Before work begins, agree who controls each account, who can make changes and who handles the renewal. “The website is yours” needs a more specific explanation.
Separate the accounts
Your domain is the address. Hosting serves the website. Business email can use another provider. A content editor, payment provider or booking tool may have another account again. One person managing the setup does not make these the same service.
For each account, record the provider, named customer, recovery contact, billing responsibility and people who need access. Use a business-controlled recovery route where possible. A developer should not be the only person able to recover an important business account.
Use a responsibility sheet
| Item | Decision to record |
|---|---|
| Domain | Registrant details, account controller and renewal owner |
| Hosting | Account owner, operator and recovery process |
| Administrator, billing and recovery contact | |
| Paid tools | Licence holder, access, renewal and export options |
Give access for the work
Use a provider’s separate-user or delegated-access feature when it is available and appropriate. Agree what access the developer needs and when to remove it. Avoid sending passwords in an initial project message or putting them into a shared brief.
Some services have a single-user account or limited delegation. That needs an explicit access arrangement rather than an assumption. Provider procedures differ; check the actual product before following a transfer or recovery instruction.
Check what can move
Website files, content, a registered domain and a third-party licence are different things. Some subscriptions belong to an account or cannot simply be transferred. Ask what you receive, what stays with the provider and what would need to be replaced if support ends.
Record the source files or repository, an export if relevant, the renewal schedule and any ongoing dependencies. Keep recovery information in a suitable password manager or other agreed secure location, not in a public project document.
Return to the sheet after changes
When a member of staff leaves, a developer changes or a provider moves, review access and recovery contacts. A handover is incomplete if the business can open the website but cannot manage its essential accounts.
Use the handover checklist and the delivery review guide to separate account control from checking the finished website.
Written by VikaSquare for business owners and office teams. Illustrations and checklists are practical planning aids. Professional permissions and sensitive-data requirements need their own review.