Changing the company that maintains your website is safe if you take control of the domain, hosting, email, CMS panel and third-party service accounts before you terminate the contract. Business owners are usually afraid of three things: losing the domain, the mailboxes or access to the panel.
None of them has to happen. You just need to take over access in the right order. Below is a checklist, from the most important matters down to the details. And one caveat: this is not about judging the previous contractor. It is about your company holding everything that belongs to it.
Table of contents
Who owns the domain and how do you check it?
The domain owner is the domain name holder (the registrant) listed with the registrar, not the company that handles it technically. That registrant should be your company. Not the agency and not one of its employees (and yet it happens, for example when a freelancer registered the domain “in a hurry”). Ask for access to the registrar account, or at least for confirmation of the registrant details.
For global domains such as .com, the ICANN rules for domain name holders guarantee the right to transfer a domain to another registrar. But watch out: after a change of the registrant’s name, organization or email address, the transfer can be locked for 60 days. .pl domains fall under the NASK registry, and the transfer is carried out by the registrant and the registrar. Why start with the domain? Because both the website and the email depend on it.
Hosting and panel access: what you need to have in hand
You need your own account with the hosting provider or a complete set of administrative credentials. FTP alone is not enough. The list should include:
- the hosting panel login,
- FTP or SFTP and SSH credentials (remote access to the server),
- database access,
- management of the DNS zone, meaning the settings that point the domain to the server,
- information on who renews the SSL certificate,
- the billing account.
Take a look at the server invoices too. Who are they issued to? In practice, they are what most often shows who really owns the service. If the hosting sits on the agency’s account, a provider that offers website and email hosting in one place will come in handy for the move.
Company email and DNS records - how not to lose emails when changing contractors
Email works thanks to the domain’s DNS records, so whoever holds the DNS decides whether emails arrive at all. Simple. First, find out where the mailboxes physically are: on the agency’s hosting or with an external provider. And who has the administrator account there. Before you touch anything, write down the current records: MX (points to the server that receives email), SPF (the list of servers allowed to send on behalf of the domain) and DKIM (a digital signature on messages). Plan the email move separately. Otherwise it is easy to switch off both the website and the mailboxes on the same day, and nobody wants to explain that to the team.
Taking over a website from an agency: an access checklist
Taking over a website from an agency comes down to collecting the logins to the accounts that belong to your company and changing the passwords after the handover. Go step by step:
- the CMS administrator account: WordPress, WooCommerce, PrestaShop or Shopify,
- plugin and theme licenses, ideally assigned to a company address,
- Google Analytics, Google Search Console and Tag Manager,
- advertising accounts,
- payment gateways,
- integrations and API keys, meaning the credentials the website uses to connect to other systems,
- the code repository.
Wherever possible, get permissions at the owner level. A user account that the agency kindly added is not enough. After the handover, remove or restrict the former contractor’s accounts and change the passwords. All of them.
Backup and documentation before a website handover
Before you change anything, make a full copy of the files and the database and keep it outside the current hosting. Then even a failed migration does not end in lost content or orders. Also ask the contractor for documentation: a list of plugins, a description of custom modifications and integrations, and the update schedule. Copyright to the code and graphics varies, and everything depends on the contract. So go through it with a lawyer, without guessing. The new team will get up to speed faster if it starts with a review of the existing website that shows its technical condition and the risks.
In what order should you change the company that maintains your website?
The safest way: access and backups first, then choosing the new contractor, and at the very end terminating the contract and changing the passwords. In practice it looks like this:
- an inventory of all access,
- a backup of the files and the database,
- verifying the domain registrant,
- choosing the new company,
- handing over the website and its configuration,
- cutting off the old accounts.
When choosing, the guide on how to choose a website contractor will help, as will the article on what vetting a contractor before signing a contract looks like. Do you prefer ongoing care to one-off jobs? Consider outsourced IT support. Oh, and one more thing. A calm, matter-of-fact conversation with the current contractor usually speeds up the handover a lot. A row usually does not.
Changing the company that maintains your website goes smoothly when the domain, hosting, email and service accounts are registered to your company. In my opinion, the best habit you can take away from this: no matter who happens to be looking after your website, keep an up-to-date list of access details and of the places where they are stored. Then the next change of contractor is a formality.
Frequently asked questions
Can the agency keep my domain?
It all depends on who is listed as the registrant. If it is your company, the domain belongs to it, even when the agency handles it technically. Check the details with the registrar, and discuss any disputed points of the contract with a lawyer.
Does moving a website to a new company mean downtime?
It doesn’t have to. Stick to the order: backup first, then DNS changes, and email separately. Then the downtime can be kept to a minimum. It is best to make the changes when traffic is at its lowest.
What should I do if I have no access credentials at all?
Start with the domain and the registrar account, then the hosting that the invoices are for. With your company documents you can recover these accounts directly from the providers. The rest, meaning Google Analytics, plugin licenses and similar services, you can recover later through their access recovery procedures.
