What you should receive when a website is handed over

Domain and DNS

• Registrant: your company.
• Registrar account: under a company email that more than one person can access, with two-factor authentication.
• Renewal date and payment method known.
• DNS management access, and a list of records (website, email, verification records).

See .az domain registration.

Hosting and servers

• Hosting account in your company's name, or a clear agreement if hosted by the developer.
• Server access credentials stored securely in your password manager.
• Information on server configuration, scheduled tasks and where logs are kept.

Website administration

• Administrator account in the CMS for your company, not only editor accounts.
• Separate personal accounts for each editor — no shared logins.
• Training or instructions for common tasks.

Source code

• Access to the code repository, ideally in your organisation's account.
• Instructions: how to run the project locally, how to deploy, environment variables and their purpose (not the secret values in the document itself).
• List of third-party libraries and their licences, if relevant.

Design and content

• Design files (for example Figma) with components and styles.
• Original images, videos and fonts, with licences.
• Brand guidelines, if created.

Analytics and marketing

• GA4 property and Google Tag Manager container owned by your company account, with administrator access.
• Search Console and Bing Webmaster Tools verified for your domain, with your accounts as owners.
• Ad accounts (Google Ads, Meta) in your company's business manager.
• Documentation of tracked events and conversions.

Third-party services

A list of every service the site uses — payment provider, email delivery, maps, chat, CRM integration, CDN, captcha, fonts — with who holds the account and who pays.

Email

• Email hosting access and administrator account.
• SPF, DKIM and DMARC configured. See email domain security.

Backups

• Where backups are stored, how often they run and how to restore them.
• The date of the last successful test restore.

See backup strategy.

Support and warranty

• Warranty terms for defects, if agreed.
• Support contacts, response times and the procedure for urgent issues.

Store access securely

Keep credentials in a company password manager, not in chats or spreadsheets. When staff or contractors change, revoke their access. See access management for teams.

If you did not receive these things

Ask for them now, while the relationship is good. If the developer is unavailable, registrars and hosting providers have procedures for proving ownership, but they take time. A security and access audit can map what you have and what is missing. See website maintenance.