# Changing Website Supplier? Keep Control of the Keys

A secure website handover gives the business usable control of its domain, hosting, website and essential integrations. Irish SMEs should confirm ownership, recovery routes, licences and a tested restoration process before ending an old arrangement. Digital Bridge in Gorey explains what to request without exposing passwords or interrupting customer services.

Written by Joey Bray, Founder & Lead Strategist, Digital Bridge. [Author profile](/about/joey). Last updated: 8 November 2026.

## What should the business control before changing supplier?

Begin with the domain registrar, hosting and website administrator account. Confirm the legal or billing owner and the recovery contact for each. A supplier may manage the service for you, but the business should understand how it retains access and what its contract permits.

Do not assume that receiving a website backup transfers the domain or subscriptions. Each service has its own account, billing and change process. List the essential services and confirm the authorised transfer method with the provider.

The [ENISA SME guide](https://www.enisa.europa.eu/publications/cybersecurity-guide-for-smes-12-steps-to-securing-your-business) encourages clear responsibility and planning. A website handover turns that general advice into a practical continuity checklist. It is not a replacement for contract review or a complete business-continuity programme.

## Which documents and records should you request?

Ask for a current inventory of the CMS, theme, plugins, custom features and integrations. Request renewal dates, licence ownership and known support limitations. For custom work, confirm the source-code and documentation rights in the agreement rather than assuming everything is automatically included.

Keep the record useful to the next developer. Describe where enquiry messages go, how bookings or orders are handled and which services must remain active. Record any scheduled tasks and their purpose without placing secret credentials in the document.

For a fictional local service business, the handover pack identifies domain renewal, the hosting account, the form provider and the booking integration. It records who approves changes and how to contact the relevant supplier. This example is not a Digital Bridge client result.

## How should credentials and access be transferred?

Use provider-supported ownership changes and individual accounts where possible. Transfer secrets through an appropriate secure process, not a public link, shared spreadsheet or email thread containing every password. Agree when credentials should be rotated and test the resulting access.

Do not remove the previous supplier before the new owner can recover the account and operate the site. Equally, do not leave unrestricted old access indefinitely. Set a clear completion point, then remove or reduce access according to the ongoing agreement.

Check the recovery email and phone number before changing account permissions. A technical transfer can appear successful while the old supplier still controls the only recovery route. Treat recovery as part of ownership, not an afterthought.

## What do you need to know about backups?

Confirm what the backup includes: files, database, uploads and any external information essential to operation. Ask where it is stored, who can access it and how restoration is performed. A downloaded archive is not proof that a working website can be recovered.

Agree a restoration test in an appropriate environment. Check that forms, permissions and business functions behave correctly after restoration. Protect copied customer data during testing and minimise unnecessary duplication.

The [NCSC SME advice](https://sme.ncsc.gov.ie/advice/) includes backups as a basic safeguard. Applying that advice during handover helps distinguish a recovery plan from a folder labelled backup.

## How do you avoid interruption during the change?

Plan the order of changes and the expected impact. DNS, email, hosting and application migrations can affect different services. Ask for a rollback plan and identify the person who can authorise it. Do not change unrelated records simply to tidy the account.

Test essential journeys before and after the agreed transition. For a shop, this includes controlled order and payment tests; for a service business, it includes enquiry delivery and booking. Inform staff of the cutover window and give them a clear route to report problems.

Record the result and any remaining dependency. If a licence cannot be transferred, agree how it will be replaced before ending support. Keep contractual issues separate from technical guesses.

## What does Digital Bridge's handover approach cover?

Digital Bridge builds websites and custom business platforms from Gorey, Co. Wexford. Printhouse's web-to-print platform is a verified example of development work, not a claim that an independent security certification was completed.

A handover scope should state the accounts, files, permissions and checks included, along with exclusions and ongoing subscriptions. The useful outcome is operational control with a documented next step. If a system requires legal, compliance or independent security assurance, name that requirement separately before the transfer begins.

## What is the next step for your website?

[Get an instant estimate](/#ai-estimator) or [discuss a scoped website security review](/contact). Call [085 224 1848](tel:+353852241848) or [email Digital Bridge](mailto:info@digitalbridge.ie). Scope and responsibilities are agreed before work starts. For an example of our development work, see the [published portfolio](/our-work).

Read our [website security service](/website-security-ireland), [Irish SME security overview](/blog/small-business-website-cyber-security-ireland), or [professional website services](/services/professional-websites).

## Frequently asked questions

### Does a website backup include my domain?

No. Domain registration is a separate account and service. Confirm its ownership and transfer process separately.

### Should I share every password by email?

No. Use provider-supported account transfer and an appropriate secure credential-sharing process.

### When should the old developer’s access end?

After the agreed transfer and recovery checks are complete, remove or reduce access according to the ongoing contract.