A Website Handover Checklist for Non-Profits

Every few months I get the same phone call. A treasurer, a board chair, sometimes a new executive director, and the sentence is always a version of “the person who set up our website left, and we can’t get into anything.” The site still works, for now. Nobody can change a word on it. The domain renewal notice is going to an email address that no longer exists. This is the most common website emergency I see, and it’s preventable with one document and an afternoon.

Why this keeps happening to non-profits

Volunteers rotate. Staff move on. The website was set up in a hurry by whoever was handy, using their own email address because that was easiest that day. Nothing was wrong with any of that. The problem is that nobody wrote it down, and the organization never owned the accounts. When that person leaves, the website leaves with them, even though it’s still on the screen.

The six accounts that make up a website

People think of a website as one thing. It’s at least six, each with its own login, and losing any one causes a different kind of trouble.

• The domain registrar. Where your address, yourorganization.org, is rented year by year. Lose this and the site can vanish on a renewal date, or someone else can register the name.
• Hosting. The computer the site lives on. Lose this and you can’t fix anything when it breaks, and you can’t move away.
• The website itself. The WordPress login, or whatever your site runs on. Lose this and nobody can update a word.
• Email. The @yourorganization.org addresses, especially the one that receives the renewal notices for everything above.
• The donation processor. Where the money lands. Lose this and you may lose the money, or spend a month proving to a company that you’re you.
• Your files. The logo, the photos, the annual reports. Usually scattered across the laptops of people who no longer volunteer. That’s its own article.

The handover document

One page, kept somewhere two people can find it. For each of the six accounts, four lines:

• What it is and which company: “Domain, registered at Namecheap.”
• Whose name and email it’s registered under. This should be the organization, not a person. If it’s a person, that’s the first thing to fix.
• Who has the login today, by role where you can: “the treasurer and the web designer.”
• When it renews and how it’s paid. Renewal dates and the card on file. This line prevents the vanishing-website phone call.

Don’t write the passwords on this page. Put them in a password manager the organization controls, and write on the page where that is and who holds the master key. Two people, always. One is a single point of failure; three starts to get loose.

Fixing ownership while everyone is still friendly

The best time to move accounts into the organization’s name is before anyone has left. The steps are dull and they take an afternoon.

• Create a role email address the organization controls, such as admin@yourorganization.org, that forwards to two people. Every account below gets registered to it.
• At the registrar, change the account email and the domain contact details to the organization. If the domain is in a former volunteer’s personal account, ask them to transfer it to yours. Registrars have a standard process for this and it’s free.
• At the host, do the same, and add a second administrator.
• In WordPress, make sure the organization has at least one administrator account of its own, not only the designer’s. Then remove the accounts of people who have left.
• At the donation processor, update the account owner and the bank details contact. This one has the strictest identity checks, so do it while the current owner can still approve the change.
• Write the renewal dates on the handover page, and put them in the organization’s shared calendar with a reminder a month ahead.

How I set this up for my own clients

Every site I build starts this way: the domain and the hosting are in the organization’s name, on an account the organization owns, and I hold a key rather than the deed. The handover page is part of the launch, and the care plan includes keeping it current when people change. You’re welcome to use the format whether or not we ever work together.

If you’re locked out right now

Don’t panic and don’t rebuild. Start with the domain, because it’s the one with a clock on it. Find out where it’s registered with a WHOIS lookup, and contact that registrar with proof that you’re the organization. Then hosting, then WordPress. Most of the time everything can be recovered in a week or two with patience and paperwork. If you’d like a second pair of eyes, send me what you know and I’ll tell you the order to do things in, free.

Questions people ask right after this one

Our designer says they will always be here, so does this matter? Designers move, retire, and occasionally vanish. A good one will be glad to move the accounts into your name. The ones who resist are telling you something.

Can the domain and hosting be at the same company? They can, and for a small organization that’s often simpler. Keeping them separate protects you if one company goes bad, but only if you keep the logins organized.

What if the old volunteer won’t respond? Registrars and hosts have ownership dispute processes. You’ll need your organization’s registration documents and patience. Start the process anyway; the clock on the domain doesn’t wait.

How often should we check the handover page? Twice a year, when the board changes, and any time someone with a login leaves. It takes ten minutes.