A WordPress website handover should give the receiving team control of the domain, hosting and WordPress accounts, plus the source code, licence register, analytics access and a recoverable backup. Before signing off, have the receiving team use its own accounts to verify access, restore the site on staging and confirm who will respond when something breaks.
Use this checklist after launch when a client takes over a site or a new agency takes on support. Decide who will run each check and where they will record the evidence.
What should a WordPress agency hand over after launch?
Hand over an account inventory, a technical pack, a dated backup, a short editor guide and a support agreement. Store the pack where the client and authorised receiving team can find it after the project workspace closes.
Account inventory. List the registrar, DNS, hosting, WordPress, analytics, tag manager and Search Console. Include the email or CRM service that receives form submissions. Record the account controller, access level, renewal owner and recovery contact.
Technical pack. Record the live and staging addresses, WordPress and PHP versions, themes, plugins and integrations. Include the repository or agreed source-code archive, the release tag or commit that matches production, deployment steps and rollback instructions. List where authorised staff can find configuration values and secrets.
Backup and test records. Include the latest complete backup reference, the restore steps, the evidence from a staging restore and any checks that still need to pass. Record which contact form, checkout or other key journey was checked and what the reviewer observed.
Editor guide and support. Show a client editor how to update a page, preview it and correct a mistake. Include the ticket route, the person responsible for urgent issues and any open work with an owner and due date.
Give named users account invitations, enable multi-factor authentication where supported and use an approved password manager to share unavoidable secrets with authorised recipients. Keep passwords, recovery codes and API keys out of the pack and ordinary email. The pack can link to the secure location and name the person who can grant access.
Who should own the domain, hosting and WordPress accounts?
The client should usually control the domain registration and recovery contact, have a named WordPress administrator, and control hosting or have a documented exit route from agency-managed hosting. The agency can run day-to-day operations with delegated access. Check the agreed contract for exceptions such as a shared hosting account or retained code.
Ownership and access matrix
Copy this matrix into the handover pack. Replace each suggested controller with a named person or team. Give a separate owner to billing or renewals if someone else pays.
| Asset | Account controller | Sign-off evidence |
|---|---|---|
| Domain registrar and DNS | Client controls registration and recovery. Agency may manage DNS. | Client opens the domain and checks renewal details. Receiving technician views the DNS zone, including email and verification records. |
| Hosting and staging | Client or contracted managed host. | Receiving technician opens the correct hosting environment or verifies the agreed support route, backup export and exit process. |
| WordPress | Named client administrator. Agency staff have roles for agreed duties. | Client signs in with their own account and verifies the expected administrative permissions. |
| Source code and deployment | Client or agreed repository custodian. | Receiving technician opens the agreed repository or code archive and identifies the release running in production. |
| Analytics and search tools | Client controls the relevant properties and containers. | Receiving lead opens the correct Analytics property, Tag Manager container and Search Console property at the agreed access level. |
| Paid plugins | Named subscription owner and renewal payer. | Receiving team verifies the current activation and records the renewal date. |
| Backups | Named storage and recovery owner. | Receiving team retrieves the agreed backup without the outgoing agency and records a staging restore. |
Record the registrar separately from the DNS provider. Save the current DNS records and label which support the website, email and verification. For sites using Cloudflare DNS, follow Cloudflare’s DNS documentation to export the zone. Use the existing settings for an access check and schedule any actual DNS changes separately.
The WordPress roles and capabilities guide distinguishes a single-site Administrator from the Super Admin who can manage a Multisite network. Give everyday editors the permissions they need and check which account can manage the site or network. For measurement, use the Google Analytics access guide to grant and verify access at the intended account or property level.
Hypothetical access check
A client administrator signs in to WordPress and previews a draft edit. The receiving agency can see the repository and identify the release in production. It can also open the hosting panel, but the backup export still requires the outgoing agency's account.
Record WordPress access and source-code access as passed. Mark backup access as blocked, assign the hosting owner to grant the required access or provide the agreed client-controlled export, and set a retest date. Keep handover open until the receiving team can retrieve the backup and complete the staging restore. This scenario is illustrative.
How do you transfer plugin licences and document renewals?
Check each vendor's terms and record who will own and pay for the licence, which sites it covers and how updates and support will continue. For each paid plugin, theme or connected service, record the product, account holder, renewal date, price and currency, activation limits, payer and the person who can approve a change.
Agree one action for each entry. Keep the client's existing subscription and update its contact details, move the site's activation to an eligible client licence, or retain the agency's licence under an agreed care plan. If the vendor's terms require a new licence, agree the cost and timing before removing the existing activation.
For example, Elementor’s licence settings guide explains how to switch a site to a different Elementor account that already has an eligible Pro licence. Check the new activation in WordPress and confirm who will receive renewal notices in the new account. Other vendors may have different terms, including separate staging activations or bundled hosting conditions.
How can the receiving team verify backups and recovery?
Have the receiving team retrieve a dated backup, restore it into isolated staging and check that the restored site can perform the tasks it needs to support. The WordPress backup handbook explains why a complete restore needs both the database and site files.
Identify the backup. Record the backup date, storage location and retention period. Confirm the backup includes the database, uploads, themes and plugins, plus the configuration needed to rebuild. Make sure the receiving team can reach the agreed copy and obtain any required decryption key through the secure channel.
Restore to staging. Use an authorised, access-controlled environment. Disable or sandbox outbound email, payments and webhooks before testing. Keep staging separate from production and restrict who can see any restored personal data.
Check the site. Sign in to WordPress, load the main templates, confirm media appears and test a critical journey. For a lead form, verify that a staging submission reaches a test inbox or sandbox. For a store, use a sandbox checkout and check the resulting test order.
Record the outcome. Log the backup timestamp, tester, staging environment, time to restore, journey results and any failed checks. Compare the backup age and restore time against the recovery targets agreed with the client. Assign failures to an owner and retest before sign-off.
A staging restore proves the selected copy worked under the recorded conditions. Production recovery may also depend on infrastructure, DNS or external services, so document those dependencies. If handover also includes changing hosts, follow the separate guide to migrating a WordPress site for the move.
What stays in the care plan after handover?
The care plan defines who handles recurring updates, backups, restore drills, monitoring and incident response. It should also state which work needs a separate approval, such as custom development or a major upgrade.
Name the person who can approve an emergency change, the first support contact and the fallback if that person is unavailable. Put contact methods, coverage hours and response targets in writing. If the client handles routine updates and a developer handles escalations, specify where to report a failed update, what details to include and who can roll it back.
Copyable handover sign-off checklist
The client can manage domain renewal and recovery, and the incoming team can view the required DNS records.
Named users have verified hosting, WordPress, source-code and measurement access at the levels agreed.
Every paid dependency has a licence decision, renewal date and payer.
The receiving team retrieved and restored the backup, checked a critical journey and saved the restore log.
The client editor completed a practice edit, and both teams have the handover pack and escalation contacts.
Both sides have recorded sign-off, owners and dates for open items. Former access has been removed or scheduled for removal once successor access is verified.
For work that needs an assigned technical owner, see Nozentra's WordPress development and support, website maintenance or agency partnership options.
