Website ownership in Kenya: domain, hosting, content and code handover

List domain registration, DNS, hosting, email, source repository, CMS, analytics and external services. A person may control one without controlling another. Knowing a CMS password does not establish access to the domain registration, and a domain account does not automatically contain the website's files or database.

Record the account owner, business contact, renewal date and how access is granted. Keep a business-controlled contact where the service allows it. If the developer manages an account on your behalf, describe that arrangement, exit process and authorised responsibilities in writing. Get suitable professional advice on legal ownership where required; this guide is a practical verification checklist, not a legal opinion.

Specify whether the deliverables include source code, designs, content, database exports, documentation and deployment configuration. Clarify whether supplied materials remain yours and what rights apply to custom work. A running service may rely on components or vendor accounts that cannot simply be transferred by copying files.

Ask about third-party themes, plugins, fonts, photos and paid services. Identify which licences belong to the business, which are managed by the supplier and what happens when support ends. Do not assume that owning the custom work removes every ongoing subscription. Record permitted usage and renewal responsibilities before the final invoice rather than during an urgent migration.

Ask for account invitations using the appropriate roles where available. Use separate staff accounts and remove obsolete access through the agreed process. Arrange sensitive credential transfer through an appropriate secure method; a publicly accessible project document is not suitable. Keep recovery information with the responsible business operator.

Demonstrate that an authorised person can update a service description, replace an image and change a contact detail. If editing is intentionally developer-managed, document the request and response process instead. Do not call a site fully editable merely because one administrator can change a footer while the important pages remain hardcoded.

Use these checks to compare proposals against your real workflow. Mark each requirement as included, optional or excluded, and record the person responsible.

A backup must include the pieces needed by that site. For WordPress, files and database content have distinct roles. For another architecture, identify the repository, uploaded assets, database and external services involved. Ask the operator to explain what can be restored and what requires a separate vendor account.

Run a restoration in an appropriate isolated environment rather than experimenting on the production site. Keep credentials and private data protected. A backup download completing successfully does not show that the content can be restored. Record the verification date, responsible person and any dependencies that need to be recreated.

Agree how security updates, renewals, outages, routine edits and larger changes are handled. Identify what is included in ongoing support and what needs a new quote. If you change suppliers, a planned migration should preserve useful URLs and enquiry routes. Avoid rushed DNS or email changes without a tested plan.

The website redesign guide covers migration checks, while the maintenance guide helps you discuss recurring work. Send our website team your asset register and handover expectations. A clear agreement plus demonstrated access protects continuity better than assuming all suppliers mean the same thing by ownership.