When taking over a website from a previous developer, the first job is not design or new features. It is making sure your business holds every login that controls the site: the domain, the DNS, the hosting, the website admin, email and the Google accounts. Once you hold those, you can remove the old developer’s access safely and decide what to change next.
This guide is a practical checklist for UAE business owners whose developer has moved on, stopped replying or handed the project to someone new. It works whether the handover is friendly or not.
Access comes before anything else because a website is a chain of accounts. If one link in the chain sits in someone else’s name, they can take the site offline, redirect your email or block changes, often without meaning to. We regularly see a Dubai clinic or a Sharjah trading company whose domain was registered under the old developer’s personal account, or whose hosting renews on a card nobody at the company owns.
Until you know who holds each account, any redesign, migration or SEO work is built on ground you do not control. So the order is always: list the accounts, get access in the business’s name, then remove old access.
The accounts to collect
Ask the previous developer, or search your company inboxes and invoices, for each of these. The table shows what each account controls and what level of access you need.
| Account | What it controls | Access you need |
|---|---|---|
| Domain registrar | Who owns the name, renewals, nameservers | Account login in the company’s name |
| DNS (registrar, Cloudflare or host) | Where the site and email point | Full edit access |
| Hosting or server | Files, databases, backups, SSL | Main account login, plus SFTP or SSH |
| Website admin (e.g. WordPress) | Content, plugins, users, settings | Administrator role |
| Business email | Mailboxes, password resets | Admin login for the email service |
| Google Search Console | Search data, sitemaps, indexing | Owner |
| Google Analytics | Visitor and conversion data | Administrator |
| Paid plugins, themes and apps | Updates and support licences | Licence keys or the vendor account |
For a WordPress site, ask for an account with the Administrator role, not Editor or Author. The WordPress roles and capabilities documentation describes the Administrator as the role with access to all the administration features of a single site; the Editor role is limited to managing content.
Domain and DNS: check these first
The domain is the one account you cannot easily replace. Hosting can be moved and a site can be rebuilt, but if you lose the domain you lose your address, your email and your search history.
- Look up which registrar holds the domain and log in to that account yourself.
- Check that the registrant (owner) details name your company, not the developer or their agency.
- Check the contact email on the domain is a mailbox your company controls, so renewal and transfer notices reach you.
- Note the expiry date and turn on auto-renew with a company payment method.
- Find where DNS is managed. It may be at the registrar, at Cloudflare or at the host. You need edit access there too.
For .ae names the rules on who can register and how transfers work are set by the registry. We cover them in our guide to .ae domain registration requirements.
Hosting, files and backups
Hosting is where the site actually runs. Ask for the main hosting account login, not just an FTP user, because only the main account lets you see billing, backups and renewal dates.
- Confirm whose name and card the hosting is billed to.
- Take your own full backup (files and database) and store a copy outside the hosting account.
- List what else lives on the same account: other domains, old copies of the site, staging sites, extra databases.
- Check the SSL certificate is valid and renewing automatically.
If the site is on the old developer’s own server and they want to close it, you will need to move it. Plan that carefully so email and the site keep working; see how to move a website to new hosting without downtime.
Google Search Console and Analytics
These two accounts hold your search and visitor history. If you lose them you can start new ones, but the history stays behind.
In Search Console, ask to be added as an owner. Google’s help page on managing Search Console users and owners explains that only owners can add and remove users. It also warns that a removed verified owner can regain access through their old verification tokens (an HTML file, a meta tag or a DNS record), so those tokens need to be removed as well.
In Google Analytics, ask for the Administrator role at account level. According to Google’s guide to adding and removing Analytics users, deleting users needs the Administrator role at account level, so property-level access is not enough to clean up later.
Remove old access safely
Once your business holds every account above, remove what the previous developer no longer needs. Do it in this order so nothing breaks:
- Take a fresh backup.
- Change the main passwords: registrar, hosting, email admin and the website admin.
- Delete or downgrade the old developer’s user in the website admin. In WordPress, reassign their posts to another user when deleting.
- Remove old FTP, SFTP and SSH users and any SSH keys you do not recognise.
- Remove management or remote-access plugins you did not install.
- Check the site’s admin email address in the settings points to a company mailbox.
- Remove the old developer from Search Console (and their verification tokens) and from Analytics.
- Move paid plugin and theme licences to a company vendor account, or plan to buy new ones.
Do not delete the old developer’s access until you have tested that your own logins work for every account. Locking everyone out is a worse problem than a few extra days of shared access.
When the previous developer will not hand over
Sometimes the developer has disappeared or the relationship has ended badly. Start with what you can prove you own.
- Domain: contact the registrar directly with your trade licence and proof of payment. The registrar, not the developer, decides who the registrant is.
- Hosting: if the account is in your company’s name, the host can reset access for you. If it is in the developer’s name, you may need to rebuild from a backup or from the live site.
- Google accounts: if you can edit the site files or DNS, you can verify Search Console ownership yourself.
If there is a contract or scope document, check what it says about ownership of the domain, code and accounts. For legal disputes, speak to a lawyer; this guide covers the technical side only.
Frequently asked questions
Who should own the domain name?
Your business should be the registrant, with a company email as the contact. A developer can manage the domain through access you give them, but should not own it.
Is an Editor login enough to take over a WordPress site?
No. You need the Administrator role to manage plugins, themes and users. Without it you cannot remove the old developer’s account.
Can I keep my Google search history if I change developers?
Yes, if you are added as an owner in Search Console and an administrator in Analytics before the old developer leaves. The data belongs to the property, not to the person.
Should I redesign the site straight after taking it over?
Secure the accounts and take backups first. A redesign can wait until you know what the site runs on and who controls each part.
If you are taking over a site and want a developer to check the accounts and handle the cleanup, our web development team can help. Send us a short brief through our contact page and we will reply with a fixed quote.
