting a WordPress website from a developer or studio. It helps you distinguish what has been delivered from what you have actually checked. Practical account access and contractual rights to code, designs or images are separate questions; record both in the handover agreement.
Use an acceptance table, with evidence for each item
Copy the table into your handover document. Add a named person, a due date and a status to each row: received, tested, or open. Received means you have the file or access invitation. Tested means the agreed check passed. Open means something is still missing or unresolved.
Keep account URLs and non-secret reference details in this document. Store passwords and recovery codes in your business password manager. The domain registrar is the company that manages your domain registration; the hosting provider runs the website. They may be different companies.
| Handover item | Evidence to receive | Acceptance check |
|---|---|---|
| Domain and routing | Registrar account, recorded registrant details, renewal date, and the provider managing DNS, the settings that direct the domain to your website and email. | You can view the agreed account, confirm the registration details with the provider and name the person handling renewal. |
| Hosting | Provider, plan, support route, and your account access or documented managed-service arrangement. | You can identify the correct site and explain how your business would request recovery or leave the service. |
| WordPress | Your own account and an explanation of its permissions. | You can sign in and complete the editing tasks you agreed with the developer. |
| Content and source files | WordPress content export, original media and the custom source/design files included in your agreement. | You can locate representative files, open them and identify anything excluded from delivery. |
| Recovery backup | Dated site files and database, storage location, restore instructions and required software or credentials. | The implementer demonstrates a restore in a private test environment and records the checks. |
| Licenses | Theme, plugin, font and image records, with the account holder and applicable terms. | You know which items require a business license or remain under a studio subscription. |
| Connected services | Relevant booking, form/email delivery, analytics and payment accounts, plus business contacts and access arrangements. | You can identify where enquiries or records arrive and who can administer each service. |
| Training | Instructions for routine tasks, a walkthrough and unresolved items. | Someone in your business can perform an ordinary edit without the developer driving. |
A managed service may give you a client dashboard while the provider administers the server. Agree what your business can access, what the provider handles and how files and data will be supplied if you leave. A handover should never include another customer's credentials.
If the domain registration needs changing, plan that separately. ICANN distinguishes changing the registered holder from moving between registrars, and some changes can restrict a later transfer. Confirm the sequence with your registrar before changing contact details. ICANN domain transfer guidance
Check what your WordPress account can do
WordPress separates user roles from individual capabilities. An Administrator normally manages one website; an Editor manages content. Multisite networks have a separate Super Admin role, and roles can be customized. Check the actual permissions your project requires, including who can add or remove authorized users. WordPress roles and capabilities
Use an individual account for each person. Ask which role your team should use for everyday content work, who handles administration and how a replacement developer would receive appropriate access. WordPress administration does not automatically provide access to the domain, hosting or connected booking account.
If control and handover are part of your website buying decision, discuss your WordPress project with WPShip. Bring your current website address and a list of the accounts you already control, plus anything you expect to receive. WPShip's about page describes WordPress sites and exportable content that customers retain; confirm the access and handover deliverables for your specific project.
Run the access checks yourself
Arrange a handover session while the developer is available. Use your own device and a fresh browser session so that the test cannot succeed merely because you are looking at the developer's logged-in account.
- Sign in to the domain and hosting accounts, or the agreed client dashboard. Identify your website and its renewal information without changing any settings.
- Complete the normal sign-in checks yourself, including two-factor authentication where enabled. This is an additional check such as an authenticator code. Confirm that the business controls the agreed recovery route; review the recovery instructions without triggering an unplanned reset. Never share one-time codes or include secrets in recordings.
- Sign in to WordPress with your individual account. On an agreed test draft, make a small edit, preview it and save without publishing. Confirm that you can find the documented administration or support route too.
- Find the handover files in business-controlled storage and open a representative file. Ask the developer to explain any file you cannot identify.
- Write down missing access, unclear responsibilities and the person who will resolve each issue. Recheck the affected item after it has been corrected.
Keep these tests away from changes to domain routing, plugin updates or the live site's data. Agree a date to remove or reduce access that is no longer needed after handover. Keep authorized support access separate, with its purpose and responsible person recorded. Removing the developer before replacement access is verified can interrupt the handover.
Receive both a content export and a recovery backup
WordPress Tools > Export produces an XML file, also called WXR, that another WordPress installation can import. It carries supported content such as posts and pages. It is useful for portability, but is not a complete restorable copy of the website. WordPress export documentation
WordPress documents two parts of a typical site backup: files and a database. The files include themes, plugins and uploads; the database contains content and other stored site data. Ask for a dated backup set that includes both, plus the software and instructions needed to restore it. WordPress backup guidance
Ask the implementer for a restore demonstration in a private test environment. They should isolate outgoing email, bookings and payments before using the restored copy. Record the backup date, who restored it and which pages, media and agreed functions they checked.
A successful restore is evidence about that backup. Agree who keeps making backups after handover, where another accessible copy is stored, and how often recovery is rechecked. Your owner-side check is to understand and inspect the evidence; you do not need to learn database administration during a handover call.
Your WordPress backup may not cover a separate booking platform, email inbox or other connected service. Put those services in the handover record with their own data access and recovery arrangements.
Make renewals and license responsibilities visible
A list of installed plugins does not tell you who will pay for them next year. For each paid component, ask for its name, supplier, account holder, renewal date, renewal responsibility and what the current terms permit.
Some components may be supplied under a developer's subscription. Ask whether your continued use, updates and support depend on that relationship, whether transfer is permitted, and what a business-held license would require. Do not assume that a license moves with the website or that every expired subscription has the same effect.
Include hosting, the domain, email delivery, booking tools, fonts and images where relevant. For custom work, record the agreed deliverables and rights separately from the access checklist. A folder of files does not resolve an unclear agreement about their use.
Finish with a usable operating guide
Ask for a short guide that names the website's main parts and covers the tasks your team will actually do. For a service business, that might mean changing business hours, editing a service page, replacing an image and checking where enquiries arrive. Keep a record of remaining defects and the contact route for help after handover.
During the walkthrough, have someone from your business perform one routine task. Questions that arise during that exercise belong in the guide. A recording can help, provided it contains no passwords or recovery codes.
Record the exceptions before completing handover
In a hypothetical handover for a local studio, the owner can edit service pages, but domain renewal notices go only to the developer and nobody has identified the business contact for the booking account. Mark the WordPress editing check tested and the other two items open. The record should say who will correct them, by when, and what the owner will recheck. A finished homepage cannot answer those account questions.
An unresolved recovery route or unexplained ongoing charge deserves a specific answer before you mark that part of the handover complete. An optional training video can have an agreed later delivery date if the team already has usable instructions. Distinguish those cases rather than assigning the whole project one vague status. These are operational acceptance checks; use the contract for the project's formal sign-off and payment terms.
Keep the final record with the delivered files: what was received, what was checked, what remains open and who is responsible. If you are planning a build or a change of provider, share those handover requirements when you contact WPShip, so the conversation starts with the control and documentation your business needs.