Most businesses discover what they do not own at the worst possible moment. The developer has emigrated, or the relationship has soured, or the person who built it simply stopped replying. Only then does it emerge that the domain is in someone else's account and nobody has the source files.
Run this at handover, while everyone is still friendly and the invoice is still open. That is the only real leverage you will have.
Credentials you must hold
- Domain registrar login, tested by you personally.
- Hosting or deployment platform login, tested by you personally.
- Content management system administrator account in your name.
- Google Business Profile ownership, not manager access.
- Google Analytics and Search Console ownership.
- Email hosting administrator access.
- Any third party service the site depends on, such as a form handler, payment gateway or mailing list.
Files you must receive
- Source code, in a repository your business controls.
- Logo files in vector format, SVG and PDF.
- All original photographs at full resolution.
- Any purchased fonts, with the licence documentation in your business name.
- A database export, if the site uses one.
- Design files, or at minimum an exported style reference.
Documents you must have
- Written confirmation that copyright in the work transfers to you on final payment.
- A list of every recurring cost, what it is for, how much in N$, and when it renews.
- Basic instructions for the three or four things you will most often want to change.
- The backup arrangement, including where backups are stored and how to restore one.
- Named contact and response expectations for anything still under support.
Ownership of the domain and the source code are the two that matter most. Everything else can be rebuilt. Those two cannot.
Test it, do not assume it
Do not accept a list of credentials. Log into each one yourself, while the developer is still available to fix anything that does not work.
An untested password is not access. It is a note that looks like access.
