What files and access should you get when a website is handed over?
Source code, domain, hosting, email and admin panel. A short list of what to ask for when you take over a web project, and how to check it.
Short answer: you should own every account the project needs to run. If the site keeps working after the developer leaves, and you don’t need them to make a change, the handover was done right.
The problem is rarely the code. It’s the accounts. The domain stays in the developer’s account, the server is billed to their card, and only they know the email settings. Nobody notices while things are fine. Then one day they’re unreachable and the site goes down.
Five things to ask for
| What | Why it matters | How to check |
|---|---|---|
| Domain | Whoever owns the address effectively owns the site. | Does the domain show up in your account at the registrar? |
| Source code | So someone else can carry on. | Is the code in your GitHub/GitLab account or organisation? |
| Server / hosting | If the bill isn’t paid, the site goes offline. | Are the hosting account and payment method in your name? |
| DNS and email | Mail and site settings are managed here. | Can you log in to the DNS panel (e.g. Cloudflare) with your own account? |
| Admin panel | So you can update content yourself. | Can you log in with your own user and admin rights? |
It’s normal for the developer to be added to these accounts as a team member. What matters is that you are the owner, and that you can remove their access yourself when the work is done.
Also ask about the code
- How do I run it? The steps to set the project up from scratch should be written down. A
READMEfile is usually enough. - Where are the secrets? API keys and passwords shouldn’t live in the code. They belong in a separate place with a clear list.
- Which paid services are used? Maps, email sending, payments: a list of services and which account each is tied to.
Backups and recovery
“We take backups” isn’t enough. Ask:
- Where are backups stored, and how often?
- Who can access them?
- When was a restore from the latest backup last tested?
A backup that has never been restored is a backup you can’t count on.
Your own checklist for handover day
- I can log in to the domain, hosting, DNS and code accounts with my own password.
- Payment methods are in my name.
- I have the list of paid services.
- The steps to run the project are written down.
- I know where the backups are and how to restore them.
- I can remove the developer’s access myself when needed.
FAQ
What if the developer wants to keep the domain in their account? A domain transfer or account change takes a few days at most registrars. The easiest way is to agree on this at the start of the project.
I’m not technical. How do I check all this? The “how to check” column needs no technical knowledge: just see whether you can log in to each panel with your own account.
At Didirtech every project is handed over with this list. Accounts are opened in your name from day one, and when the work is done, all access stays with you.