Website handover checklist. What to check yourself before you sign off

The contractor emails a link and says the site is done. It looks fine on your laptop, and it is tempting to reply "approved" and move on. This website handover checklist is for the afternoon before you do that, because sign-off is the last point where fixes are obviously part of the job.

After you sign, every change starts with a conversation about whether it was in scope. You can check almost everything below yourself, without a developer.

The website handover checklist starts on a phone

Begin with speed. Go to pagespeed.web.dev, paste your address and look at the mobile result, because Google's test shows phone and desktop separately. A score of 90 or above is the green zone, and that is enough. Chasing 100 rarely changes anything a customer will notice.

The score is a measurement on a given day, not a promise. Run the same test twice and you can get different numbers, because the network and the server are never in exactly the same state. So write the score into your handover notes together with the date.

Then pick up your own phone, not a narrowed browser window on your computer. Text should be readable without zooming, the menu should open and close, and the page should not slide sideways. Tap the phone number in the footer too. It should open the dialler straight away.

Forms and the privacy policy

Fill in every form on the site and actually send it. Then open the inbox where enquiries should land, the one you really read every day. Check the spam folder as well.

A "Thank you, your message has been sent" screen proves nothing. A site can show it while the message never arrives, because mail sending was never set up or enquiries still go to the contractor's test address.

Next to each form there should be a short note on what happens to the data and a link to the privacy policy. Check that the policy exists and names your company, rather than being text carried over from some other site. Whether the wording is right is something to check with a lawyer. It is not a question for a developer.

SSL, the domain and your logins

The padlock next to the address means the connection is encrypted. Type the address starting with plain http, without the s, and see whether the browser moves you to https on its own. Click through a few subpages too, since a warning sometimes appears only further in.

The domain should be registered to you. For .pl domains the public WHOIS lookup at dns.pl shows the registrar, the renewal date and whether the owner is a person or a company. It does not show the owner's name. You see the owner in your own account with the registrar. If you have no such account, that is your answer.

Before you sign off, you should hold:

• a login to the hosting, set up on your own email address,
• a login to the domain registrar account,
• an administrator account in the site's admin panel,
• access to the code, ideally an invitation to the repository.

Also ask where the backups are kept and who restores them when needed. A backup that sits only on the same server as the site will not help when that server is the one that fails.

Small things you can see in the address bar

Add something that cannot exist to the end of your address, for example /handover-test. You should get a "page not found" page. If the home page opens instead, Google sees what looks like endless copies of your home page under different addresses.

Type the address once with www and once without. Both should end up on one and the same address in the bar. If each one stays where it is, a search engine may treat them as two separate sites.

Finally, look at the tab title on a few subpages. That is usually the title Google shows in search results. Every page should have its own, and if every tab says the same thing or shows the name of a template, put it in your notes. The short description for Google is not visible in the browser, so ask the contractor about page descriptions directly.

What our scan checks for you

Our free website scan covers part of this list automatically. You enter the address, and the scan runs Google PageSpeed and checks SSL, security headers, the domain, the SPF and DMARC mail settings, basic SEO, privacy and cookie signals, and what search and AI crawlers can see. It is not a legal assessment. It shows what is missing, not whether your documents comply with the law.

No outside tool can tell you whether your forms reach the inbox or whether a backup can actually be restored. That part stays with you.

Put all your remarks in one email and send it before you sign off. A written list gets handled faster than comments made over the phone.