A website maintenance plan can look inexpensive until the business needs to change providers. The useful question is not whether a vendor says the site is portable. It is whether the business can recover the domain, content, code, configuration, media, data, and operating knowledge needed to keep the site working. Review the exit path before signing and repeat the review while the relationship is healthy.
Separate ownership from access
List every asset involved in operating the site: domain registration, DNS, hosting, source repository, content management system, database, media library, theme and plugin licenses, analytics, search tools, email delivery, forms, backups, monitoring, and third-party integrations. For each asset, record the legal owner, account owner, billing owner, administrators, recovery contacts, and export method.
A vendor login is not the same as business ownership. A strong plan puts the business in the registrant or primary-owner position and grants the maintainer the least access needed. If the provider is the only party that can renew the domain, recover an account, or approve a transfer, changing maintainers can become an emergency.
ICANN explains that an authorization code is required to transfer a generic top-level domain between registrars, and that a registrar must provide the code within five calendar days if the registrant cannot generate it in the control panel. Use that as a practical control test: confirm the business is the registrant, the recovery details are current, and an authorized business representative can reach the registrar without relying on the maintainer. See ICANN's Auth-Code guidance. ICANN's domain transfer overview also says the registrant has a right to transfer a domain and must be the registrant of record or administrative contact to initiate the process. Do not generate or share a live transfer code merely for a routine audit; verify the documented process and account control safely.
Ask what an export leaves behind
The word export is too vague for a contract. Name the formats and the exact data included. For a content-managed site, ask separately about pages, posts, media files, database records, redirects, form submissions, structured fields, users, design files, source code, configuration, environment variables, scheduled jobs, and logs.
WordPress documents that its standard export can produce a WXR XML file containing items such as posts, pages, comments, custom fields, taxonomies, navigation menus, and custom post types. That is useful content portability, but it does not prove that an entire working site can be reconstructed. The WordPress command-line documentation is more explicit: a WXR export does not include site configuration or the attachment files themselves. Review the WordPress export documentation and the WP-CLI export reference as examples of why every export needs a scope statement.
Request a sample export before a long commitment. Open it in an isolated environment, count important records, inspect media references, and note what must be obtained through another method. A file that downloads successfully but cannot restore the intended service is not a tested exit path.
Look for operational dependency
A site may technically be exportable yet depend on undocumented vendor knowledge. Warning signs include deployment steps that only one person knows, licenses held only in the vendor's account, custom code without a repository, backups that cannot be restored outside the vendor's environment, and integrations whose credentials or ownership are unclear.
Require a compact operating record: architecture, account map, renewal dates, deployment procedure, backup and restore procedure, integration inventory, monitoring destinations, and emergency contacts. The record should identify secrets without copying secret values into an ordinary document. The business should know where credentials are managed and who can rotate them.
Read the exit terms as an operating procedure
Check notice periods, final-payment conditions, export fees, migration assistance, response times, post-termination data retention, deletion timing, license transferability, and access removal. Ask what happens if the relationship ends during an incident or if the vendor stops operating. Separate a reasonable fee for new migration work from a fee that is necessary simply to receive business-owned material.
A credible provider can explain the boundaries. Some licenses may not transfer, some hosted features may need replacement, and confidential credentials must be handled securely. Those limits are not automatically unacceptable. The warning sign is an important dependency that was hidden, unpriced, or impossible to test before the business became dependent on it.
Protect search continuity
Moving a site can affect URLs, redirects, ownership verification, analytics, and search visibility. Google's Change of Address guidance says a domain move should be prepared with redirects and requires ownership of both the old and new Search Console properties for that tool. It also warns that combining a move with a redesign or URL-structure change can cause traffic loss while pages are reassessed. Google Search Central's site move guide adds that teams should test the new site, prepare a URL map, configure redirects, and monitor old and new URLs. A maintenance plan should preserve the information needed to map old URLs to new ones and should not make the vendor the only verified owner of search properties.
Run a small exit drill
Once a year, choose a low-risk test. Export a representative set of content, restore a backup in an isolated location, confirm that a second authorized person can access the repository and hosting account, and compare the restored result with the production site. Do not change live DNS or transfer a domain merely to prove a point. Record gaps, owners, and deadlines.
Before selecting a plan, score five areas: business-controlled accounts, complete and documented exports, reproducible restore, transferable operating knowledge, and clear contract exit terms. A low monthly price does not compensate for failure in a critical area. A plan is reasonably portable when the business can leave through a known process without surrendering its identity, records, or ability to operate.
Sources
- About Auth-Code — ICANN
- Tools Export screen — WordPress.org
- wp export — WordPress Developer Resources
- Change of Address tool — Google Search Console Help
- Transferring Your Domain Name — ICANN
- Site Moves and Migrations — Google Search Central