Website handover checklist for volunteer webmasters

Before your volunteer webmaster steps down, make sure the organization, not the person, holds every account the website depends on: the domain, the hosting, the WordPress administrator login, the email and payment services, and Google’s tools. Then get a written note that the organization may keep using what they built, and close their access once someone else has taken over. Doing this while they are still around takes an evening. Doing it after they have gone can take months.

Use the checklist below. It is written for leagues, clubs, associations and other volunteer-run groups, but works for anyone.

Why this matters more than it seems

Volunteers change every year; websites stay for ten. The usual problem is not bad intentions but accounts set up in a hurry, in someone’s personal name, years ago:

The domain renews on a personal credit card and the renewal notices go to a personal email.
The WordPress login is shared, or exists only in one person’s browser.
Google Search Console and Analytics were verified by one person’s Google account.

For .ca domains, CIRA sends its notices by email to the contacts on the record, and keeping those email addresses working is the registrant’s responsibility (CIRA, Registrant Agreement). If the contact is a volunteer who has moved on, nobody hears that the domain is about to expire.

The handover checklist

1. The domain

☐ Which registrar is it with, and when does it expire?
☐ Is the registrant the organization, not the volunteer?
☐ Are the administrative contact email and the registrar account email ones the organization controls (for example, an office or board address)?
☐ Is auto-renew on, with a payment method the organization controls?

If the registrant is the volunteer personally, transfer it to the organization now, while they can approve it. For .ca domains, the current registrant asks their registrar to change the registrant, and the organization has to meet CIRA’s Canadian presence rules. An unincorporated club or association qualifies when at least 80% of its members and of its directors or officers normally live in Canada (CIRA, Canadian presence requirements; general registration rules).

2. Hosting

☐ Who is the host, whose name is the account in, and who pays?
☐ Is there file (SFTP) and database access, and who has it?
☐ Where are backups kept, and when was the last one?

3. WordPress

☐ Does the organization have its own administrator account, held by a named person, not shared?
☐ List every user with the Administrator role.
☐ Take a full backup of files and database before anyone leaves.

When the volunteer’s account is no longer needed, you do not have to lose their posts. When you delete a user, WordPress asks whether to attribute their posts and links to another user (WordPress, Users screen).

4. Email, forms and payments

☐ Which service sends the site’s email (contact forms, receipts)?
☐ Which payment processor handles registrations or donations, and whose account is it?
☐ Where do form submissions go, and does anyone still read that inbox?

5. Google’s tools

☐ Who are the owners in Google Search Console?
☐ Who are the administrators in Google Analytics?

In Search Console, add a board or office account as an owner before the volunteer leaves. Removing someone’s owner access is not enough on its own: a verified owner keeps their verification token (a file, tag or DNS record), and Google warns they can use it to regain access unless you remove it too (Google, Search Console permissions). In Analytics, only administrators can manage users, so make sure the organization has one (Google, Analytics access).

6. Plugins, themes and licences

☐ Which premium plugins or themes does the site use, and whose email are the licences in?
☐ When do they renew?

7. The knowledge

☐ Ask for a one-page note: how the site is put together, what breaks, what they do each month, and anything they meant to fix.
☐ Ask for a 30-minute walkthrough, recorded if they agree.

8. Permission to keep using their work

☐ Get a short written note that the organization may keep, change and use what they built.

This sounds formal for a volunteer, but it matters. Under Canada’s Copyright Act, the author of a work is its first owner. The exception is work made by an employee in the course of employment, and a volunteer is not an employee. Any transfer of copyright has to be in writing and signed (Copyright Act, section 13). A friendly one-paragraph note now avoids an awkward question later. For anything significant, ask a lawyer for the right wording.

9. Close old access

Once the new person is in place:

☐ Remove the volunteer’s WordPress account or lower its role.
☐ Remove them from hosting, registrar, Search Console (and their verification token), Analytics and any other tools.
☐ Change shared passwords, if any remain.

The Canadian Centre for Cyber Security’s guidance for volunteer-based organizations says the same: disable accounts when they are no longer required, give people only the access they need, and use shared accounts only when there is no alternative (Cyber Centre, securing access controls in a volunteer-based organization). A password manager held by the organization makes this far easier next time (Cyber Centre, password managers).

After the handover

Put one person on the board or staff in charge of the list, and review it every year when positions change. If nobody wants the technical side, that is a good moment to read Who should manage your organization’s website?

Disclosure: GMNI takes on volunteer-run sites under Managed Care, and this checklist is how we start.

If you are in the middle of a handover and would like help, schedule a discussion.

Sources (checked 30 September 2026)