A new agency, a developer who leaves, a new owner: each one is a handover, even when nobody calls it that. The first problem is rarely the code. It is that nobody knows who can still get in, and some keys sit with people who no longer work for you.
No checklist makes a company completely safe, as we wrote in Total protection was always a myth. These are the five checks we run at a handover.
Who Owns the Domain
Whoever controls the domain controls the website address, the email and every password reset sent to it. Following guidance from the UK’s National Cyber Security Centre (NCSC), check that:
- The domain is managed by your company, not by the hosting company or the agency.
- It renews automatically, on a company payment method, not a personal card that will expire.
- At least two trusted people can manage it, each with their own login.
- Two-factor login is on at the registrar. For a company with one domain held with a provider, the NCSC calls this its most important recommendation.
- You have asked the registrar about a domain lock, which blocks changes until it is removed.
Who does it: the managing director or finance. Cost: the renewal you already pay, plus any fee for a lock.
The Mailbox Behind Every Reset
For each important account, check which address receives password resets and security alerts. Whoever reads that mailbox can reset the password. A former employee’s private address, or the old agency’s, is a key you do not hold.
Move every recovery address to a role address on your own domain, such as web@. Make it a group or shared mailbox that at least two named people open with their own logins. Where an account allows only one login, keep its recovery codes with the company, not on one person’s phone.
Who does it: whoever administers your email. Cost: nothing but time.
Every Account, Every Person
List every account that can change the site or touch its money:
- Domain and hosting: registrar, DNS, hosting.
- The site itself: website admins, code repository, backup storage.
- Money and orders: payment provider, shipping and ERP connections.
- Marketing: analytics, Search Console, ad accounts.
For each one, record a named owner, who has access and whether two-factor login is on. Accounts of people who left often stay active without anyone noticing. Remove former staff, freelancers and old agencies, downgrade admins who only edit content, and end shared logins. In Google Search Console, a removed owner can verify again until you delete their verification token.
Use passkeys where a service offers them: they replace the password with your device’s fingerprint, face or PIN. The NCSC has recommended them for important accounts since April 2026. Otherwise use an authenticator app, and SMS codes only when nothing else is possible.
Keep the list on one page, with the date of each review. That is your access register. Check it every quarter, and whenever someone leaves or a supplier changes.
Who does it: one named person per account, and the managing director for the register. Cost: a few hours, then a short review each quarter.
What the Old Team Knew
Removing an account does not remove a password someone copied. Change the passwords for hosting, the database, file access (SFTP) and website admin. Replace the keys that connect the site to payment, shipping, ERP and mail services. Remove any SSH keys, deploy keys and application passwords the old team added: a password change leaves them working. Do this after removing access, and plan it with whoever runs the integrations so orders keep flowing.
Who does it: your developer or provider, with one named person approving. Cost: a short planned window.
Copies and Licences Held by Someone Else
Ask where the backups live. If the only copies sit in the old agency’s account, they are its backups, not yours. Keep one copy in storage your company controls, out of the web server’s reach, and test that it restores.
If the old agency processed customer data for you, it has to delete or return that data when the work ends, at your choice. The GDPR requires your contract to say so (Article 28(3)(g)). Ask it to confirm in writing that staging copies, old servers and customer data exports are deleted or handed over.
Paid plugin, theme and extension licences belong in your company’s name. If the old agency holds one, you may not be able to renew or transfer it, and may lose its updates.
Who does it: your IT lead or provider. Cost: storage and licence fees, in your name.
What It Means for You
Two parts have to come from you: deciding who owns each account, and formally asking the previous team to hand things back. We start with the domain and the mailbox, because whoever controls those can reset everything else.
A policy says what should happen. A dated register shows that it did. If the EU’s NIS2 Directive applies to your company, its minimum list includes access control, asset management, backups and multi-factor authentication (Article 21(2)). If you supply a company that NIS2 covers, that company has to weigh the security of its direct suppliers. Your access register is a good part of your answer.
If you can tick every item, you are in good shape: run the list again next quarter. If you cannot, Sentinel, our managed security service, starts here. We review where your site stands, including access and two-factor login, and close the obvious gaps first. If you want us to look at yours, book a 20-minute call. If you do not need us, we will tell you.