Who owns your website? The handoff checklist

Your business does not control a digital asset merely because your name appears on the page. Control means an account the business can access, recover, transfer, and hand to a replacement provider without permission from the old one.

Use the interactive ownership checklist while collecting the records below.

Domain and DNS

Record:

• domain name and registrar
• legal registrant or account owner
• expiry date and auto-renew status
• business-controlled login and recovery email
• domain-lock status
• nameservers and DNS provider
• who can change DNS
• where the authorization or transfer code is requested

For a .ca domain, CIRA operates the registry while a certified registrar manages the customer account. Confirm the registrant satisfies CIRA’s Canadian Presence Requirements and that the business, not an agency employee, is the intended holder.For .com and other generic domains, use ICANN’s official registration-data lookup and transfer guidance. Privacy can hide public details without changing the underlying registered holder.

Website and hosting

Collect the hosting account, administrator access, project name, deployment method, source repository, build instructions, and a current export or backup.

For WordPress or another database-backed site, collect a database backup, uploaded media, theme or application source, plugin inventory, licences, and a tested restore process. A screenshot of the pages is not a backup.

For a static site, collect the repository or complete source folder and the instructions needed to build and deploy it.

Communications and customer systems

Document ownership and recovery for:

• primary business email and domain mail settings
• contact forms and submission notifications
• booking system and connected calendars
• business phone number and porting details
• email-marketing list and consent records
• CRM and customer exports

The primary email deserves special attention because it often resets every other account.

Discovery, social, and payments

Confirm the business is the primary owner of Google Business Profile, Apple Business (formerly Apple Business Connect), Bing Places, Search Console, analytics, and each social account.

Payment accounts must use the correct legal entity, settlement bank, tax details, support contact, and recovery method. Never share one employee’s personal login for payments.

Billing and recovery

For each account, record:

• current owner
• backup owner
• recovery email and phone
• multi-factor method
• location of backup codes
• payment method and renewal date
• last successful login or recovery test

Do not put passwords into a spreadsheet. Store them in a business password manager and use the checklist to record where control lives.

Agency exit procedure

1. Inventory access before announcing a cutover date.
2. Add the new owner while the old provider is available.
3. Export source, data, reports, and licences.
4. Rotate passwords, recovery contacts, API keys, and billing permissions.
5. Remove old access only after the new route is tested.
6. Check the website, email, forms, analytics, and payments after the transition.
7. Preserve the contract and handoff record.

The free route is business-owned accounts plus a quarterly review. A paid managed-service arrangement is justified when the business needs a named operator, but that operator should be an authorized guest, not the only owner.

Keep recovery usable

Use the backup register and restore exercise to record what the copy includes, where protected access instructions live, and whether a sample restores successfully. A copy inside the same inaccessible account may not survive that account’s loss. Keep recovery instructions outside the affected device and preserve required records before cancelling a service.