The Handoff Document Every Site Owner Should Have
Every few months we're asked to help with a website nobody can get into. The developer is unreachable, the hosting is on a former employee's personal account, and the domain renewal notice goes to an address that stopped existing in 2022.
Sometimes it's recoverable. Sometimes the answer is genuinely "you'll need to start again," and that conversation is dreadful.
All of it is prevented by one document.
What goes on it
The domain. Registrar, the account it's under, who can log in, renewal date, payment method on file, and where the recovery codes are.
DNS. Where records are managed — often not the registrar. Who has access.
Hosting. Provider, plan, account holder, control panel URL, renewal date.
The website platform. What it's built on, where the admin login is, who has administrator accounts, and where the code lives if there's a repository.
Email. Provider, who administers it, where the mail records point.
Backups. Where they are, how often, how far back, and — the part everyone omits — the actual steps to restore one.
Third-party services. Analytics, tag manager, chat widget, booking system, payment processor, CDN, monitoring, every plugin with a licence. Each with: what it does, whose account, what it costs, and when it renews.
People. Who currently has access to what, and who to call when something breaks.
How to keep it
One page. The longer it is, the less likely it stays current.
Owned by the business, not the agency. In the business's own document store, accessible to at least two people, one of whom is not technical.
No passwords in it. Passwords belong in a password manager. This document says where things are and who has access, and points at the manager for credentials.
Dated. With a review reminder — quarterly is plenty, and it takes ten minutes.
The test
Hand it to someone in the business who isn't technical and ask them to answer: if the website went down tomorrow and nobody could reach the usual person, what would you do first?
If they can answer from the page, it works. If they can't, it's missing something.
Why it's usually missing
Nobody's job includes it. It's created during a crisis, by which point half the information has to be excavated from old emails and hosting support tickets.
It takes about an hour to write from scratch, and the hour is never urgent — right up until it's the most urgent hour of the year.
The related question
While you're writing it, ask: if we parted ways with everyone currently working on this site, could we carry on?
If the honest answer is no, that's not a documentation problem. That's a dependency, and it's worth resolving deliberately rather than discovering it during an outage.