Transferring website ownership step by step: why the order matters

Websites · About 5 minutes to read

Website handovers rarely fail because something cannot be transferred. They fail because things move in the wrong order: a domain frozen for 60 days because the owner details changed first, a site offline because DNS switched before the new server was ready, email lost because nobody copied the MX records. This order avoids those traps:

1. Asset list and escrow
2. Domain, before any owner details change
3. Hosting
4. DNS and email
5. CMS, plugins and licences
6. Analytics and Search Console
7. Site move, if the domain changes
8. Credentials, then confirmation

1. Agree the asset list first

Write down everything the price includes: domain, hosting, files and database, mailboxes, CMS accounts, premium themes and plugins with licence keys, analytics, tag manager, Search Console, social profiles, email lists and every third-party service the site uses. Anything not listed is not in the deal. For a fuller inventory, use Escrozon's checklist for handing over a website safely.

Then put the payment into escrow: the seller knows the money exists, and it stays put until the buyer confirms. See how escrow holds the payment during a handover.

2. Registrar transfer or change of registrant?

If the buyer wants their own registrar, transfer the domain first and change the owner details only after it arrives.

• Registrar transfer: the domain moves to a registrar the buyer chooses, using an authorisation code (the policy calls it the AuthInfo code) that the seller supplies after unlocking the domain.
• Change of registrant: the domain stays where it is, but the owner's name, organisation or email address changes to the buyer's.

For generic domains such as .com, the ICANN Transfer Policy sets the timing:

• A registrar may deny a transfer requested within 60 days of the domain's registration or of a previous registrar transfer.
• After a change of registrant, the registrar must lock the domain against registrar transfers for 60 days, unless it offered an opt-out beforehand and the owner took it. Changing only the owner's email address counts.
• Once a transfer is requested, the registry completes it unless the current registrar refuses within five calendar days.

So do not let the seller add the buyer's email beforehand, and check the domain's registration and last transfer dates before agreeing a timeline. Staying with the seller's registrar? Use its process for moving a domain between accounts. For country-code domains, check the registry's own rules.

3. Hosting: migration or account handover

Migrate if you can: copying the site to hosting the buyer controls leaves nothing in an account the seller once ran.

4. DNS and email (MX) records

Copy the whole DNS zone first: every A, AAAA, CNAME, MX and TXT record, including those for email authentication and service verification. If the seller's registrar also hosts the DNS, do this before the registrar transfer, because the records may not travel with the domain.

• Recreate the records at a DNS host the buyer controls, check them line by line, then switch the nameservers. Point the records at the new server only after the migrated site passes testing.
• MX records decide where email goes. Miss them and mail stops, often silently. Decide first whether existing mailboxes move or the buyer creates new ones.
• After the switch, send test emails from an outside address and submit the contact form. Keep the old setup running for a few days while cached DNS answers expire.

5. CMS admin, plugins and licences

Give the buyer their own accounts and licences, not the seller's logins.

• The seller creates an administrator account in the buyer's name. The buyer logs in, reassigns any content the seller authored, then removes the seller's accounts.
• Ask each premium theme and plugin vendor how its licence transfers. If it cannot, the buyer buys a licence and enters their own key.
• Replace every API key in the settings (email sending, forms, maps, backups, spam filtering) with the buyer's own.

6. Analytics and Search Console

Use Google's own user tools, never the seller's login.

Google Analytics

The seller adds the buyer's Google account as an administrator; the buyer then removes the seller.

Search Console

The buyer verifies with their own token (an HTML file, HTML tag or DNS record), then removes the seller's tokens and any delegated owners the seller added, as Google's help on managing Search Console owners and users describes. Verify yourself first: if all verified owners are removed, the remaining users lose access after a grace period. A seller verified through Google Analytics or Tag Manager stays verified until their rights there are removed.

7. If the domain changes

If the buyer folds the site into their own domain, or the seller keeps the domain and sells only the content, follow Google's guidance on site moves with URL changes. Map every old URL to a new one, use server-side permanent redirects such as 301 or 308, verify both sites in Search Console, and submit a Change of Address for the old site. Google advises keeping the redirects generally at least one year, and says a medium-sized site can take a few weeks or more to show its new URLs.

That changes the deal: if the seller keeps the old domain, the buyer's traffic depends on their redirects for at least a year. Put that in the agreement, or buy the old domain too.

8. Change every credential, then confirm

As each account arrives, change its password and recovery details and remove the seller's access. Before confirming the deal, sweep:

• registrar, hosting and control panel accounts;
• SFTP and SSH logins, including authorised SSH keys;
• database users, CMS administrators and mailboxes;
• DNS, CDN, backup and connected social accounts, plus API keys;
• recovery emails, phone numbers and two-factor devices.

A recovery phone number the seller still controls is a back door.

Never share personal account passwords

A seller should never hand over the password to their personal email or Google account, and a buyer should never ask for it. Every step above uses a service's own transfer or ownership feature instead. If the only way to hand something over is a personal login, move the asset out of that account. And before trusting anyone to hold the money, check what to look for in any escrow service.