At the end of a website project you should hold your domain, your hosting account, a copy of the source code, every admin login and the rights to use what was built, and your contract should say so in writing.
Most owners never ask, because the launch is exciting and the question feels awkward. The cost shows up two years later, when the agency has closed, the freelancer has gone quiet or the relationship has soured, and nobody can find the password.
This website handover checklist covers what to ask for, how to check you have got it, and what the law says about who owns the work. It is one part of our wider guide to choosing a web design agency in the UK.
Who owns a website the agency built?
By default, the person who creates the work owns the copyright, not the person who paid for it, unless a contract says otherwise.
The government's guidance on copyright ownership is direct. For work done by a contractor, the creator, not the commissioner, is the first owner unless you agree otherwise in writing. If the contract is silent, a court may imply a limited licence to use the work for the purpose it was commissioned, which falls short of owning it.
That means the sentence you need in the contract is short: ownership of the code, designs and content created for the project transfers to you on payment in full. Where an agency uses its own reusable components, ask for a licence that lets you keep using them, with no end date and no fee.
Our guide to reading an agency contract shows where these clauses usually sit.
What does it look like when it goes wrong?
It looks like a business owner with a live domain and no way to get at the site.
A thread on UK Business Forums shows how it happens. A small business owner found their site had been removed by their designer, who hosted it on his own server. One reply asked a question every owner should be able to answer, whether you have control over your domain name.
Another pointed out that a designer with control of the hosting "could terminate it whenever he chose". A third added that even if a backup existed, it might not work for another developer "as the platform wasn't properly supported".
The thread is from 2015, and the pattern has not changed. The remedy is simple and cheap if you ask at the start: put the accounts in your name from day one.
What should be on a website handover checklist?
Ten items belong on the list: domain, hosting, source code, admin accounts, content and media, licences, analytics and search accounts, redirects, documentation and a short training session.
1. The domain, registered in your name
You should be the registrant of your domain, with your own email on the account. Ask for the registrar login or for a transfer into an account you control. If the agency bought it on your behalf, find out whose name and email are on the registration.
A domain held in the agency's name is the commonest single cause of a hostage situation.
2. The hosting account
Hosting should sit in an account you own, or in a clearly separated space you are named on. If the agency hosts multiple clients on one server, ask what happens to your site if you leave and how you would get a copy. Check the renewal date and who receives the invoices.
3. The source code
For a custom build, you should receive access to the code repository, for example on GitHub, plus the build and deployment instructions. For WordPress, you want the theme, any custom plugins and a full backup of files and database. Put the repository in your organisation's account, and add the agency as a collaborator, not the other way round.
4. Every admin login
Collect logins for the content management system, the hosting panel, the domain registrar, the database, email accounts tied to the site, form-handling tools, payment accounts and any third-party service. Use a password manager and shared vaults, not a spreadsheet in an email. Remove the agency's admin accounts when support ends, or downgrade them to the minimum.
5. Content and media
Ask for all text, images, videos, PDFs and downloadable files in their original formats, in a folder you hold. Good agencies add the original photography and the source design files. If you paid for stock images, get the licence details with them.
6. Licences for themes, plugins, fonts and images
Premium themes, plugins, fonts and stock photos come with licences, and many are tied to the buyer's account. Ask for a list of every paid component with the licence key, the renewal date, the cost and whose name it is in. If a licence is in the agency's name, get it transferred or replaced before launch.
7. Analytics, search and tracking accounts
Your Google Analytics property, Search Console, Google Business Profile and advertising conversion tags should all list you as the owner. Check that you are an owner and not just a user, because only owners can add or remove other people. Agencies should be added as users with the rights they need.
8. The redirect map
If the project replaced an old website, ask for the list of old addresses and where each now points. Google's site move guidance says redirects should be kept for as long as possible, generally at least a year. You need the list to check this at six and twelve months. Our checklist in why redesigns lose traffic for three months explains why.
9. Documentation
A few pages are enough: how the site is built, where it is hosted, which services it depends on, how to deploy a change, how to restore a backup and who to call. Ask for a short list of integrations and what each does, including bookings, payments and email.
If you plan to add tools later, our article on booking, quoting and payment integrations shows what to expect.
10. A training session
An hour with the person who will edit the site, recorded so new staff can watch it. Cover how to edit a page, add an image, publish a post, change a form recipient and what not to touch.
How do you check the handover is complete?
Test it: log in to everything yourself, restore a backup to a test location and ask someone outside the project to follow the documentation.
Log in to the registrar, host and CMS from your own computer, and read the account holder's name on each. Change one line of text on a staging copy. Ask for the backup to be restored somewhere else, to prove it works.
Put the renewal dates for domain, hosting, SSL certificate and paid licences in a shared calendar, with a reminder a month before each.
If the agency resists any of that, treat it as information about how a future disagreement would go.
What should the contract clause say?
A good clause names the items, the timing and the condition, so nobody has to argue about it later.
A workable version reads along these lines: on receipt of final payment, the agency assigns to the client all copyright in the code, designs and content created for the project, grants a perpetual licence to any reusable components, and delivers the items listed in a schedule within seven days.
The schedule then lists the domain, hosting, repository, logins, content and licences. Have a solicitor check the wording for your situation, since this is a sketch and not legal advice.
Two details matter. Tie the transfer to payment in full, which is fair to both sides. And list the third-party tools by name, so the agency cannot say later that a paid plugin was outside the scope.
What if the agency will not hand things over?
Start with the contract, then ask in writing, then escalate in proportion to what is at stake.
Check what the agreement says about ownership and delivery. Write a short email listing exactly what you want, with a date. Most disputes end there, because the request is reasonable and the agency has more to lose from a quarrel than from a transfer.
If it does not, a solicitor's letter often resolves the rest. Keep copies of invoices showing you paid for the work.
If you cannot get at the site at all, you may need to rebuild from the live pages, which is slower and costs more. That is the reason to ask for the handover while the relationship is good.
What about ongoing support?
Handover does not mean the end of the relationship. It means you can choose.
You may still want the agency to update the site, patch security issues and fix faults. If so, agree what that covers and what it costs, which is the subject of our guide to hosting, security and maintenance on a £50 a month plan.
Put response times in writing, and keep the right to move to another provider. The same principle appears in our guide on what happens when you leave an agency.
For a professional services firm whose site carries regulated information or client data, add one more item to the list: who is responsible for data protection on the site, and where the data is stored.
Ask before you sign
Put the checklist into the proposal stage, not the end of the project. It is far easier to agree ownership before the work than to ask for it after the final invoice.
If you would like a handover plan written into your next website project, our website design service covers handover as well as the build, and you can contact us to see how it looks in practice.
