Here's a call we get a few times a month. A business owner paid for a website two or three years ago. The developer has since moved, closed shop, or just stopped answering. Now the owner needs to change a phone number, or the site went down, or the domain is about to expire, and they discover they don't have access to anything. Not the hosting. Not the domain. Sometimes not even the email tied to all of it.
They paid for the site. They don't own it. Not in any way that matters.
None of this is usually malicious. Most developers register things under their own accounts because it's faster, fully intending to sort it out later. Later never comes. The fix is simple: at handoff, you collect a specific set of credentials and documents, and you verify each one yourself before the final payment clears. This post is that list.
The principle: ownership means access, not invoices
A receipt proves you paid for a website. It doesn't prove you control one. Control means that tomorrow, with no help from the original developer, you (or anyone you hire) could log in, change anything, move the site to a different host, and renew the domain. If you can't do all of that today, work through this list until you can.
And if you're hiring a developer right now, send them this list before the project starts. A good one will nod along. A bad one will get cagey, and you just saved yourself the project.
1. The domain: the one that can kill your business
Your domain name (yourbusiness.com) is the single most important asset on this list. Lose the website and you can rebuild it. Lose the domain and you lose your email, your search presence, your business cards, and the link on every directory and review platform on the internet.
Demand and verify:
- The registrar account itself, in your name. GoDaddy, Namecheap, Cloudflare, whoever. The account email should be yours, not the developer's. If the developer registered the domain under their account, have them transfer it to an account you create. Registrars all have a formal transfer or "change of registrant" process for exactly this.
- Log in yourself and look at the expiration date. Set the domain to auto-renew on your card, not theirs. Expired domains get scooped up by resellers within days, and buying yours back is expensive when it's possible at all.
- Check the contact email on the account. Renewal warnings and security alerts go there. If it's the developer's email, you'll never see the warning that matters.
A surprising number of "my website disappeared" emergencies are actually "my domain expired and nobody saw the notices." See the SBA's guidance on protecting your business assets for the general principle: critical accounts belong in the business's name.
2. Hosting: where the site actually lives
Hosting is the server your website files sit on. Common setups for small business sites include shared hosts, managed WordPress hosts, or modern platforms like Vercel and Netlify.
Demand and verify:
- An account or login with owner-level access, not a "collaborator" seat the developer can revoke. On platforms with team features, you should be the team owner and the developer should be the guest, never the reverse.
- Billing in your name. If the developer is paying for hosting and quietly invoicing you, that's a dependency you don't want. When they disappear, the hosting bill stops being paid, and your site goes down with no warning to you.
- Log in and confirm you can see your site listed. Don't accept a screenshot. Type the password yourself.
- Know what the monthly cost actually is. Markup on hosting isn't a scandal if it covers real maintenance, but you should know the underlying number.
3. The website platform login
Separate from hosting, there's usually an admin login for the site itself: WordPress admin, Shopify, Squarespace, Webflow, or the dashboard of whatever was used.
Demand and verify:
- An administrator-level account, not an editor or contributor role. Administrator means you can create and delete other users, install or remove anything, and export your data.
- Log in and change the password yourself at handoff. This confirms the credentials work and ensures you control them from that moment on.
- A list of every other user account that exists and what level each has. Remove anyone who shouldn't be there. Departed contractors with admin access are one of the most common ways small business sites get defaced or quietly break.
4. Source files and content
If your site was custom-built (not a drag-and-drop platform), there is source code somewhere, and you should have it.
Demand:
- A copy of the full source code, ideally as access to the code repository (usually GitHub) with you as an owner on the repository or organization, plus a downloaded copy in your own storage.
- Original design files if a designer was involved: logos in vector format, the design mockups, fonts purchased for the project, and the licenses for any paid stock photos.
- A content export. Most platforms can export pages, posts, and form submissions. Get one at handoff and learn how to run one yourself, because that export is also your backup.
- Image originals. The full-resolution photos, not just the compressed versions on the site.
If a developer says the code is "proprietary" and you only licensed it, that should have been in the contract you signed, and it changes what you bought. Get clarity in writing either way.
5. Every connected account
Modern websites are wired into a half-dozen other services. Each is a small key, and you want the whole keyring:
- Google Search Console and analytics. You should be an owner on the Search Console property, not a delegated user. Google's Search Console documentation explains verification; have the developer add your Google account as a verified owner before handoff.
- Google Business Profile. This one gets missed constantly. If an agency set up or manages your profile, confirm your own Google account has primary ownership. Google has a process for adding and removing owners and managers, and the primary owner should be you.
- The contact form and email services. Whatever sends your form notifications (a form plugin account, an email service, a CRM) needs to be in your name, or at minimum documented with credentials you hold.
- SSL certificate. Usually automatic with modern hosting, but confirm nothing about HTTPS depends on an account you can't reach.
- Any paid plugins, themes, or licenses. Who bought them, when do they renew, and on whose card?
6. Documentation: the 30-minute insurance policy
Ask for one document, even just a shared doc or PDF, that covers:
- Where everything lives. Registrar, host, platform, code repository, and the email account each is tied to.
- How to do the five most common tasks. Change a phone number, update hours, add a photo, edit a service page, check form submissions. Screenshots help.
- What renews, when, and for how much. Domain, hosting, plugins, licenses.
- Who to call. If the developer offers ongoing support, what's covered and what's billed.
This document takes a competent developer half an hour to write. Its absence costs you that emergency call to a stranger at 9 p.m. when the site is down and nobody knows where it's hosted.
The handoff meeting: do it live
Don't accept handoff as a zip file and a goodbye email. Schedule 45 minutes, share a screen, and walk the list together. You log in to each account yourself, in real time, while the developer is there to fix anything that doesn't work. Change the passwords as you go. Tie everything to a business email address (info@yourbusiness.com, not a personal Gmail), because employees and contractors change, and so will you.
Then store all of it in a password manager, with at least one other trusted person in the business holding access. Owner-only credentials become nobody's credentials at exactly the wrong moment.
If you're already locked out
If you're reading this after the developer vanished: start with the domain. Use a WHOIS lookup to find the registrar, then contact that registrar's support with proof of business ownership. It's a slow process but a real one. Hosting and platform accounts can often be recovered the same way. And when you rebuild, run this checklist from day one. Our website and SEO service puts every account in your name at handoff as standard procedure, and if you want help untangling a mess before deciding anything, book a call and we'll point you in the right direction even if you never hire us.
Want a site you actually own from day one?
We build done-with-you websites live on a call, with every account created in your name while you watch. First draft in 24 hours. Live in 7 days, guaranteed. Tiers start at $500 for a Minimal site, $2,000 plus $200/mo for Standard with SEO, $3,500 plus $400/mo for Max with a 24/7 AI receptionist (the tier most trades pick), and from $6,000 for Super Max. Pay-in-4 and Klarna financing available. Veteran-owned, based in Wilmington, NC, with more than 1,500 small business sites built in the last 90 days.