Quick answer: When you change web agency, treat the move as an ownership handover, not only a creative restart. Before notice periods end, secure domains, hosting, code repositories, analytics, ad accounts, DNS, third-party SaaS and written documentation. Confirm you can deploy and restore without the outgoing vendor. A checklist prevents locked accounts, missing backups and awkward “we thought you had the password” moments.
Why handovers fail
Agencies often hold the keys for speed. Years later those keys sit in a former employee’s password manager. Common failures:
- Domain registrar login unknown
- Hosting on a contractor’s personal credit card
- GitHub repo owned by a freelancer who left
- Google Analytics under a personal Gmail
- No staging site or deploy docs
- Plugins licensed to the agency email
You are not being difficult by asking for ownership early. You are running a business continuity exercise. Related habits like website documentation and a clear website brief for the incoming team reduce downtime.
30 days before you switch (or earlier)
Access inventory
Create a spreadsheet with every system, the URL, the login owner and whether you have admin rights:
- Domain registrar
- DNS host (sometimes separate)
- Web hosting / cloud account
- CDN and WAF
- SSL certificate provider if separate
- CMS admin (WordPress users)
- Git hosting (GitHub/GitLab/Bitbucket)
- Design files (Figma, Adobe)
- Stock photo / font licenses
- Email / workspace (Google Workspace, Microsoft 365)
- Analytics and Tag Manager
- Search Console
- Ads (Google, Microsoft, social)
- Call tracking
- CRM and form backends
- Email marketing ESP
- Payment processors and ecommerce apps
- Monitoring / uptime tools
- Backup tools
- Chat widgets and heatmapping tools
Mark anything you cannot log into today in red.
Legal and commercial
- Review contract for IP ownership of code and design
- Note notice periods and final invoice timing
- Request written confirmation that credentials will transfer
- Decide whether the outgoing agency remains on a short hypercare retainer
Domain, DNS and email
- Ensure the registrar account is under your company email and billing
- Export DNS zone records before changes
- Confirm TTL values before planned cutovers
- Keep email working: MX records mistakes cause more panic than homepage typos
- Document any third-party DNS features (filters, steering)
If email and site share a host panel, be extra careful during moves.
Hosting and application access
- Transfer hosting billing to your card or company account
- Collect SFTP/SSH details or confirm you own the panel users
- Rotate passwords after the agency loses day-to-day need
- Verify backup schedule and perform a restore test (website backup strategy)
- Confirm PHP/Node versions and cron jobs
- List environment variables and secrets storage locations
For WordPress, audit admin users, remove stale accounts and confirm file permissions are sane. Keep a staging workflow if you have one.
Code and deploy ownership
- Repos transferred to an org you control
- Deploy keys and CI secrets rotated
- README with build and deploy steps
- Branching model explained in one page
- Theme/plugin license keys moved to your email
If there is no Git history, export a clean codebase snapshot and start version control immediately with the new team. Deployment ambiguity is how emergency SFTP edits return.
Analytics, ads and SEO properties
Move ownership, not only “shared access”:
- Google Analytics accounts/properties
- Google Tag Manager containers
- Google Search Console (verify with a method you control)
- Bing Webmaster Tools
- Ad accounts and pixels
- Rank tracking tools
Export historical reports you may need if an account transfer stalls. Keep UTM conventions documented so the new agency does not invent a parallel taxonomy.
Content, design and brand assets
- Current brand guidelines
- Logo source files
- Photo libraries and license proofs
- CMS export or database dump
- Redirect maps from past migrations
- Ongoing content calendar ownership
Incoming teams waste weeks recreating assets that existed but were never delivered.
Third-party apps and licenses
List every paid plugin and SaaS connected to the site. Change the owner email. Update credit cards. Confirm seats. Cancel duplicates. Especially watch:
- SEO plugins
- Page builders
- Security and backup plugins
- Forms tools
- Membership systems
Security hygiene on the day access changes
- Rotate CMS, hosting, registrar and repo passwords
- Revoke API keys the agency created
- Remove agency users from GTM, Analytics, ads and Slack
- Check authorized apps on Google/Microsoft accounts
- Confirm 2FA is on for critical logins you now own
A handover without rotation leaves a lingering access path.
Briefing the incoming agency
Provide:
- Goals for the next 90 days
- Known bugs and tech debt list
- Brand and tone notes
- Conversion priorities
- Contacts for approvals
- The completed access spreadsheet
Ask them for a website launch checklist style plan if a redesign is imminent, and a deployment process document before they touch production.
Parallel run tips
When possible, keep the outgoing agency available for two weeks after the new team has credentials. Pay for limited Q&A hours. That is cheaper than archaeology.
Avoid redesigning, replatforming and switching agencies in the same week unless you must. Stacking risk creates outages.
Red flags when leaving a vendor
- Refusal to provide admin access you contractually own
- Code only on their laptop
- “Designs are proprietary” for work you paid to create (read the contract)
- Hosting that cannot be transferred without a full rebuild
- Personal accounts used for company analytics
Escalate early. Sometimes a domain lawyer or simply executive pressure solves what email cannot.
FAQ
When should we tell the current agency we are leaving?
Honor the contract. Prepare ownership inventory first so notice does not strand you mid-transfer.
Can we change agencies without changing the site design?
Yes. Many switches are about communication, velocity or cost. Stability can be the goal.
Who should own the Google Analytics account?
Your company. Agencies should be users, not landlords.
What if we have no documentation at all?
Start with access inventory and a full backup. Pay the new team for a discovery sprint before big features.
Communication plan during the transition
Name a single client-side owner who collects credentials and answers both agencies. Ambiguous ownership creates duplicate DNS edits. Set a shared timeline: access transfer week, freeze on noncritical production changes, new team smoke tests, then outgoing offboarding. Put emergency contacts in writing for the first weekend after cutover.
If customers might notice visual or performance changes, prepare a short internal FAQ for support staff so they do not blame “the website being hacked” when a deliberate update shipped.
Printable handover checklist (summary)
- Domains and DNS under company billing
- Hosting under company billing
- CMS admins audited
- Repos in company org
- Analytics and ads ownership verified
- Search Console verified
- Backups tested
- Licenses transferred
- Passwords rotated
- Incoming team briefed
If you want a development partner that documents ownership clearly from day one, see our Turn visitors into customers web services.
