Quick answer
List who owns hosting, application deployment, billing, the domain and recovery. Give the receiving person named access and verify it before removing the outgoing person’s rights. Sharing a password or adding a portal user does not transfer a contract or domain registration.
Agree what is changing hands
First agree which responsibilities are changing: application deployment, billing contact, hosting ownership or domain control. Record the customer and authorised people. Access changes, contract transfers and domain transfers are separate actions.
Confirm the service and support agreement, any maintenance window, data-processing responsibilities and who may approve access changes. The technical website move plan covers file, database and DNS cutover; this guide covers control and handover authority.
List the assets and access owners
Identify hosting account, application repository, deployment account, database access, domain registrar, DNS provider, CDN, certificate renewal, analytics, forms and any third-party mail or payment service. For each item, write down the current owner, intended owner, role, login route and recovery contact. Record credential locations by approved secure reference, never by pasting passwords or private keys into a handover sheet or support ticket.
Check that the receiving party can access only what its role requires. WHMCS separates client accounts from users with permissions; adding a user is not the same as transferring account ownership or billing liability. Ask Novasean support to handle any account-level change that requires administration or contract review.
Use an authorised transfer sequence
Have the existing account owner and receiving owner agree a handover date and confirm the named support contact. Grant the new person scoped access through the actual available account or deployment workflow, then have them sign in independently and perform a harmless read-only check. Transfer application knowledge and current release/rollback records. For a fuller handover record covering responsibilities, dependencies, recovery and open risks, use the agency and client hosting handover checklist. Only after the receiver confirms access should the outgoing person’s permissions be reduced or removed according to the agreed role change.
If the agency relationship is ending, decide who will own future application updates and incidents. A hosting provider’s platform support does not automatically become application maintenance.
Test the new support and recovery path
Ask the receiver to identify the live site, last release, backup or recovery request route, domain controller and authorised support channel. Test a normal deployment or access request without exposing live credentials, and confirm the old agency no longer has unnecessary access after handover. Keep an audit record of approvals and completion. If ownership, billing or domain authority is disputed, pause access removal and ask the contracting parties and support to resolve it.
Example: an agency stops maintaining the application
The customer may already own the hosting contract while the agency controls deployment and the repository. Transfer repository and deployment access through the supported workflows, identify the new application maintainer, and have that person verify a harmless read-only task. Treat any billing-owner or registrant change as a separate authorised process.
If the receiver can log in but cannot identify the backup route or deploy a reviewed change, the handover is incomplete. Resolve the missing responsibility before ending the old arrangement; hosting support does not automatically become application maintenance.
Frequently asked questions
Can I just share the existing login? Use named, least-privilege access where the service supports it. Shared credentials obscure accountability and make clean revocation difficult.
Does a website handover transfer the domain? No. Registrar and registrant control require their own authorised decision and procedure.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.