Seminar at SoftUni Creative
Last updated on
Have you ever asked your agency for the hosting password and received the answer a week later?
That is usually the moment an owner realises the website is theirs only on paper. The domain is registered to the agency. Search Console is on the email of one of its employees. The paid plugins run on the agency’s licences.
The decision to change your provider is usually made long before the conversation. The risk is in the transition: the weeks when the old partner no longer responds and the new one does not yet have access to anything.
Most separations go smoothly if things happen in the right order. Below is that order: what should be yours before you tell the agency, what to ask for at handover, and what to check in the first 30 days with the new partner.
The short version
- The domain, hosting, Google accounts and licences should belong to the company, not to the agency or to an individual employee.
- Check ownership quietly, before you announce the change. After that, your negotiating position is weaker.
- Ask for a full backup of the files and the database, and keep it on your side, not only on the server.
- The new partner should start with a technical review before taking responsibility for the website.
- Revoke the old agency’s access only once everything has been checked, but no later than that.
- The contract with the new partner should also describe how you would part ways, if it ever comes to that.
What should be yours before you tell the agency
In our experience, the most common problem when taking over someone else’s website is not the code. It is access.
Code can be reviewed, fixed or rewritten. A domain registered in someone else’s name, or a Google account with five years of history on a former employee’s email, is hard to get back, and sometimes it cannot be recovered at all.
| What | How it should be | What happens if it is not |
|---|---|---|
| Domain | Registered to the company, with a company email as the contact | When it expires, both the website and email stop working |
| Hosting and DNS | A company account, or a clear process for transferring it | The new partner cannot move, back up or fix the site |
| WordPress administrator | A separate administrator account for the company | You depend on the agency for every change |
| Search Console, GA4, Tag Manager, Google Ads | The company is the owner, the agency has user access | You lose the history of your traffic and ads |
| Paid plugins and themes | Licences belong to the company or can be transferred | Updates stop, including security updates |
| Code and backups | A current copy of the files and the database on your side | If the server fails, there is nothing to restore from |
Why does it matter to check this before you tell the agency? While the relationship is running, adding the company as an owner is a routine request. Once you announce the change, the same request becomes a negotiation.
Be careful: Do not end the contract or stop payments before the company has owner access to the domain, the hosting and the Google accounts. If the agency decides not to cooperate, these are exactly the things that take longest to recover.
The order of the switch
Changing providers is a small project. There is a sequence, and each step relies on the one before.
- Inventory. Write down what you have: domains, hosting, email, Google accounts, paid services, integrations with the warehouse system, couriers and payments. Who owns each one, and until when it is paid.
- Ownership. Ask for the company to be added as the owner everywhere it is not.
- Backup. A full copy of the files and the database, downloaded to your side.
- A technical review by the new partner. Before taking over the site, they see what state it is in and what they are taking on.
- Handover. The old agency hands over documentation and answers questions. It helps to agree a deadline for this, for example two weeks.
- Switch-over. The new partner takes over hosting, updates and monitoring.
- Revoking old access. Passwords are changed and the agency’s accounts in WordPress, the hosting and Google are removed. This is the last step, and it is often skipped.
What the old agency should hand over
Access is half of the handover. The other half is information that exists only in the head of the person who built the site.
It is worth asking for the following in writing:
- a full, dated backup of the files and the database;
- a list of plugins and the theme, which ones are paid, and whose name the licences are in;
- any custom code: where it is, what it does, and whether there is a repository with its change history;
- integrations with the warehouse system, couriers, payments and CRM, including who owns the API keys;
- scheduled tasks: syncs, emails and backups that run automatically;
- the DNS records, especially those for email;
- known issues, and work that was started but not finished.
This is where many businesses go wrong. They receive the backup and consider the handover done. A backup without an explanation of the custom code is like a key without an address. You have it, but you do not know what it opens.
Why the transition is a risky time for security
While the switch is under way, often nobody updates the website. The old agency no longer feels responsible. The new one has not taken over yet.
According to Patchstack’s annual report, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025, 42% more than the year before. 91% of them were in plugins. For 46%, the developer had not released a fix by the time the vulnerability was made public.
In practice, that is more than 200 new vulnerabilities every week, almost all of them in plugins of the kind every site has. A month without updates during the switch is an open window.
The second risk is old access. An administrator account belonging to someone who no longer works on the site is a door nobody is watching. That is why the last step in the list above matters so much.
What the contract with the new partner should cover
The best moment to agree how you would part ways is at the start, when both sides want the relationship to begin.
- Rights to the code and design. Written explicitly: the company receives the rights, or a licence to use and modify them with no time limit. If the contract says nothing, this can become a dispute.
- Account ownership. The domain, hosting and Google accounts belong to the company.
- Response times. How quickly the partner reacts when the site is down, and how quickly for a routine task. This is usually described in an SLA (service level agreement).
- Backups. How often they are made, where they are kept, and when a restore was last tested.
- Handover at the end. What you receive, and by when, if you decide to move on.
The last point looks odd at the start of a relationship. In fact, it is a sign of trust. A partner who is not afraid to write down the exit usually has no reason to keep you by force.
Worth doing: If your contract covers both the build and the maintenance, make sure the rights to the code do not depend on whether you continue with maintenance. The site was paid for once, and it is yours.
If the new partner is in another country
More companies now work with a development partner abroad. The same rules apply, with three additions: agree the working language of documentation and support, check which country’s law governs the contract, and make sure the hosting location fits your GDPR obligations. None of this is complicated, but it is easier to settle at the start.
The first 30 days with the new partner
When we take over the maintenance of a WordPress website we did not build, we always start with a technical review. Without it, we would be taking responsibility for things we do not know.
Whoever you work with, the first month should include:
- a test restore from backup, on a staging environment, not just a check that a backup exists;
- updates to WordPress, the theme and the plugins, first on staging;
- a scan for malicious code and unknown administrator accounts;
- baseline figures for speed and for traffic from Search Console and GA4, so there is something to compare with;
- a real end-to-end test of the contact form, the order and the payment;
- a short report: what was found, what is urgent, and what can wait.
The report matters for another reason too. It separates inherited problems from new ones. Six months later, nobody will remember what state the site was in at the handover.
When to be more careful
Most agencies hand over websites properly. But there are signals that are a reason to speed up the ownership check:
- the request to add the company as owner goes unanswered or keeps being postponed;
- the domain is registered to the agency, and it does not offer to transfer it;
- the site runs on the agency’s own platform, with no way to export the content;
- a backup cannot be provided “for technical reasons”;
- handing over the code is tied to an extra payment not described in the contract.
None of these signals on its own means bad intentions. But each of them is a reason not to postpone the first two steps.
Sometimes the bigger risk is staying
A good example from our work is GT Supply, an importer of industrial parts.
Before we started working together, the company had invested in two websites over roughly 12 to 18 months. According to the client, they brought no inquiries and did not rank in search engines.
Two websites. A year and a half. Not a single inquiry.
The new website shows the real catalog of more than 700,000 product codes, structured the way industrial buyers search: by brand and by exact code. The client reports more than six times higher revenue since launch.
Changing providers carries risk. But every month with a website that brings no inquiries has a cost too. It just does not show up on an invoice.
Frequently asked questions
Who owns the website if the agency built it?
The answer is in the contract. It should state explicitly that the company receives the rights to the code and design, or an unlimited licence. The domain, hosting and Google accounts should be registered directly to the company, whatever the contract says about the code.
Can the agency refuse to hand over access?
In practice, it can delay the handover. That is why the company should have owner access to the domain, the hosting and the Google accounts before announcing the change. Then handing over the rest is a matter of time, not goodwill.
Do we lose SEO when we change agencies?
Changing the provider itself does not affect rankings if the website stays the same. The risk comes with a redesign or a migration, when URLs and content change. That needs its own plan, with a full map of 301 redirects.
Do we have to change hosting as well?
Not necessarily. If the hosting is good and the account belongs to the company, the site can stay there. A move is worth it if the account belongs to the old agency, if the site is slow, or if the new partner cannot take responsibility for a server they do not control.
How long does the switch take?
It depends on complexity. A company website is taken over faster than an online store with warehouse and courier integrations. What matters is that the old contract does not end before the new partner has received everything and completed the technical review.
What if we have no access at all?
Start with the domain. The registrar can restore access to the registered owner against company documents. Ownership in Search Console can then be verified again through a DNS record, without the agency. Hosting is recovered the same way, if the account is in the company’s name.
Key takeaways
- Check ownership before you part ways, not during.
- A backup is only useful if you know what is in it and have tested that the site can be restored from it.
- The transition is the most vulnerable time for security. Someone has to own updates throughout.
- A good contract describes both the way in and the way out.
Thinking about changing your partner?
We can start with a technical review of your website. You will see what state it is in, what is yours and what is not, and what needs to happen before we take over maintenance.
Contact us with your website’s address and a short note on who maintains it today. The conversation is confidential, and your current partner will not hear about it from us.
