Taking over a website from a previous developer? Check you have these accesses

Why it is worth doing now

While the website works, missing passwords bother nobody. The problem surfaces at the worst moment: the domain expires because the invoice goes to the former developer's inbox, the website breaks after an update, or the phone number needs changing urgently.

Then, instead of a quick fix, the search begins: who has access, to what, and how to get it back. That can take weeks.

The domain: the most important key

The domain is the website address and usually your business email too. Check who the registrant, meaning the formal owner, is. It should be your business, not the developer.

You need access to the account at the registrar, the company where the domain is paid for, or at least the transfer code (also called an auth or EPP code). That code lets you move the domain to another registrar without the previous developer.

Hosting, admin panel and code

Besides the domain, you need access to the places where the website runs:

• The hosting account, ideally set up in your business's name and paid by it.
• An administrator account in the website's panel (such as WordPress), not just an editor account.
• The website code: a repository (for example on GitHub) or a full copy of the files and database.
• Accounts for the services the website uses: form delivery, maps, paid plugins and their licences.

Email and Google accounts

These accounts are easy to forget, and losing them hurts just as much. In each of them you should have an owner or administrator role, not just view access:

• Business email: where it runs and who can create new mailboxes.
• Google Search Console: data on how the website appears in search.
• Google Analytics and Google Tag Manager: visit history and tracking settings.
• Your Google Business Profile (the listing in Maps), ad accounts and social media.

How to ask for access

Write to the previous developer politely and specifically: a list of what you need and a request to transfer ownership of the accounts, not just the passwords. Most developers are happy to do it, because they do not want to be responsible for a website they no longer look after.

If contact has broken off, most accesses can be recovered as the business owner: from the domain registrar, the host and Google. It takes longer and needs paperwork, but it is possible. That is why it matters so much that the domain and hosting are in your business's name from the start. If you also want to move the website to new hosting or a new technology, see website migration.

What to do after the takeover

Once you have access, start with a review. When I take a website over into website care, it is always my first step:

• Change the passwords and remove accounts of people who no longer work on the website.
• Make a full backup and check that it can be restored.
• Check that the system and plugins are up to date and that the contact form sends messages.
• Store all the accesses in one secure place, such as a password manager.