Access to the domain, hosting and website should remain under the control of the business the site was built for. An authorised person at the business should be able to renew services, manage access and recover accounts. The agency or developer receives separate access with the permissions needed for the agreed work.
Agree this before development and check it at handover. Being able to change text in a CMS does not automatically give you access to the domain, business email or analytics. If you hire someone else next month, you should know who can grant access and where to find the information they need to continue the work.
Who should register the domain and administer the website?
For a business domain, check that the business is named as the registrant, the person or organisation the domain is registered to. RNIDS recommends this for business use in its guide to registering Serbian .rs and .срб domains. The email address receiving notices should be active and checked regularly.
The domain registrant, hosting account holder and CMS administrator are different roles. One person may have all the access, but check each separately. Being able to edit a page does not establish that you can renew the domain or retrieve a website backup.
Also agree what code, design and content you receive, which licences you use and what happens when the relationship ends. An administrator role describes the technical ability to manage an account. Usage rights and the transfer of particular materials need their own agreement with the supplier.
Which accounts should you check at handover?
Create a register with the provider, control panel address and responsible person for each service. Add the renewal date and account recovery procedure. Record where confidential information is securely stored; do not put the secrets themselves in a document circulated by email.
Scroll the table sideways to see all columns.
| Account or service | What the business should control | What to check for recovery | When access is needed |
|---|---|---|---|
| Domain | Registrant details and the registrar account. | Renewal contact and identity verification procedure. | Renewing registration or changing suppliers. |
| Hosting | Its website service and agreed access to backups. | Provider support and the website restoration procedure. | An outage, package renewal or move. |
| DNS | The account where DNS records are managed. | A copy of settings and an authorised person to change them. | Connecting the site, email or another service. |
| Business email | Organisation administration with the email provider. | The administrator account recovery process. | A new employee or a team member leaving. |
| CMS | User administration and access to its content. | Account recovery and the location of backups. | Editing pages and adding editors. |
| Google Analytics 4 | Administrator access to the appropriate account or property. | Who manages permissions and the Google accounts. | Reviewing measurement or changing analysts. |
| Google Search Console | Verified ownership of the appropriate property. | A verification method controlled by the business. | Monitoring search and granting SEO access. |
If the site uses a code repository, publishing service, paid plugins or external integrations, add them to the register. For each licence, record who pays and whether it remains available after handover. For a site on the agency's shared infrastructure, agree the export and migration process in advance.
How do you grant access without sharing passwords?
Use user invitations or delegated access where the service supports them. Each person should sign in with their own account. You can then change their permissions or remove access without changing everyone else's account.
Enable two-factor authentication where available. Agree who at the business keeps recovery methods and how an authorised replacement can access them. ICANN recommends a unique registrar password, keeping login credentials private and checking whether an additional authentication step is supported.
Grant only the permissions needed for the work. If the provider has no invitations or separate users, ask for its supported delegation or account transfer procedure. Do not send passwords, backup codes or private keys through a contact form, ordinary email or group chat.
Does a content editor need administrator access?
An editorial role is usually sufficient for publishing articles. WordPress separates roles and capabilities: an Editor can manage and publish other users' content, while an Administrator has broader permissions. Plugins and customisations can change capabilities, so check what the particular account can do.
At handover, ask the employee to use their own account to edit a sample draft, add an image with alt text and preview the result. If they cannot complete the task, establish whether they need a permission change or a short explanation. Our guide to editing website content with a CMS covers everyday work.
Who needs GA4 and Search Console access?
In GA4, an authorised person at the business should be able to manage users. Google distinguishes administration from viewing reports, for which it provides the Viewer role. Give someone analysing one website an appropriate role for that property.
Check permissions granted above the property too. Google's user management guide explains that account access includes its properties. Record analytics identifiers and the domain being measured in the handover documentation, to avoid treating another site's report as your own.
For Search Console, establish verified ownership that the business can retain. Google distinguishes owners from full and restricted users. When removing a previous owner, check their verification tokens too: remaining tokens can let them verify ownership again. Before deleting anything, check each token's purpose and retain the business's valid verification.
Why check DNS and business email separately?
DNS holds records that connect the domain to services. These include email records described in the Cloudflare documentation. Their exact values depend on the email provider. Before changing DNS settings, save the existing configuration and establish which services depend on it.
You can move a website to another host and keep the existing email service. Include this in the migration plan: who prepares the change, who approves it and how sending and receiving will be checked. Include contact form message delivery in the agreed checks.
Plan a recovery route for important accounts that does not depend solely on email at the same domain. If that email becomes unavailable, the responsible person needs to know which alternative procedure was set up and is accepted by the provider.
How do you confirm that handover is complete?
During a joint check, ask the authorised person at the business to open the required control panels independently. A list of sent invitations is a starting point; confirm handover once invitations are accepted and the agreed tasks have been checked.
- Check business details, responsible people, renewal dates and who receives notices.
- Confirm access to users, content and the agreed backups. Record what is stored and who can initiate restoration.
- Review account recovery without revealing secrets to other participants.
- List active collaborators, agree which access remains and remove unnecessary access once continued operation is secured.
- Record the review date, completed checks and outstanding items with a responsible person.
If you continue working together, assign responsibility for service renewals and access requests. Address recurring work separately using the guide to what website maintenance includes. When commissioning website development, put these requirements in the proposal so you have clear acceptance criteria.
For an estimate for a project or taking over an existing website, send the URL, known providers and a note of which accounts you can currently access. We arrange access separately through the appropriate permission process.