What I Include in a Website Handoff and Maintenance Plan
Document ownership, deployment, recovery, monitoring, and support boundaries so a website remains maintainable after launch.
I consider a website handoff complete when the owner can identify each service, reach the right account, deploy a tested change, restore a backup, and know who handles maintenance. A folder of credentials does not meet that standard.
I build the handoff during the project. Waiting until launch turns operational decisions into a hurried inventory and increases the chance that one account remains tied to a temporary developer address.
Create the ownership inventory
I list the domain registrar, DNS provider, hosting platform, source repository, CMS, database, email service, analytics, monitoring, and third-party integrations. Each row names the business owner, technical administrator, billing owner, renewal date, and recovery contact.
The inventory records account names and safe identifiers, not passwords or recovery codes. Credentials stay in an approved password manager or secret store.
Document deployment
I write the production branch, build command, environment requirements, deployment trigger, expected job stages, and post-deployment checks. The handoff names the commit currently deployed and the process for promoting a reviewed change.
I include a small rollback procedure with the prior artifact or commit. Database or infrastructure changes get separate recovery notes because code rollback may not reverse them.
Prove backup and restore
The plan identifies what the backup covers: database, uploaded media, configuration, and any external content. It lists retention, encryption, owner, and last restore-test date.
I restore a representative backup in an isolated environment and verify pages, records, media, and authentication. A green backup notification without a restore test remains an assumption.
Assign monitoring and updates
I document uptime checks, error alerts, form-delivery monitoring, security updates, dependency reviews, certificate and domain renewal, and content ownership. Each alert needs a recipient and response expectation.
The maintenance plan states which updates are routine and which require a quote or approval. That prevents urgent support from turning into an argument about scope.
Remove temporary access
After acceptance I remove test users, temporary tokens, staging bypasses, and my access where ongoing support does not require it. Shared passwords rotate and personal developer accounts stop owning business assets.
I ask the owner to test account recovery while project contacts are available. An ownership transfer that cannot survive a lost phone is incomplete.
Hold a handoff session
I walk through the inventory, publish a safe change, review an alert, and locate the recovery procedure. The recipient records questions and confirms responsibilities in writing.
- Business-owned accounts control core services.
- Deployment and rollback are documented.
- Restore evidence is current.
- Maintenance work has owners.
- Temporary access is removed.
Need help putting this into practice?
Terry Hunt Dev provides ongoing website maintenance and structured project handoffs. Request a handoff or maintenance review through the contact page.