SEO Handover Checklist: Accounts, Data and Acceptance

An SEO handover involves more than sending a final report or sharing a website password. A business needs the agreed access, data and documentation to keep its website running when a contract ends, staff change or a new agency takes over.

This guide covers preparation, transfer and acceptance, with a practical checklist for each stage. Adapt it to the service scope, website platform and agreement between the parties.

What is an SEO handover?

An SEO handover is the process of transferring agreed project accounts, data, documentation and deliverables, then confirming that the receiving team can manage the relevant assets and continue operations. It should identify what is being transferred, who is responsible and how completion will be verified.

A handover may take place at contract completion, during an agency change, when an employee leaves or at the end of a phase of SEO services. Changing the provider does not automatically require new hosting, DNS changes or a replacement analytics setup.

Agree on the scope before transferring anything

Review the contract and its annexes to distinguish business-owned assets, project deliverables and the provider’s shared tools. Operational access does not automatically transfer ownership of every software license, platform account or internal method.

• Business assets: Identify the accounts, content, data and configurations the business owns or is entitled to use under the agreement.
• Project deliverables: List the articles, reports, implementation records, code and configurations included in the handover.
• Third-party resources: Clarify whether themes, plugins, images and tool subscriptions can be transferred or require a separate license.
• Out-of-scope systems: Record assets managed by the business or another supplier instead of assuming the SEO agency controls them.

For example, a content-only engagement may not include server administration. A shared SEO tool account used for several clients may remain with the provider, while the client receives project-specific exports where permitted by the agreement and license terms.

Before handover: what should be prepared?

1. Build an account and access inventory

Record each system, sign-in URL, asset identifier, current administrator, receiving email address and required role. Keep passwords, recovery codes and API secrets out of broadly shared tracking documents.

Include Workspace, business email, SSH or registrar access only where relevant to the project’s responsibilities. Avoid requesting access that the receiving role does not need.

2. Prepare project data and evidence of completed work

• Keyword research, topic groups, target URLs and implementation status.
• New and revised articles, images and other transferable content.
• Technical records covering redirects, internal links, canonical rules and hreflang where used.
• Performance reports with data sources, date ranges and filters.
• A list of completed, ongoing and pending tasks, plus known issues.

For significant changes, document the date, responsible person and purpose. Screenshots can support the record, but access to the underlying system or relevant exports makes verification easier.

3. Preserve configurations and suitable backups

For a self-managed website, and where included in the agreement, prepare copies of code, database and media. Record the backup date, relevant environment versions and recovery procedure. For SaaS platforms, identify what can be exported and what remains controlled by the platform.

Technical records may include robots.txt, sitemap locations, redirect maps, schema examples, canonical rules and hreflang. Where these are generated automatically, document the settings or code that controls them rather than relying only on a saved output.

Check that files can be opened and, where appropriate, test recovery in a separate environment. A checksum helps confirm file integrity; it does not prove that a backup is complete or recoverable.

4. Document routine operations

Explain how to update content, manage SEO settings, deploy relevant changes, test the result and return to a previous version if something fails.

Include scheduled tasks, paid services, license expiry dates, notification recipients and support contacts. Match the level of detail to the engagement: a content provider may not be responsible for server deployment instructions.

During handover: transfer access in the right order

1. Confirm the authorized recipient

Agree on the sending and receiving contacts, their email addresses and the assets they are authorized to accept. Verify sensitive or unexpected requests through an established contact channel before granting access.

Prefer business-controlled accounts, enable multi-factor authentication and confirm appropriate recovery methods. Where supported, invite named users rather than sharing personal passwords.

2. Grant access and test it from the recipient’s account

The recipient should sign in independently and check the correct asset and role. The business needs sufficient administrative control to manage its systems, while operational staff should receive permissions appropriate to their tasks.

• Search Console: Distinguish user access from ownership and confirm a verification method the business controls.
• GA4: Review account-level and property-level access. Granting administrative access and moving a property are separate actions; move it only when necessary and eligible under the platform’s requirements.
• GTM: Check both account and container roles, including publishing rights where needed.
• Hosting, CMS and repositories: Confirm working permissions, billing responsibility and account recovery.

Transfer secrets through a controlled channel, such as the organization’s password manager. Record who received access and when. Keep credentials and recovery codes out of general acceptance reports.

3. Check continuity without unnecessary changes

Verify the website, enquiry forms, measurement and essential integrations before and after access changes. Do not replace GA4 or GTM identifiers simply because a different team will manage them.

If DNS, hosting or code changes are required, prepare a separate implementation plan covering backups, ownership of each step, timing, checks and rollback. Use a test environment where appropriate instead of running an unnecessary deployment on the live site.

For sitemaps, check their availability and processing status in Search Console. A submitted sitemap does not mean every listed page has been indexed.

After handover: acceptance and removal of old access

1. Separate handover acceptance from SEO performance

Handover acceptance confirms that agreed assets and documentation have been received, access works and the recipient can take over. SEO performance acceptance assesses results against the KPIs, measurement methods and conditions in the contract.

A single ranking screenshot is not enough to explain overall performance. Reports should identify the period, keyword or URL scope, measurement source and relevant data limitations. Receiving a deliverable does not automatically establish that every performance target was met.

2. Record acceptance and outstanding work

The handover record should identify the project, date, representatives, received items, test outcomes and document locations. For incomplete work, specify the reason, responsible person, deadline and verification method.

Mark an item complete only when supported by evidence. Mark irrelevant items “Not applicable” with a brief explanation rather than leaving ambiguous blanks.

3. Revoke old access after the recipient has checked control

Follow the agreed schedule. Review user accounts, partner access, active sessions, API tokens, SSH keys, shared passwords and connected automation. Rotate or revoke secrets with their dependencies in mind to avoid interrupting services.

In Search Console, removing an owner does not automatically remove their verification tokens. Review remaining methods so an old owner cannot unexpectedly verify again. Remove only the identified token after checking whether another service still depends on it.

Agree on retention periods for backups and logs, the support window and the scope of post-handover assistance. Do not treat a 90-day retention period or 30–90 days of support as a universal requirement.

4. Schedule a follow-up review

The parties may agree on a review after transfer, for example after 7–14 days depending on the project. This is a planning example rather than a mandatory deadline.

Check availability, forms, indexability, redirects and measurement. Distinguish pre-existing issues from problems caused by subsequent changes. For a deeper assessment, consider a separately scoped SEO audit.

SEO handover checklist and acceptance evidence

Adapt this template to the project. Add an owner, due date and status for each item: Accepted / Needs follow-up / Not applicable.

Common SEO handover mistakes

• Sharing only a password: Ownership, recovery details and service dependencies may still be missing.
• Revoking access too early: The recipient has not yet confirmed independent control.
• Rebuilding measurement unnecessarily: Data becomes fragmented or tags fire twice.
• Keeping untested backups: Missing files are discovered only during an incident.
• Leaving open work undocumented: Responsibility and priorities become unclear.
• Assuming every tool is transferable: Project assets, shared accounts and third-party licenses are treated as the same thing.

Frequently asked questions

Does ending an SEO contract require a hosting change?

No. If the business controls its hosting and the website works reliably, updating management access may be sufficient. A hosting migration requires its own assessment and plan.

Should GA4 or Google Tag Manager be recreated when changing agencies?

Not simply because the manager changes. Retain the existing setup where appropriate. If assets must be moved or replaced, assess permissions, data continuity and integrations first.

Must an agency transfer a shared SEO tool account?

That depends on the agreement and license terms. Project-specific exports or replacement arrangements may be appropriate without transferring a shared account containing other clients’ information.

What should the receiving team do first?

Confirm administrative control, backup availability, website operation and measurement. Review open work and renewal dates, then follow the agreed access-revocation schedule.

Keep website operations clear after the handover

A complete SEO handover makes it clear which assets the business controls, where the data is stored, what has been completed and who will handle remaining work. A documented inventory and practical checks help the next team take over with fewer uncertainties.

If you need a website review before taking over or an SEO plan for the next phase, contact VIET SEO to discuss a suitable scope.

References

• Google Search Console: Managing owners, users and permissions
• Google Analytics: Add, edit and delete users
• Google Tag Manager: Managing users and permissions