A practical checklist for business owners who need control of their domain, DNS, hosting, WordPress and measurement accounts before changing supplier.
Short answer
Before you switch agency, confirm that your business—not an individual contractor—can access and control every account that keeps the website online. The minimum set is the domain registrar, DNS, hosting, WordPress administrator access, email delivery, analytics, Search Console, tag management and verified backups. Record who owns each account, which email receives recovery messages, what can be transferred, and what must be recreated. Do this before cancelling a service or changing credentials.
You may be ready to redesign your website but unsure which account holds the domain or who receives its renewal notices. That uncertainty is common during a supplier change. An access audit turns it into a practical list of accounts to verify before the transition begins.
Why an ownership audit matters
A website is not one login. It is a chain of services. The domain points to DNS; DNS points visitors and email to the right services; hosting stores the site; WordPress manages content; analytics and Search Console record performance. Losing access to one link can delay a redesign, interrupt email, block renewal, or make a security incident harder to contain.
An audit is not an accusation against the current supplier. It is basic business continuity. A good handover gives the incoming team enough access to inspect the current setup without exposing unnecessary personal data or weakening security.
1. Confirm the domain registrant and registrar account
Start with the domain name because it controls how people reach your website and often supports business email and service verification.
Check:
- the registrar company and the exact account used to manage the domain;
- the registrant or account holder is the business or an authorised representative;
- the recovery email and phone are current and controlled by the business;
- the expiry date and renewal method are understood;
- the transfer lock and authorisation-code process are documented;
- the nameservers currently in use are recorded before any change.
ICANN advises registrants to keep contact information current so they receive important notices. It also explains that renewal, transfer and account-access issues are handled through the registrar or reseller. Do not move the domain merely to make the audit look complete. First prove access, record the current configuration and plan any transfer separately.
2. Map DNS before touching it
DNS changes can affect the website, email, verification records and third-party services. Export or copy the current DNS zone and label the purpose of each record. At minimum, identify the website records, mail records, SPF/DKIM/DMARC entries, verification records and any subdomains used by applications.
Do not delete unfamiliar records during a handover. A record that looks unused may support email delivery, a booking system or a verification token. If ownership must change, duplicate the verified configuration in the new DNS account, lower risk through a planned change window, and keep rollback information.
3. Verify hosting ownership and recovery access
Confirm where the live site is hosted, who receives billing and security notices, and which account can open support requests. Record the primary domain, server or plan name, PHP version, SSL management, backup method and any staging environment.
The business should be able to:
- access the hosting control panel or an appropriately scoped collaborator account;
- request support without relying on a former supplier;
- download or restore a complete backup;
- identify where outgoing website email is configured;
- distinguish the production site from staging or archived copies.
A hosting login alone is not proof of recoverability. WordPress guidance notes that a full restoration needs both the database and the site files. Ask when the last backup completed, where it is stored, how long copies are retained, and whether a restore has been tested.
4. Review WordPress users and privileges
Create a current list of WordPress users, roles and business purpose. WordPress includes predefined roles with different capabilities; Administrator access is powerful and should not be shared casually.
For a supplier transition:
- keep at least one business-controlled Administrator account;
- create named accounts for incoming people instead of sharing one password;
- give the least privilege needed for the task;
- remove or downgrade old accounts only after the handover is complete;
- confirm that recovery email addresses belong to the correct people;
- document any security plugin, two-factor authentication or single sign-on dependency.
Never paste passwords into a handover document. Use the account’s secure invitation or password-reset workflow. If a former administrator might still control hosting or verification files, removing the WordPress user alone is not enough.
5. Check analytics, Search Console and tag ownership
Measurement accounts should survive a supplier change. Confirm the organisation has an owner or administrator in:
- Google Analytics;
- Google Search Console;
- Google Tag Manager;
- advertising accounts that use website conversion tags;
- consent-management or call-tracking tools, if used.
Google explains that Search Console owners have full control. Search Console also warns that removing all verified owners can eventually remove access for delegated owners and users. Record the property type, verified owners and verification method before changing a DNS record, HTML file or tag.
Do not assume a dashboard screenshot proves ownership. Test that the business account can open settings, view users and export the data it is authorised to keep.
6. Separate website email from personal inboxes
List the mailboxes or services used for contact forms, order notifications, password resets and system alerts. Confirm which sender address WordPress uses and how messages are authenticated. A website can appear healthy while form mail silently fails.
During transition, send a controlled test from every public form and confirm:
- the success message appears;
- the message reaches the intended inbox;
- reply-to information works;
- spam handling does not hide the message;
- no private test data is left in screenshots or tickets.
7. Record licences, integrations and external services
Build an inventory of premium themes, plugins, fonts, image licences, APIs, payment gateways, booking tools, CRM connections and CDN or security services. Mark each as business-owned, supplier-owned, transferable, replaceable or unknown.
Do not copy a supplier’s licence key or private account. If a tool is tied to the old supplier, decide whether the business needs its own licence, an alternative, or removal. Make the decision before the old account is disconnected.
8. Secure the transition
Plan the change in this order:
- make and verify a current backup;
- record the current domain, DNS, hosting and WordPress state;
- create named accounts for the incoming team;
- confirm analytics and Search Console ownership;
- test forms, email, checkout or other critical journeys;
- change credentials and remove obsolete access;
- monitor uptime, security alerts and business-critical functions.
WordPress hardening guidance recommends a tested backup and secure administrative connections. Use multi-factor authentication where available, avoid sending credentials in email or chat, and keep an audit trail of access changes.
A compact ownership matrix
For each service, record:
- service name and URL;
- business owner;
- technical owner;
- recovery email;
- current access status;
- renewal or billing contact;
- transfer or closure plan;
- last verified date;
- evidence location.
Status values such as CONFIRMED, PARTIAL, UNKNOWN and TRANSFER REQUIRED are more useful than assuming a blank cell means there is no problem.
Common handover mistakes
The most common failure is cancelling hosting or an agency agreement before access and backups are verified. Other avoidable mistakes include changing nameservers without copying mail records, sharing one administrator login, deleting verification files, assuming a plugin licence can be transferred, and testing only the homepage.
A complete audit does not mean every account must be moved. It means the business understands who controls each dependency and has a safe plan for anything that must change.
What to ask the incoming web team
Ask for a written access list, a risk-ranked transition plan and a rollback path. The team should explain which changes are necessary, which can wait, and what evidence will confirm success. They should also separate website ownership from ongoing care: taking control of the accounts is not the same as choosing a maintenance scope.
Frequently asked questions
Should the business own the domain account?
The business should have durable, authorised control of the domain registration and recovery path. A supplier can manage technical settings, but the organisation should not depend on a former contractor to renew or recover its domain.
Can the old agency keep an Administrator account?
Only if there is an active, documented reason and the access is still authorised. Otherwise remove or downgrade it after backups, ownership checks and the transition are complete.
Is a WordPress export a full backup?
No. A content export is useful, but a full recovery normally requires the database and site files, plus knowledge of external services such as DNS, email and storage.
Do we need to move every service immediately?
No. Proving ownership and documenting dependencies comes first. Move only what has a business reason, a tested plan and a rollback route.
Plan your handover with a clear access list
If you need help mapping the current setup, discuss your website transition. We can review the dependencies and the work needed before a redesign or provider change. For continuing support, explore website care and hosting.
