List the domain registrar, hosting, DNS, CMS, email, analytics and connected services. The business should have its own owner account wherever possible. An admin password alone does not prove control of the domain.
Take a file and database backup, then test restoring it in a separate environment. Record active licences, scheduled jobs and external API connections. Ask for the deployment procedure and outstanding issues.
Transfer access through a secure channel. Rotate personal credentials and keys after handover, with a plan for services that could stop when a key changes.




