When a web development project reaches the final milestone, most SME owners review how the homepage looks on their office laptop, click two menu links, and approve the final invoice. Months later, they discover they do not have Administrator access to their own CMS, their contact form emails are landing in spam, or a critical layout plugin stops working because it was registered under a freelancer’s personal trial account.
Before signing off on User Acceptance Testing (UAT) and releasing final milestone payment, run through these eight technical handover checks—alongside our 9 Website Migration SEO Checks.
1. Root ownership of domain registrar, DNS and cloud hosting accounts
Why it matters: Your domain name (e.g., yourcompany.com.sg) and DNS zone control both your website and your corporate email. As highlighted in our agency contract red flags guide, if a developer registers your domain under their personal account and becomes unreachable, recovering your domain requires a lengthy dispute process.
What to verify: Log in yourself to confirm your company owns the SGNIC/registrar account, Cloudflare/DNS dashboard, and hosting billing profile, with two-factor authentication (2FA) tied to a corporate mobile number.
2. Commercial theme, builder and plugin license keys
Why it matters: WordPress and WooCommerce sites often rely on paid commercial plugins (such as Elementor Pro, WPForms, multilingual tools, or security suites). If a developer uses nulled (pirated) plugins or revokes their agency license key six months after launch, your site loses security patches.
What to verify: Request a written inventory of all installed plugins and themes, confirming which licenses are owned directly by your company and which are covered under an active maintenance SLA.
3. Automated off-site daily backups and a tested restore procedure
Why it matters: Server hardware fails, staff accidentally delete pages, and plugin updates occasionally conflict. Assuming your hosting provider keeps backups without checking often ends in disappointment when you discover backups were never enabled.
What to verify: Confirm that automated daily backups (database + media files) are stored off-site with at least 14 to 30 days of retention, and ask the developer to demonstrate where backups are accessed.
4. Role-based CMS accounts (separating daily Editors from Super Admins)
Why it matters: Sharing a single admin login across five marketing executives and external contributors creates a major security risk and makes it impossible to tell who changed a page.
What to verify: Ensure your leadership holds an individual Administrator login, while daily content writers and coordinators are assigned Editor or Author roles that cannot accidentally delete plugins or change theme code.
5. Authenticated SMTP email delivery and end-to-end form logging
Why it matters: Default PHP mail on web servers (`wp_mail`) is frequently blocked or flagged as spam by Microsoft 365 and Google Workspace because it lacks SPF, DKIM, and DMARC authentication.
What to verify: Submit a live test enquiry on every form across your website, confirming that (a) the email notification arrives via authenticated SMTP in your inbox within 60 seconds, and (b) a backup copy of the submission is stored inside the website database or CRM.
6. Real-device mobile responsiveness across 360px–430px viewports
Why it matters: A website built on a 27-inch studio monitor frequently suffers from oversized headings, horizontal scrollbars, or overlapping sticky buttons when viewed on a standard iPhone or Android screen.
What to verify: Inspect your homepage, top service pages, blog posts, and checkout/contact pages on actual mobile phones—checking tap-target spacing, table scrolling, and image cropping.
7. SSL/HTTPS enforcement, security headers and login protection
Why it matters: Public websites face automated brute-force login bots within hours of going live. Basic security hardening prevents common credential-stuffing attacks and mixed-content browser warnings.
What to verify: Check that HTTP automatically redirects to HTTPS with a valid SSL certificate, XML-RPC / unused endpoints are restricted, login rate-limiting is active, and admin passwords follow strong policies.
8. Handover documentation, editor walkthrough and post-launch warranty window
Why it matters: Your team should not have to pay a developer fee every time you want to swap a team photo, publish a blog post, or update a seasonal banner.
What to verify: Require a recorded 30-minute walkthrough video (or concise handover guide) showing how to edit text, images, and posts, plus written confirmation of the post-launch bug warranty period (typically 30 days).
Website Technical Handover Sign-Off Checklist
Complete this verification table before releasing the final milestone payment for any new website build:
| Handover Category | Specific Verification Test | Credentials / Evidence Required | Status Sign-Off |
|---|---|---|---|
| 1. Domain & DNS | Verify company-owned registrar & Cloudflare/DNS login | Registrar login + 2FA enabled on corporate device | Required before launch |
| 2. Hosting & Backups | Confirm off-site daily backup schedule & SSL auto-renewal | Hosting dashboard access + last backup timestamp | Required before launch |
| 3. CMS & Licenses | Verify individual Admin/Editor logins & active plugin licenses | Plugin inventory sheet + license activation status | Required at handover |
| 4. Forms & SMTP | Submit live test form & check inbox + database/CRM entry | Authenticated SMTP test pass + CRM log verified | Required at launch |
| 5. Mobile & Speed QA | Test key pages on 375px mobile viewport & PageSpeed Insights | Zero horizontal overflow; legible typography & tables | Required before final payment |
Build and maintain your business website with disciplined engineering
At W Creates Digital, our web development team delivers clean, well-documented websites with transparent credential ownership, authenticated form routing, and structured handover QA. Contact our Singapore team to discuss your next website build or technical audit.