A business can pay for a website and still struggle to answer basic operational questions. Who controls the domain? Where is the hosting account? Who receives renewal notices? Can the business export its records? What happens if the person who set everything up is unavailable?
These questions are easier to resolve during the project than during an outage or a change of supplier. They belong in the delivery conversation alongside design, functionality and the launch date.
Know where the important accounts live.
List the services the platform depends on: domain registration, hosting, business email, payment providers, source repositories, analytics and any other connected tools. Record the accountable business owner, billing responsibility and recovery route for each. Keep credentials in an appropriate password manager rather than placing them in a shared project document.
Distinguish access from contractual ownership. A technical handover can demonstrate who can administer an account, but it does not settle every question about intellectual property, licensing or supplier terms. Those points should be explicitly agreed in the relevant contracts, with suitable professional advice where needed.
Match access to each person’s job.
A content editor, support employee and platform administrator may need different permissions. Shared all-powerful accounts make it harder to understand who changed something and harder to remove access cleanly when a role changes. Ask the team to explain the permission model using the business’s actual responsibilities.
The NCSC’s account-security guidance is a useful reference for stronger sign-in protection and recovery preparation. Access arrangements should protect important accounts without making the business dependent on one person’s private device or personal inbox.
Know what can be exported and restored.
Ask what records the business can obtain, in what format and with which relationships preserved. A list of customer names may be inadequate if the useful history sits in orders, attachments or status changes. Request a small, non-sensitive example of the export process and clarify what is outside it.
Backups answer a related but different operational question: how to recover after something goes wrong. Agree what is covered and how restoration is checked. Avoid treating an untested copy as a complete recovery plan, especially when several services contribute to the same workflow.
Who is responsible after handover?
OWASP’s Top 10 provides a recognised starting point for understanding common web-application security risks. It is an awareness resource, not a certificate that a platform is secure. The project still needs appropriate implementation, review and an owner for ongoing issues.
Before closing the project, have an authorised person from the business check the account register and recovery arrangements with the delivery team. Confirm that the instructions are usable, not simply that a document was sent. Record any missing access or supplier dependency while the people who can resolve it are still involved.
Read further
Original sources behind the technical guidance in this article.