Accepting a Website From Your Developer: The Handover Checklist

The moment before final payment is the only point at which you have leverage. Everything on this list is straightforward to obtain then and awkward to chase afterwards.

Work through it before you sign off, not after. For remote production teams, a related reference is this resource, which looks at how activity signals should be interpreted.

Ownership and access

The most important section, and the one most often skipped because it feels administrative rather than technical.

[ ] Domain registered in your name, in an account you control. Not the agency's account "for convenience."
[ ] Hosting account in your name, with billing under your control
[ ] Source code delivered, and repository access transferred to you
[ ] CMS administrator credentials with full privileges, not an editor account
[ ] Design source files — Figma, Sketch, or equivalent, with edit access
[ ] Written confirmation that ownership transfers on final payment
[ ] Licences documented for every paid plugin, theme, font, and stock image — including who they are registered to and when they renew
[ ] Third-party account access: analytics, tag manager, search console, CDN, email service

The font and plugin licences deserve attention. Licences registered to the agency stop working when the relationship ends, and font licensing in particular can become a legal problem rather than an inconvenience.

Migration and redirects

Only relevant if you are replacing an existing site — and if you are, this section matters more than every other one combined. Security reviews should also account for the OWASP Top 10.

[ ] Redirect map delivered as a document: every old URL and its new destination
[ ] All old URLs return 301, not 302, and not 404
[ ] No redirect chains — old URL to new URL directly, not via two intermediate hops
[ ] Old site crawled and archived before it was switched off
[ ] Sitemap submitted to Search Console
[ ] Indexed page count monitored for the first month after launch

Test this yourself. Take twenty URLs from the old site — the ones that had traffic — and check each one lands on a sensible page. This is fifteen minutes of work and it is the difference between keeping your search rankings and starting over.

SEO fundamentals

[ ] noindex removed from the production site. Staging sites are blocked from indexing and the block is forgotten with striking regularity — verify the live robots.txt and the meta robots tag on real pages
[ ] Unique title and meta description on every page, none duplicated
[ ] One H1 per page, with a sensible heading hierarchy beneath
[ ] Self-referencing canonical tags, absolute URLs, pointing at the page itself
[ ] robots.txt correct, with the sitemap referenced
[ ] XML sitemap present and containing only indexable pages
[ ] Structured data implemented and validated in the Rich Results Test
[ ] hreflang reciprocal and self-referencing if the site is multilingual
[ ] alt text on every image

The canonical check is worth doing manually on several pages. Canonicals pointing at a staging domain, at a template's original source, or at the wrong page are among the most damaging and least visible errors a launch can carry.

Performance

[ ] Core Web Vitals measured on mobile, not desktop
[ ] Images in WebP or AVIF, sized appropriately, with srcset
[ ] Explicit width and height on every image, video, and iframe
[ ] Lazy loading on below-the-fold images, and not on the hero image
[ ] Third-party script inventory provided — every tracking, chat, and marketing script, with justification
[ ] Caching and compression enabled
[ ] Font subsetting with font-display: swap

Contract targets should reference field data, verified in Search Console within 60 days of launch, because that is how Google measures it. A lab score from a fast connection is not the same thing. See our plain-language guide to Core Web Vitals.

Analytics and tracking

[ ] Analytics installed and recording, verified with live traffic
[ ] Search Console verified, with you as owner
[ ] Conversion events configured — form submissions, calls, purchases
[ ] Test submissions excluded from the data
[ ] You have owner-level access, not view-only

Sites launch without working measurement more often than anyone admits, and the loss is silent: three months later nobody can say whether the rebuild worked.

Functionality

[ ] Every form submits, and the notification arrives at the right inbox
[ ] Form validation and error states tested, including on mobile
[ ] Spam protection active
[ ] Transactional emails — confirmations, receipts, password resets — sent, received, and correctly formatted
[ ] Search, filtering, and any interactive component tested with real data
[ ] Payment flow tested end to end in live mode, if applicable
[ ] 404 page helpful rather than a dead end

Transactional emails are the most commonly missed item on this list. They live outside the site, so nobody tests them, and a broken order confirmation is discovered by a customer.

Cross-browser and device

[ ] Tested on current Chrome, Safari, Firefox, and Edge
[ ] Tested on iOS Safari and Android Chrome on real devices, not only a browser's device simulator
[ ] Tested on a mid-range phone, not just a current flagship
[ ] Landscape orientation checked
[ ] Tested on a slow connection

Accessibility

[ ] Keyboard navigation works throughout, with visible focus states
[ ] Colour contrast meets at least 4.5:1 for body text
[ ] Form fields have associated labels
[ ] Images have meaningful alt text; decorative images have empty alt
[ ] Heading structure is logical and sequential
[ ] Video captions where applicable

Security and maintenance

[ ] SSL certificate active, with auto-renewal configured
[ ] No mixed content warnings anywhere on the site
[ ] Backup schedule configured, and a restore tested at least once
[ ] Admin accounts audited — agency accounts removed or downgraded once handover completes
[ ] Update responsibility documented: who applies CMS and plugin updates, how often
[ ] Written maintenance terms: warranty period, what it covers, hourly rate afterwards, response times

Documentation

[ ] A short guide to editing content in the CMS
[ ] A list of what a non-technical person can safely change and what they cannot
[ ] Named contact for support, and the escalation path

Before you pay

Two things separate a clean handover from a difficult one.

Do not settle the final invoice until the checklist is complete. Withholding a final payment percentage against handover is a normal contractual arrangement, and it should have been agreed at the start.

Have someone independent run the checks. The person who commissioned the site is not the best person to audit it — they have been looking at it for months and have stopped seeing it. A second pair of eyes finds the noindex tag.

Нужен независимый аудит сайта перед приёмкой? . Или посмотрите услуги веб-дизайна, если проект ещё впереди.