Website handover checklist

Whoever controls the domain controls the website and its email. Move it first, carefully.

• Write down where the domain is registered and when it expires.

  A public domain lookup (RDAP or WHOIS) shows the registrar and expiry date.

• Make sure it has at least 2–3 months left, or renew it before you start.

  Some registrars refuse a transfer close to expiry, and a lapse can lose the name.

• Unlock the domain and get the transfer (EPP/auth) code, or push it to the buyer’s account at the same registrar.
• Update the owner (registrant) name and email to the new owner’s details.

  Changing the owner can lock transfers to another registrar for 60 days at some registrars; agree the order with the buyer.

• New owner confirms the domain shows in their account, with auto-renew on.

DNS sends visitors to the website and email to the mailbox. A mistake here takes both offline.

• Export or screenshot every DNS record before anything moves (A, CNAME, MX, TXT, SPF, DKIM, DMARC).
• Recreate the records in the new owner’s DNS provider, or move the DNS account to them.
• Check the website and email still work once the change has spread (it can take up to 48 hours).

Where the website’s files and code run.

• Agree how hosting moves: transfer the account or project, add the new owner as a team member, or copy the site to their hosting.
• Hand over the code and files: the code repository (GitHub, GitLab) or a full download.
• List the settings the site needs (environment variables), without sending passwords or keys in plain email.

Without it, browsers warn visitors the site is not secure.

• Check whether the certificate renews itself (most hosts use free Let’s Encrypt certificates).

  A paid certificate rarely transfers; the new host usually issues a free one.

• After the move, open the site and check the padlock shows, with no warnings.

Mailboxes on the domain (Google Workspace, Microsoft 365, Zoho or the host’s email) and the emails the website sends.

• Decide which mailboxes go with the sale, and who keeps a copy of old emails.
• Move the email account to the new owner, or have them set up their own and copy the mail across.

  Google Workspace and Microsoft 365 accounts belong to an organisation, so they usually move by adding the new owner as an admin, not by transfer.

• Move the service that sends the website’s emails (receipts, password resets, newsletters) and check they still arrive.

Customer accounts, orders and content often live in a database, separate from the website’s files.

• Take a full, fresh backup of the database and files on the handover day, and test that it opens.
• Move the database account to the new owner, or restore the backup in theirs.
• Turn on automatic backups in the new owner’s account, and delete your own copies once they confirm.

  Keeping customers’ personal data after the sale may break privacy laws.

How customers pay: Stripe, PayPal, Shopify Payments, Square and the like.

• New owner opens their own payment account and connects it to the website.

  Usually can’t be transferred Payment accounts are tied to a person or company’s identity and bank, so they usually can’t be transferred.

• Plan how existing customer subscriptions move (Stripe can copy card details between accounts on request).
• After the switch, turn off your payment account’s connection to the site, and settle any refunds and disputes.

Visitor numbers and how the site appears in Google and Bing.

• Add the new owner to Google Analytics (or your analytics tool) as an administrator.
• Add the new owner to Google Search Console and Bing Webmaster Tools as an owner.
• Hand over Google Tag Manager or similar, if used.

Often the hardest part: many of these belong to a person, not the website.

• Ad networks (Google AdSense, Ezoic, Mediavine and others): new owner applies with their own account.

  Usually can’t be transferred Ad accounts are tied to a person’s identity and tax details.

• Affiliate programs (Amazon Associates and others): new owner joins with their own account and swaps the links.

  Usually can’t be transferred Many programs forbid transferring an account; earnings stay with the old account.

• Social media pages: add the new owner as an admin (Facebook and Instagram pages, YouTube channels, LinkedIn pages), then remove yourself.

  Personal profiles can’t be transferred, and some platforms ban selling accounts. Check each platform’s rules.

• Email list: export subscribers with their consent records and move them to the new owner’s email tool.

  Privacy and anti-spam laws may require you to tell subscribers about the new owner.

Paid plugins, themes, fonts and tools the website needs to keep working and getting updates.

• List every paid plugin, theme, font and tool, with when each renews.
• Transfer each licence the seller allows; otherwise the new owner buys their own.

  Usually can’t be transferred Many licences are personal and can’t be transferred. Check each seller’s terms.

• Replace your licence keys on the site with the new owner’s.

Do these in this order, so nobody is ever locked out and nothing is left with the old owner.

• 1. Add the new owner to each account (as owner or admin) while you still have access.
• 2. New owner changes the login email, password, recovery email and phone, and sets up their own two-step verification.

  Two-step codes going to your phone or authenticator app will lock them out later.

• 3. Only then remove the old owner (you) from each account, and delete saved logins and backup codes you kept.
• Replace API keys and connection keys you created, so old ones stop working.

Every service that charges for the website should move to the new owner’s card.

• List every bill behind the website: domain, hosting, email, database, plugins, tools.
• New owner puts their own card on each account before your card is removed.
• Check none of your cards is still on any account after the next renewal.

Questions always come up after a handover.

• Agree a support window in writing (for example 30 days of answering questions), and what it covers.
• Hand over notes: how the site works, what renews when, and who to contact for each service.
• Both sign off when everything has moved and the new owner confirms it all works.