Most website disasters trace to a botched or skipped handoff. Here’s the whole checklist — useful whether you’re the owner receiving it or the developer delivering it (and if you’re the latter: doing this well is the best referral engine there is).

The transfer list

Access: registrar, hosting, site admin (a fresh owner-role account, not a shared login), DNS if managed separately, CDN/email/analytics accounts, and any third-party services billed for the site.

Code: repository transfer or a complete export with history where possible; a README that says how to run it locally; a list of anything custom and why it exists.

Data: a current database backup, the uploads/files directory, and a demonstrated restore — a backup is a rumor until you play it back.

Knowledge: the quirks document — the cron that must run, the plugin that can’t update, the form that feeds the CRM. Twenty minutes of honest writing that saves the successor twenty hours of archaeology.

Money: which subscriptions exist, what they cost, whose card, and renewal dates — especially the domain’s.

The verification (owner’s side)

Don’t file the handoff; test it. Log into everything from your own machine. Run the restore. Confirm the card on each account is yours. Every item you don’t verify now is a rescue you fund later.

Walking away clean

Departing developer removes their admin accounts (after the owner confirms access), hands over the last invoice, and — the classy move — stays reachable for thirty days of questions. Incoming developer starts with the takeover checklist. And if you’ve received a handoff that’s mostly gaps, that’s not a handoff — that’s a rescue assessment waiting to be scheduled.