Taking Over a Website from a Previous Developer
Transitioning vendors does not have to result in downtime or lost code. Here are the 8 non-negotiable digital assets your company must possess before signing off.
Do not notify the outgoing vendor until assets 01 to 05 are secured.
The single most common mistake Malaysian SMEs make is sending an angry termination email while the agency still controls the domain, DNS, and hosting server. Secure your database and registrar control quietly before having the termination conversation.
Domain Registrar Master Account
Ensure the domain is registered with a reputable registrar (MYNIC, Exabytes, Shinjiru, Cloudflare, Namecheap) under your official SSM corporate name and email, not the agency's personal account.
DNS Management & Zone File Export
Secure direct administrative access to where your DNS records live. Request an export of your current DNS Zone File so your business email, MX records, and verification TXT tags are never interrupted.
Cloud Hosting & Server Control Panel
Obtain the primary billing login and root/admin credentials for your hosting environment (cPanel, AWS, Google Cloud, DigitalOcean, or Railway). You must control the billing credit card directly.
Complete Git Source Code Repository
Do not accept a simple ZIP file of compiled code. Insist on a transfer of the Git repository (GitHub, GitLab, or Bitbucket) containing the full revision history, branch records, and commit logs.
Unencrypted Database Dump & Uploads
Demand a clean, unencrypted SQL database export taken while the site is in a stable state, alongside an archive of all customer-uploaded media files, documents, and assets.
Deployment Pipeline & Environment Secrets
Ask for documentation on how the site is deployed (build scripts, Dockerfiles, webhook URLs) and a secure inventory of environment variables (.env files) without hardcoded third-party passwords.
Payment Gateway & Third-Party API Keys
Ensure all merchant accounts (Curlec, Billplz, Stripe, DOKU, LHDN MyInvois) and transactional services (Resend, SendGrid) are registered under your business registration number, not the developer's.
Google Search Console & Analytics Primary Owner
Verify that your company Google account is listed as a Verified Owner in Search Console and Administrator in Google Analytics 4. An agency should only ever hold delegated User permissions.
Handover & Takeover FAQs
When should I tell the agency we are terminating their services?
NEVER announce contract termination before securing assets 01 through 05 in your own possession. Once a vendor knows they are being terminated, cooperation often drops to zero, and obtaining database exports or repository transfers becomes significantly harder.
What if the developer claims they own the intellectual property (IP)?
Under Malaysian law, unless your development agreement explicitly transferred IP upon payment, copyright in custom code can technically default to the creator. However, standard contracts state that upon full settlement of invoices, all client assets and code belong to the client. Having paid invoices is your primary proof of ownership.
How long does a professional takeover take?
A standard technical handover takes 5 to 10 business days when the vendor is cooperative. If access must be recovered through hosting providers and registrars directly, allow 2 to 4 weeks.
Let JagaWeb Audit Your Handover Package
We review the repository, inspect the server, test backup restoration, and give you a written verification report before you make final vendor settlement.