Website Handover Checklist
Never release your agency's final milestone invoice until every one of these 8 digital assets is verified in your company's direct possession. Interactive tool with verification tests and pre-written vendor copy scripts.
Domain (.com, .my, .com.my) registered strictly in your company SSM name with your direct corporate billing email.
If the developer registers the domain under their personal name or agency account, they legally control your brand identity and can hold your traffic hostage.
Run a WHOIS lookup or login to MYNIC / GoDaddy / Namecheap. Confirm your corporate email is listed as Registrant Contact and you have access to obtain the EPP/Auth transfer code.
Hi [Agency], please initiate the domain registrant transfer of [ourdomain.com] to our corporate registrar account at [Registrar], or update the Registrant Admin email to [director@company.com].
Direct administrative control over nameservers and DNS records (A, CNAME, MX, TXT, SPF, DKIM).
Without DNS control, you cannot redirect traffic, migrate servers, or configure corporate Google Workspace / Microsoft 365 business email.
Log in to your Cloudflare or registrar DNS dashboard. Confirm you can view, edit, and add DNS records without requesting developer permission.
Please transfer primary account ownership of our Cloudflare DNS zone for [ourdomain.com] to our corporate email [it@company.com], or provide current DNS management dashboard credentials.
Master administrative access to VPS, AWS, Cloud Run, DigitalOcean, cPanel, or managed hosting provider.
If hosting is under an agency shared reseller plan, you cannot access raw server configurations, monitor resource spikes, or migrate independently.
Log in to the server control panel. Verify you can access billing settings, view active PHP/Node.js runtimes, and inspect disk usage.
Please provide master cPanel / AWS IAM / DigitalOcean access credentials for our web server, or transfer the cloud project/droplet to our company billing account.
Highest tier administrator user account in WordPress, Shopify, Strapi, or headless CMS dashboard.
Agencies often assign clients 'Editor' or limited 'Admin' accounts, blocking plugin installations, theme edits, and user permissions management.
Log in to WordPress/CMS. Go to Users and confirm your role is 'Administrator'. Verify you can access Plugins, Settings, and User Management tabs.
Please promote our user account [admin@company.com] to full Super Administrator in the CMS, and remove any former contractor accounts that no longer require access.
Organization ownership on GitHub, GitLab, or Bitbucket containing the clean repository and version history.
Without Git history, future engineers cannot see how features were built, security audits become difficult, and you cannot deploy updates safely.
Clone the Git repository to a clean machine. Run the build command (e.g. `npm run build` or composer install) to ensure it compiles without missing dependencies.
Please invite our company GitHub organization [org-name] as Admin owner of the website repository, and confirm all proprietary modules and environment templates (.env.example) are committed.
Unencrypted SQL or NoSQL database dump along with server automated backup access.
If the server crashes during handover or an invoice dispute occurs, losing the database means losing all customer accounts, transactions, and historical data.
Download the `.sql.gz` dump file. Open in a local staging database tool (e.g. TablePlus or phpMyAdmin) to verify table structure and user tables are intact.
Please generate and deliver a full unencrypted database backup (.sql.gz) along with the media uploads directory (/wp-content/uploads or GCS bucket dump).
Primary verified ownership of GA4, GTM, and Google Search Console properties.
Historical traffic data, conversion attribution, search query rankings, and penalty notifications remain locked with the old agency if ownership is not transferred.
Open Search Console > Settings > Ownership Verification. Confirm your corporate Google Account is listed as a Verified Owner, not just a Delegated User.
Please add [seo@company.com] as verified Owner in Google Search Console and Administrator in Google Analytics 4 & Google Tag Manager, then remove unused agency delegates.
Direct ownership of commercial plugins, premium font licenses, SSL certificates, and Malaysian payment gateways (Curlec, SenangPay, Stripe).
Expired commercial plugin keys break automated security updates, leaving your website vulnerable to zero-day CVE exploits.
Check plugin update dashboards. Confirm licenses are registered to your company email or lifetime keys are provided with receipt of transfer.
Please provide an itemized list of all active commercial plugins, third-party API keys (Google Maps, Mailgun, Payment Gateways), and transfer active license subscriptions to our billing email.
Related Guides & Crisis Playbooks
Facing difficulties getting your assets transferred? Consult our dedicated playbooks:
Developer Takeover Guide
Complete protocol for migrating from an uncooperative developer.
Read Guide →Domain Hostage Recovery
MYNIC and ICANN dispute steps when a vendor withholds your domain.
Read Guide →Takeover Cost Breakdown
Understand the realistic costs of auditing, remediating, and maintaining legacy code.
View Pricing →Frequently Asked Questions
When should this handover checklist be completed?
Complete this checklist BEFORE paying the final milestone invoice (typically the final 10%–20% retention fee). Once final payment is made, agency responsiveness often drops dramatically.
What if the developer refuses to hand over the source code?
Under Malaysian contract law, if you paid for custom bespoke development without explicit written retention of title clauses, the resulting intellectual property belongs to the buyer. Review our detailed playbook on taking over websites from previous developers.
Can JagaWeb perform this handover verification for us?
Yes. We conduct Independent Website Ownership Reviews for RM1,500. We audit all 8 digital assets, inspect hosting, scan repository code quality, and issue an executive certificate of ownership.
What should I do if my developer has already gone missing?
If your developer has disappeared or stopped responding, visit our Website Rescue Hub for emergency triage steps, including ICANN/MYNIC domain recovery and database retrieval.
Need Us to Secure Your Digital Assets Directly?
Skip the back-and-forth tension with your agency. Our senior engineers conduct a comprehensive RM1,500 Independent Website Ownership Review. We obtain and verify all 8 assets, remediate vulnerabilities, and hand you a clean certificate of ownership.