The website handover checklist for agencies
A client is moving on, or taking their site in-house. Here's how to hand over every login cleanly, safely and professionally.
ClientKeeps team · · 2 min read
Not every client stays forever. When one moves to another agency or takes their website in-house, a clean handover protects them and you. It's also the last impression you leave.
Before the handover
1. Collect everything in one place. Open the client in ClientKeeps and check you have every login: domain, DNS, hosting, FTP, WordPress, email, analytics. Fill gaps now; afterwards it's harder.
2. Find out who owns what. Domains and hosting should be in the client's name, on accounts they control. If any are in your agency's name, plan the transfer first. Domain transfers can take days.
3. Agree a date. Pick the day access changes hands, and tell your team.
On the day
4. Change the passwords that matter. Change the main passwords (domain, DNS, hosting, WordPress admin) to new generated ones before handing them over, so old copies stop working.
5. Hand over securely. Never email passwords. Send each login as an external link that expires, with a passphrase you tell the client by phone. When it expires, it opens nothing.
6. Move two-factor codes. If the client's accounts use two-factor codes stored in your vault, help the client set up their own authenticator, then remove yours.
7. Remove your agency's users. Delete your team's WordPress users, hosting sub-accounts and DNS access, or ask the new agency to do it once they're in.
After the handover
8. Delete the client. In ClientKeeps, a deleted client goes to the Trash for 30 days, so you can still restore it if something was missed. The audit log keeps the record of who did what.
9. Check the audit log. Make sure nobody opened the client's logins after the handover date.
10. Say thank you. A short note confirming what you handed over, and that your access is removed, goes a long way. Many clients come back, or send friends.
Why it matters
A messy handover leaves your agency holding passwords to a site you no longer look after. That's a risk with no upside. A clean one takes an hour and leaves everyone safer, and it shows the kind of agency you are.
