A local business website handoff should let an authorized successor operate the site without sharing a former contractor's personal account or guessing who controls the domain. The notes should map ownership, access, dependencies, routine work, and recovery evidence. Store secrets in the approved credential system, never in the handoff document.
Identify the property and accountable owners
Record the canonical public URL, business name, legal or billing owner, technical owner, content approver, and emergency contact. List the registrar, DNS provider, hosting platform, content system, analytics property, search property, form provider, email service, and any appointment or commerce service. For each, name the account owner and renewal or review date without copying card numbers or credentials.
Map access by role
List current members, their scope, and why each role is required. Prefer named accounts and the narrowest practical permissions. Cloudflare documents account- and domain-scoped roles with materially different powers; its Super Administrator can manage members, billing, purchases, and broad account settings. A handoff should therefore say which role was verified, not merely that someone has Cloudflare access.
Record domain custody without exposing transfer secrets
Document the registrar, registered name holder or business owner, renewal date, auto-renew status, recovery contact, and approved transfer process. ICANN describes an Auth-Code as required for moving a generic top-level domain between registrars. Record where an authorized owner can request it, but never place the code itself in routine notes. Confirm that renewal notices reach a monitored address owned by the business.
Capture search and analytics ownership
List the Search Console property type, verified owners, full and restricted users, verification method, analytics property, tag or container, and reporting owner. Google states that Search Console property owners manage users and permissions, and that unused ownership tokens may need review. The incoming owner should be able to open the correct property and explain the verification path without removing a working token during the handoff.
Explain publishing and integration workflows
Describe how a page moves from draft to approval to publication, who may edit hours and contact details, and how to roll back a release. Inventory forms, maps, analytics tags, consent tools, structured data, social links, and third-party embeds. For each integration, record its purpose, owner, data destination, failure signal, and removal procedure. Do not claim a form works until a harmless test submission is received at the expected destination.
Add monitoring and recovery
List uptime, certificate, domain-renewal, form-delivery, crawl, and error checks with cadence and owner. Identify the last known-good backup, what it includes, where it is retained, and the last restore test. A downloadable backup is not enough if nobody has confirmed how DNS, media, databases, and external services reconnect.
Run an acceptance test
Have the incoming owner sign in with a named account, inspect the domain and hosting state, open Search Console, publish and reverse a harmless test change, submit a test form, and locate the recovery instructions. Record results and unresolved gaps. Remove or reduce outgoing access only after business-owned control and recovery paths are verified.
Close the handoff
Record both parties, acceptance date, open risks, temporary access, renewals due soon, and the next review. The handoff is complete when the incoming owner can identify every critical provider, perform routine work, verify public behavior, and recover the site without depending on the departing person.
Sources
- Managing owners, users, and permissions — Google Search Console Help
- Account roles — Cloudflare Docs, Oct. 2, 2026
- About Auth-Code — ICANN
- Domain Name Transfers — ICANN