Changing Website Supplier? Keep Control of the Keys

Do not assume that receiving a website backup transfers the domain or subscriptions. Each service has its own account, billing and change process. List the essential services and confirm the authorised transfer method with the provider.

The ENISA SME guide encourages clear responsibility and planning. A website handover turns that general advice into a practical continuity checklist. It is not a replacement for contract review or a complete business-continuity programme.

Keep the record useful to the next developer. Describe where enquiry messages go, how bookings or orders are handled and which services must remain active. Record any scheduled tasks and their purpose without placing secret credentials in the document.

For a fictional local service business, the handover pack identifies domain renewal, the hosting account, the form provider and the booking integration. It records who approves changes and how to contact the relevant supplier. This example is not a Digital Bridge client result.

Do not remove the previous supplier before the new owner can recover the account and operate the site. Equally, do not leave unrestricted old access indefinitely. Set a clear completion point, then remove or reduce access according to the ongoing agreement.

Check the recovery email and phone number before changing account permissions. A technical transfer can appear successful while the old supplier still controls the only recovery route. Treat recovery as part of ownership, not an afterthought.

Agree a restoration test in an appropriate environment. Check that forms, permissions and business functions behave correctly after restoration. Protect copied customer data during testing and minimise unnecessary duplication.

The NCSC SME advice includes backups as a basic safeguard. Applying that advice during handover helps distinguish a recovery plan from a folder labelled backup.

Test essential journeys before and after the agreed transition. For a shop, this includes controlled order and payment tests; for a service business, it includes enquiry delivery and booking. Inform staff of the cutover window and give them a clear route to report problems.

Record the result and any remaining dependency. If a licence cannot be transferred, agree how it will be replaced before ending support. Keep contractual issues separate from technical guesses.

A handover scope should state the accounts, files, permissions and checks included, along with exclusions and ongoing subscriptions. The useful outcome is operational control with a documented next step. If a system requires legal, compliance or independent security assurance, name that requirement separately before the transfer begins.

No. Domain registration is a separate account and service. Confirm its ownership and transfer process separately.

No. Use provider-supported account transfer and an appropriate secure credential-sharing process.

After the agreed transfer and recovery checks are complete, remove or reduce access according to the ongoing contract.