Nine items, and the rule is test each one rather than file it. Do this while you still hold the final instalment — afterwards a missing item becomes a favour rather than a request, and at the lower end of the market there was never money in the price for favours.
Keep the last payment at 10%. Small enough that nobody deadlocks over it, large enough to matter.
The nine items
☐ 1. Domain registrar login
Test it: log in yourself, and reset the password via your own email.
Then: turn on auto-renew, confirm the saved card is current, and put the expiry date in your calendar with a 30-day reminder.
Why first: this is the one thing that can’t be recreated. Miss the renewal and your website and business email stop together.
☐ 2. Hosting login
Test it: log in and find the control panel.
Then: note the hosting expiry date too — it’s a separate date from the domain, with a separate outage.
☐ 3. Website admin login, in your own name
Test it: log in, change one word on a page, and save it.
Not a shared login you’re told about verbally — an account created for you.
☐ 4. A full backup, as a downloadable file
Test it: download the zip, open it, confirm it isn’t empty and contains recognisable folders. Ask what restoring would involve.
Then: store it somewhere that isn’t the server. A backup living only inside the hosting account is worthless if the account is lost.
Why it matters: with a backup and your domain, almost any developer can restore you quickly. Without either, you’re rebuilding — and a compromised-site cleanup in India typically runs ₹20,000–50,000 or more.
☐ 5. Analytics and Search Console, under your own Google account
Test it: log in with your own Google account and see the property listed.
If these sit in the developer’s account, you can’t measure anything after they’ve gone.
☐ 6. Business email, if it was included
Test it: send an email from it and reply to it.
☐ 7. Both renewal dates, in writing
Domain expiry and hosting expiry, as dates. Put both in your calendar.
☐ 8. The post-launch change rate and response time, in writing
“Small changes ₹X, response within Y working days.” A named rate is enforceable; “anytime, just message me” is goodwill, and goodwill is what evaporates in month eight.
☐ 9. A written list of anything registered under their account for you
The question nobody asks:
Please confirm whether anything — Google Business Profile, analytics, business email, payment gateway, social accounts — is registered under your account on my behalf.
This is where hidden dependencies live. One buyer discovered their site had been registered against a developer’s personal email only when a payment gateway withheld transactions because the verification details didn’t match.
Test the site itself while you’re at it
Five checks from your own phone, on mobile data — not the developer’s laptop:
☐ Phone number correct, visible without scrolling, and dials when tapped
☐ Contact form submitted — and you’ve confirmed which inbox it reached
☐ WhatsApp button opens a chat with your number, including the country code
☐ Every page in the menu opens; no placeholder text anywhere
☐ Address shows https with a padlock, and loads in about three seconds
One extra, easy to miss: ask whether the staging site is blocked from search engines and whether that block has been removed from the live site. Both halves matter — a block left on after launch means the finished site can’t be found at all.
The message to send at go-live
Before I release the final payment, could you send: the domain registrar login, hosting login, website admin login in my name, a full backup as a zip, and confirmation that analytics and Search Console are under my Google account? Also both renewal dates, your post-launch change rate and response time, and whether anything is registered under your account on my behalf. I’ll test each and confirm.
Any competent vendor sends this without comment — it’s a normal end-of-project handover. Resistance on item 1 or 9 tells you something worth knowing before the money moves.
What to do if you’ve already paid in full
You have less leverage, not none. Framing decides the outcome:
Hi [name]. For my records, could you send the registrar login, hosting login, admin login and a full backup as a zip? Also, please confirm whether anything is registered under your account for my business. Happy to settle anything pending.
No grievance, specific items, and a reason to reply. If there’s a genuine unpaid balance, pay it — a few thousand rupees to end a dependency is the cheapest option available.
And note what you can get without them: the domain if it’s in your name (reset via your own email), hosting by contacting the host directly as account owner, and — once you have hosting — the backup and admin login both follow. The full recovery order.
Store handover: four extra items
☐ Payment gateway account under your login, with matching business details
☐ Backup frequency and storage location confirmed — order and customer data cannot be recreated by rebuilding
☐ Shipping aggregator account in your name
☐ A test order placed end to end, and refunded
What to do this week
- Send the go-live message before releasing the final instalment.
- Test all nine items rather than filing them.
- Put both renewal dates in your calendar and turn on auto-renew.
- Store the backup somewhere that isn’t the server.
- Ask item 9’s question explicitly — it’s the one that finds hidden dependencies.
If you want it done the certain way
You get all nine in writing at go-live, and we’d rather you tested each one in front of us than took our word for it. Domain in your name from day one, backup handed over, analytics under your own Google account. WhatsApp us; we reply in about five minutes between 9am and 7pm.
Related reading
- The only website handover checklist you need
- The 5-point website ownership audit
- Is your domain really yours? Check in 30 seconds
- You don’t have a single password to your own website
- What silently disappeared from what you were promised?
FAQ
What should I receive when my website is finished?
Nine things: domain registrar login, hosting login, an admin login in your own name, a downloadable full backup, analytics and Search Console under your own Google account, business email if included, both renewal dates, the post-launch change rate and response time, and a written list of anything registered under their account for you.
When should I ask for the website handover?
Before releasing the final payment, and keep that instalment at 10% so it’s worth completing but not worth a standoff. Afterwards a missing item becomes a favour rather than a request.
What’s the most commonly missed handover item?
A written list of anything registered under the developer’s account on your behalf — Google Business Profile, analytics, business email, payment gateway. That’s where hidden dependencies sit, and almost nobody asks.
Why does the backup need to be stored off the server?
Because a backup living only inside the hosting account is worthless if that account is lost, suspended or controlled by someone else. Download it and keep your own copy.
