Your developer just told you the website is finished. Congratulations. Before you pay the final invoice, you need to make sure you actually receive everything you paid for.
I’m not talking about whether the site looks good or loads fast. I’m talking about ownership, access, and control. The things that determine whether you own a website or just rent access to one.
Too many business owners pay in full, shake hands, and only later discover they can’t access their own hosting, don’t have the source code, or worse - don’t even own their domain name.
The Non-Negotiables
These are the things you must receive. No exceptions, no excuses.
1. Domain Registration Ownership
What it is: Your domain name (yourbusiness.co.uk) is registered with a domain registrar. Someone owns that registration.
What you should receive:
- Domain registered in your business name or your personal name
- Registration account at the registrar (Namecheap, GoDaddy, etc.) in your name
- Login credentials for the domain registrar account
- Confirmation that you’re listed as the registrant, admin contact, and billing contact
- Proof that auto-renewal is enabled (or a reminder to enable it)
How to verify:
- Log into the domain registrar with the credentials provided
- Check the domain’s WHOIS information (use whois.net)
- Verify all contact emails are yours, not the developer’s
Red flag: If your developer says “I own the domain but you can use it” or “It’s easier if I keep ownership,” that’s not acceptable. This is YOUR domain. You must own it.
If you want complete ownership from the start, check out our own-outright website service where everything is in your name from day one.
Cost expectations: Domain registration costs £10-20 per year for .co.uk or .com. If your developer says they need to “retain ownership for technical reasons,” they’re lying.
2. Hosting Account Access
What it is: Your website files live on a server somewhere. That server is provided by a hosting company. You need full access to that hosting account.
What you should receive:
- Account at the hosting provider (Vercel, Netlify, SiteGround, etc.) in your name
- Login credentials (username and password)
- Confirmation that you’re the account owner and billing contact
- Access to the hosting control panel (cPanel, Plesk, or provider dashboard)
- Documentation of what’s hosted and where
- Billing information and renewal dates
How to verify:
- Log into the hosting account with provided credentials
- Verify you can see billing information
- Verify you can access file manager or deployment settings
- Check that your email address is listed as the account owner
Red flag: “I provide hosting as part of my service” or “Your site is on my server” means you don’t control your hosting. You’re renting space on their infrastructure, which they can shut off at any time.
Cost expectations: Hosting ranges from £0 (Vercel/Netlify free tier for basic sites) to £10-50/month for business hosting. If you’re paying the developer a monthly hosting fee significantly higher than market rates, you’re being overcharged.
3. Website Admin/CMS Access
What it is: The control panel where you can edit pages, add content, manage settings. WordPress admin, Shopify dashboard, or whatever CMS your site uses.
What you should receive:
- Administrator-level login credentials
- Username and password for the admin panel
- Confirmation that your email is set as the primary admin email
- Access to create/delete other admin users
- Recovery method if you forget your password
How to verify:
- Log in to the admin panel
- Check your user role is “Administrator” or equivalent (not “Editor” or limited role)
- Verify you can access all settings and functionality
- Test password reset to confirm it goes to your email
Red flag: If you’re given “Editor” access but not full admin, you don’t have complete control. The developer might have retained admin-level access for themselves without telling you.
4. Source Code and Files
What it is: The actual code that makes your website work. HTML, CSS, JavaScript, images, everything.
What you should receive:
- Complete copy of all website files
- Code repository access (GitHub, GitLab, etc.) if applicable
- Database backup (if your site uses a database)
- All original design files (Figma, Photoshop, Sketch files)
- Any custom graphics, logos, or assets created for the project
- Clear file structure documentation
How to verify:
- Download all files and verify they’re complete
- If using a repository, verify you’re the owner, not just a collaborator
- Check that you can actually use the files (not encrypted or locked in proprietary format)
- Confirm another developer could work with these files
Red flag: “The code is proprietary” or “You don’t need the source code” is unacceptable. You paid for the work, you own the output. If the developer refuses to provide source code, don’t make final payment.
Format matters: Files should be in standard, open formats. Not locked in a proprietary system only your developer can access.
The Important Extras
These aren’t always applicable, but if they exist for your site, you must receive access.
5. Email Account Access
What it is: If your website comes with professional email (you@yourbusiness.co.uk), you need full control.
What you should receive:
- Access to email hosting control panel
- All existing email account credentials
- Ability to create/delete email accounts
- Email forwarding and alias settings
- Spam filter and security settings access
How to verify:
- Log into the email control panel
- Create a test email account
- Send and receive test emails
- Verify you can reset passwords for existing accounts
Cost note: Email hosting is often separate from website hosting. Typical costs: £4-10 per mailbox per month (Google Workspace, Microsoft 365) or £2-5/month (cheaper email hosting like Proton Mail or FastMail).
6. Analytics and Tracking Access
What it is: Tools that show how many people visit your site, where they come from, what they do.
What you should receive:
- Owner access to Google Analytics
- Owner access to Google Search Console
- Access to any other analytics platforms (Plausible, Fathom, etc.)
- Facebook Pixel access if applicable
- Any other marketing or tracking tool access
How to verify:
- Log into Google Analytics
- Verify your access level is “Owner” or “Administrator”
- Check that your email is the primary account
- Verify you can add/remove other users
Red flag: If the developer set up analytics under their own Google account and gave you “viewer” access, that’s insufficient. You should own the analytics property.
7. Third-Party Service Access
What it is: Any external services integrated with your site.
What you should receive access to:
- Payment processors (Stripe, PayPal, etc.)
- Email marketing platforms (Mailchimp, ConvertKit, etc.)
- Booking systems (Calendly, Acuity, etc.)
- CRM systems (HubSpot, Salesforce, etc.)
- Form services (Typeform, Google Forms, etc.)
- CDN/performance services (Cloudflare, etc.)
How to verify: Make a list of every integration on your site. Confirm you have admin access to each one.
8. Social Media and Brand Assets
What it is: Access to social profiles and design assets related to your site.
What you should receive:
- Admin access to any social media accounts they set up
- All logo files in multiple formats (PNG, SVG, EPS)
- Brand colour codes (hex values)
- Font files or licensing information
- Any stock photos purchased for the site with license documentation
How to verify: Check that all social media accounts list you as an admin. Download all design files and verify they’re in editable formats.
Documentation You Must Receive
Code and access aren’t enough. You need to know how things work.
9. User Guide / Documentation
What it should cover:
- How to log into the admin panel
- How to create and edit pages
- How to add blog posts or news articles
- How to update images
- How to edit navigation menus
- How to manage forms and handle submissions
- How to add or remove team members (if applicable)
- How to update contact information
Format: Written document (PDF or Google Doc) or video walkthrough. Preferably both.
Red flag: “It’s intuitive, you’ll figure it out” is not documentation. You need actual written or recorded instructions.
10. Technical Documentation
What it should cover:
- Hosting environment and configuration
- Domain DNS settings
- SSL certificate information and renewal
- Backup procedures and schedule
- Update procedures (if applicable)
- Emergency contact information if something breaks
- List of all plugins/extensions installed
- Any custom functionality and how it works
Format: Written document with clear explanations. Screenshots are helpful.
11. Maintenance Requirements
What you should know:
- How often the site needs updates (if applicable)
- What breaks if updates aren’t done
- Estimated time/cost to maintain
- Whether you can do it yourself or need help
- Backup schedule and where backups are stored
- Security monitoring (if any)
This helps you plan for ongoing costs and responsibilities.
The Handover Meeting
Don’t just receive a bunch of passwords via email. Schedule a proper handover meeting.
What Happens in a Good Handover
Duration: 30-60 minutes, screen sharing session
Agenda:
- Walkthrough - Developer shows you around the admin panel, demonstrates key tasks
- Credential handover - You receive all logins, verify they work in real-time
- Documentation review - Developer explains documentation, you ask questions
- Test edits - You make a test change while they watch and guide
- Support terms - Clarify what happens if you need help after handover
- Final questions - You ask anything unclear
Record the session: Use Zoom, Loom, or similar to record the handover meeting. This becomes reference material later.
Questions to Ask During Handover
- “What’s the most common thing clients need help with after launch?”
- “If I accidentally break something, can I undo it?”
- “Who do I contact if the site goes down?”
- “How do I know if something needs updating?”
- “What should I never touch in the admin panel?”
The Verification Checklist
Before making final payment, tick off every item:
Domain:
- Registered in my name
- I can log into registrar account
- I’m listed as all contacts in WHOIS
- Auto-renewal is set up or I know renewal date
Hosting:
- Account in my name
- I can log into hosting control panel
- I can see billing information
- I know renewal date and cost
Website Access:
- Administrator-level CMS login
- Password reset goes to my email
- I can create/edit/delete content
- I can manage users and settings
Source Code:
- Complete file download or repository access
- Database backup (if applicable)
- Design files received
- Files are in usable format
Services:
- Email account access (if applicable)
- Google Analytics owner access
- Google Search Console owner access
- All third-party integrations accessible
Documentation:
- User guide received
- Technical documentation received
- Maintenance requirements explained
- Handover meeting completed and recorded
Legal:
- All contracts fulfilled
- No ongoing dependencies on developer
- Support terms clarified
- Ownership transfer documented
If any box is unchecked, that’s a conversation before you pay.
What to Do If Something’s Missing
Scenario 1: The developer forgot
Most common. They’re busy, they overlooked something. Be direct:
“Before I make final payment, I need [specific item]. Can you provide that by [date]?”
Usually resolved quickly.
Scenario 2: The developer refuses
Red flag. This is when things get tricky.
“I understood I would own [domain/code/etc.]. Can you explain why you’re not providing that?”
If they claim it’s “proprietary” or “not included,” refer back to your original agreement or contract. If it’s in writing, you have leverage.
Scenario 3: There was no clear agreement
This is why written contracts matter. Without clear terms, it’s your word against theirs.
Options:
- Negotiate a buyout if they claim ownership
- Walk away and rebuild elsewhere (painful but sometimes necessary)
- Legal action (expensive, slow, usually not worth it for small sites)
Prevention: Always have a written agreement before starting. Include a handover checklist as part of the contract terms.
Moving Forward After Handover
Once you have everything:
Immediate tasks:
- Change all passwords to unique, strong ones
- Store all credentials in a password manager
- Set calendar reminders for domain/hosting renewals
- Make your first test content update to ensure you can
- Create a list of who to call if something breaks
Within the first month:
- Set up automatic backups if not already configured
- Test password reset processes
- Document any questions or confusion points
- Consider scheduling follow-up support session with developer
Ongoing:
- Keep documentation accessible
- Budget for maintenance or ongoing development
- Monitor domain/hosting renewal dates
- Keep credentials updated and secure
The Bottom Line
Website handover isn’t just about the site looking good and being live. It’s about receiving everything you need to own, control, and maintain your online presence independently.
A good developer wants you to be self-sufficient. They’ll provide complete handover because they’re confident in their work and they respect your business.
A bad developer creates dependencies because they want recurring revenue from holding your site hostage.
Use this checklist before making final payment. Verify you have everything. Anything missing is a red flag worth investigating before you hand over the last of your money.
You paid for a website. Make sure you actually get one.
