The Website Handover Checklist
The least discussed day of a web project is its most critical one: handover day. 📦 Payments settled, site live, everyone content — and precisely in that comfort, the seeds of future years’ problems get planted.
Because in most projects, handover is not a ceremony but an email: “your site is live, congratulations.” Access stays with the agency, files go unrequested, nobody asks for a guide. 📧
This guide turns handover into a procedure: how to verify the handover list, how to run the check walk, in what order access transfers, and what to watch in the first thirty days. This is the most practical piece in the series — read it with a checklist in hand, especially if your agency sits in another city or country. ✅
What the handover items should be, we placed at the proposal stage in the agency guide. This piece covers how that list gets verified in the field on delivery day — the bridge between the promise and the handover. 🌉
Why Handover Is a Crisis Door 🚪
BU BÖLÜMÜN ÖZETİ
- The “ask the agency for the password” day
- The “those files stay with us” answer
- The “how was this done?” question
- The “licence expired” surprise
Every item skipped at handover returns months later as a crisis — and on crisis day your bargaining position is weaker than today’s. Four familiar scenarios prove it.
You may recognise them. 🎬
The “ask the agency for the password” day
A year later a small change is needed, and the discovery lands: the admin password was never handed over. 🔐 If the agency is well-meaning, the problem is small; if the relationship soured, the agency closed, or an ocean and a time zone sit between you, you become a guest on your own website. A site without access is a site without an owner.
The “those files stay with us” answer
You want to work with a new team, the source files get requested, and the answer arrives: “those are our working files.” 🗃️ A file not requested at handover becomes a negotiation later. The ownership argument gets settled in the contract; at handover it only gets verified.
The “how was this done?” question
The employee who updated the site leaves, and the knowledge leaves with them. 🚶 Without a delivered guide and a recorded training session, every staff change starts from zero. Institutional memory gets attached to files on handover day — or never.
The “licence expired” surprise
The theme or plugin licence lived in the agency’s bulk account; when the relationship ended, the licence ended — and the site stopped receiving updates. 📄 Handover must include a licence list: what, in whose name, expiring when, renewal cost. A four-column table kills this surprise completely.
The Handover List: A Verification Table ✅
BU BÖLÜMÜN ÖZETİ
- The access test: log in and act
- Have the backup opened
- Test the documents on a person
- Never sign with open items
The handover list lives in the proposal; on delivery day each item gets verified one by one. The table pairs every item with its verification question — the question is never “was it given” but “does it work”.
Six items, six questions. 📋
| Item | Verification question |
|---|---|
| Admin access | Did you log in with your own email and add a user? |
| Hosting and domain | Did you enter the panels — in the business’s name? |
| Full backup | Is the file in your hands, at a plausible size? |
| Source files | Are the sources of every custom piece in the package? |
| Licence list | Are all four columns filled: what, who, expiry, cost? |
| Guide and training recording | Does the recording play, is the guide current? |
The access test: log in and act
Access verification is not receiving a password but performing an action: log in, create a user, delete it. 🔑 Check the permission level too — a restricted account dressed as a full one is delivery day’s classic trick. The ownership rules from the hosting guide get field-tested right here.
Have the backup opened
The backup file arriving is not enough; ask for a small proof: its contents listed, or a restore into a test environment. 💾 An empty or partial backup is the most dangerous gap — invisible until crisis day. The maintenance rule “an untested backup is not a backup” starts at handover.
Test the documents on a person
The guide’s test is simple: hand it to a colleague who has never used the site and have them add a news post. 📖 Every place they stall is a gap in the guide. The training recording gets watched and archived the same day; a recording nobody can find is a recording never made — and if teams span languages, ask whether it can be subtitled.
Never sign with open items
The handover protocol gets signed with a mark against every line. ✍️ Open items get written in with a date attached; a verbal “we’ll send it later” usually means never. The link between the final payment and complete delivery is the contract’s job.
The Delivery-Day Check Walk 🔍
Documents done; now the site itself gets inspected. This walk adapts the tests from earlier in the series to delivery day — it takes an hour and protects years.
Four stops. 🚏
A full tour on a phone
Your own phone, a private tab: homepage, service pages, contact. 📱 The entire five-minute mobile test is mandatory programming today: does the number dial, does the map open, are the pages fast? A fault found today gets fixed by the agency; found in a month, it gets invoiced.
Send the form end to end
Fill the form, send it, and watch the notification land at the right address. 📨 Thank-you page, error messages and the alert address get checked one by one — the four-link chain from the form guide must stand assembled on delivery day. If notifications flow to the agency’s address, that changes today.
Access Transfer: The Correct Order 🔐
BU BÖLÜMÜN ÖZETİ
- Take over and verify
- Rotate the passwords, into the vault
- Delegate scoped access to the agency
- Put the first thirty days under watch
Access transfer follows a sequence, not improvisation. The visual gives the four steps — break the order and you either lock yourself out or leave old doors open.
The steps. 🗝️
Take over and verify
Hosting, domain and admin accounts get bound to the business’s email; then every login gets physically entered. 🏢 Recovery email and phone fields get checked too — a forgotten recovery address remains a back door, whoever it belongs to and wherever they live.
Rotate the passwords, into the vault
Once the takeover completes, every password changes and enters the password vault. 🔒 This step is not distrust of the agency; it is transfer hygiene, and a good agency proposes it themselves. Vault access lives with at least two people.
Delegate scoped access to the agency
If maintenance continues, the agency receives a user of its own with scoped rights — never the password. 🎫 When the work ends, the access closes with one click. The access list — what, where, who — enters the archive on a single page; that page is the delivery-day output of the hosting guide’s ownership regime.
Put the first thirty days under watch
The month after delivery is observation month: form notifications, speed and analytics get checked weekly. 📆 The warranty period gets used actively — every fault found is reported in writing. Day thirty is the day the maintenance calendar officially begins; handover ends, keeping-alive starts.
Make the Handover a Ceremony 🤝
BU BÖLÜMÜN ÖZETİ
- The half-day handover meeting
- The protocol protects both sides
- The parting-day rehearsal
- Let’s run your handover together
The whole list fits on one page and the handover fits in half a day. A small ceremonial discipline protects both sides — and a good agency does not dodge the ceremony; it volunteers for it.
Three closing notes. 🎀
The half-day handover meeting
Handover happens in a meeting, not an email — in a room or on a recorded video call: the list gets verified together, the check walk gets walked together, the training happens in the same session. 🗓️ That half day is the most productive half day of the coming years.
The protocol protects both sides
The signed handover protocol protects the agency as much as you: with deliverables on record, the boundary of later requests is clear. ⚖️ Healthy relationships feed on clarity, never on ambiguity — doubly true across borders, where a written record replaces the shared hallway.
The parting-day rehearsal
If the handover list is complete, you have achieved one more thing: if you had to part with the agency tomorrow, you would lose nothing. 🕊️ That freedom is the health of the relationship — you stay as a satisfied client, never as a captive one.
Let’s run your handover together
If a project is underway, let’s prepare your handover list together; if a past handover left gaps, an audit maps the current state: Web Design. In our own deliveries we write this list upfront — because a complete handover is our reference too. 🚀
Frequently Asked Questions 💬
Sık Sorulan Sorular
Visitor analytics and search-engine tools must be installed and attached to the business’s own accounts. 📊 Measurement bound to the agency’s account means losing the data history at parting. The full measurement regime comes later in this series; today’s job is seeing the meters run in your name.
If the site was rebuilt, the old page addresses must forward to their successors — otherwise years of search equity fall into the void. 🧭 The check is plain: type a few old addresses and watch them arrive at the right pages. A list of dead addresses goes to the agency today, not tomorrow.
Six items: full admin access, hosting and domain accounts, a full backup, source files, the licence list, and the guide with a training recording.
By logging in and acting: create and delete a user, and confirm the permission level is complete.
By listing its contents or restoring it to a test environment; the file arriving is not proof by itself.
Four columns: what, in whose name, expiry date and renewal cost. Licences in the agency’s account fail when the relationship ends.
The mobile tour, an end-to-end form send, analytics account ownership and old-address redirects.
Four steps: take over, verify, rotate all passwords, delegate scoped access — then the access list enters the archive.
Yes; it is transfer hygiene, not distrust — a good agency proposes it themselves.
It protects both sides: deliverables on record give later requests a clear boundary.
Observation: forms, speed and analytics get weekly checks, faults get reported under warranty, and the maintenance calendar begins.