Website handoffs create confusion when access, documentation, and ownership are unclear. If you inherited responsibility for a site you did not build, or if someone else has been managing it and you are switching providers, the transition can feel murky. What do you give them? What do you keep? How do you stay informed without having to become an expert yourself?
A clean website handoff usually comes down to four things: access scoped to the work, documentation that does not live in one person’s memory, clear reporting expectations, and an exit path if the relationship changes.
What Access a Web Professional Will Typically Need
Before any meaningful work can begin on your site, a professional needs access to specific systems. A managed website support provider will typically walk you through this process during onboarding. Here is what is typically required and what each one is for.
WordPress Admin Access
If your site runs on WordPress, your provider needs an administrator-level login. This lets them install updates, manage plugins, modify templates, and make changes to the site’s content and settings. This is distinct from editor or author access, which only allows content changes.
A separate admin account for the provider is usually cleaner than sharing an existing login. It makes revocation straightforward if the relationship ends and keeps the owner’s account separate from vendor access.
Hosting Control Panel Access
Your website runs on a server managed by a hosting company. That hosting account has its own login (usually cPanel, Plesk, or a proprietary dashboard). Access to the hosting control panel allows your provider to manage server-level settings, create or modify databases, upload files via FTP, configure SSL certificates, and access error logs.
Providers do not always need the primary hosting login. Many can work through a sub-account with sufficient permissions for the work in scope.
Domain Registrar Access
Your domain name (yourcompany.com) is registered separately from your hosting. The registrar is the company where you purchased or transferred the domain, such as GoDaddy, Namecheap, or Squarespace Domains. Access to the domain registrar allows your provider to adjust DNS settings, which control where your domain points (such as to your web host, your email provider, or a CDN).
This access is not always needed for ongoing maintenance, but it is often needed for migrations, SSL renewals, and email configuration. Problems usually compound when no one knows who the registrar is or how to reach the account during an urgent situation.
FTP or SFTP Credentials
FTP (File Transfer Protocol) and SFTP (the secure version) are methods for accessing your site’s files directly on the server. Some work requires this level of access, particularly for custom theme development, file-level debugging, and migrations.
Backup and Staging Access
If your site has a staging environment or a backup system managed by your host, your provider will need to know how to access those tools. If your host does not provide these automatically, your provider should set them up as part of onboarding.
What Documentation to Gather
Good documentation makes every future request faster and cheaper. If you do not have any, creating it during the handoff is a reasonable first project to assign your new provider.
At minimum, you want to document:
- Domain registrar: Company name, login email, and where renewal reminders go
- Hosting provider: Company name, plan type, account login, and what is included
- WordPress login URL: Usually yoursite.com/wp-admin, but sometimes customized
- Theme name and version: Found in the WordPress dashboard under Appearance > Themes
- Active plugins: A list of what is installed and what each one does
- Third-party integrations: Any tools connected to your site, such as your email marketing platform, CRM, Google Analytics, or payment processor
- SSL certificate: Where it is issued, when it renews, and whether renewal is automatic
- DNS records: Especially if your email is hosted separately from your website
Deep technical understanding is not required to document any of this. A competent provider can help compile the list during onboarding. The goal is simply to have it recorded somewhere the business can access, not trapped in one person’s memory.
What a Good Handoff Process Looks Like
Access Transfer, Not Access Donation
A professional handoff does not mean giving someone everything and hoping for the best. It means creating access that is scoped appropriately, documented, and revocable.
Good practice is to create new credentials specifically for your provider rather than sharing existing logins. This means:
- A new WordPress admin account in the name of the agency or the individual contact there
- A hosting sub-account if your host supports it
- Access to only the systems that are actually needed
If a provider asks for your personal login to your domain registrar or your personal email account, that is a red flag. They should be able to work with delegated access.
Define What Ongoing Reporting Looks Like
Before work begins, agree on how you will stay informed. A professional provider should be able to tell you, in plain language and on a regular schedule:
- What updates were applied and when
- Whether any problems were identified during the period
- Whether backups are running and where they are stored
- Any changes made to the site and why
Monthly summaries are typical for maintenance relationships. More frequent communication should be the norm when active development is underway.
Establish a Point of Contact
A healthy relationship leaves no ambiguity about who gets contacted if something goes wrong. That usually means a specific person or team, along with a clear expectation for response time.
Document the Scope of the Relationship
What is the provider responsible for, and what are you responsible for? This should be written down, even if it is informal. Common areas that create confusion include:
- Who publishes new content to the site
- Who approves changes before they go live
- Who handles domain renewals
- Who monitors uptime
Getting this clear at the start prevents unpleasant surprises later.
How to Stay Informed Without Managing the Details
You do not need to understand the technical details of every task performed on your site. What you do need is enough information to know whether things are being handled.
A few habits tend to keep owners informed without turning them into site managers:
Monthly summaries deserve a quick review. Even when most of the detail is not meaningful to the owner, it should still be possible to spot updates applied, backups confirmed, and anything flagged as a concern.
A brief weekly browser check catches obvious failures. Opening the homepage, clicking through the contact page, and submitting a test form is often enough to surface visible problems that did not trigger an alert.
Renewal dates matter. Domain registration and hosting plans renew on a schedule, and expired domains can take both the site and email offline at the same time.
Questions are operational, not bothersome. A trustworthy provider can explain what was done and why. Dismissive responses usually tell the owner something useful about the relationship.
What to Do at the End of a Provider Relationship
Ending a relationship with a web provider can be as important as starting one. When a provider relationship ends:
- Revoke any access credentials you created for them
- Change any shared passwords
- Confirm you have current copies of all backups
- Confirm you have access to all systems they were managing on your behalf
If your provider was handling domain renewals or billing on your behalf, transfer those responsibilities before the relationship ends, not after. This is especially important for domain names: if the domain is registered under someone else’s account, transferring it after the fact can take time and create gaps.
Keeping control of your website does not require you to become technical. It requires knowing where the access is, who has it, and how to get it back. That is a documentation problem, not a technology problem, and it is entirely manageable with the right setup from the start.
Related reading: Hiring and Managing a Web Development Agency, Part 3: How to Know If They Are Doing Their Job, Who Should Be Managing Your Website? Part 1: Hosting vs. Management: What Is Actually Covered, and Website Hosting Explained: What Each Plan Actually Covers.