The Exit File: What a Clean CMS Handover Actually Looks Like

When an agency hands back the keys to a CMS, the handover often arrives as a shared drive, a Friday call and a vague promise that everything is in there. That is not a handover. It is a hope.

For UK web teams, the risk is practical rather than dramatic. The site stays up, so nobody panics. Then a plugin renewal fails, a DNS record needs changing, a redirect breaks, or a new developer asks for the theme repository and everyone looks at the floor. The exit file should be a contractual, testable deliverable — not a courtesy.

Put a named owner and a dated plan in charge

The moment notice is served, name an internal handover owner. That person should not be the marketing intern who once updated a banner. They need authority to chase the agency, sign off deliverables and escalate to procurement or legal if the contract is vague.

Ask for a dated handover plan with acceptance criteria. A useful plan covers access, licences, code, content, integrations, documentation and a test window. The final payment should be tied to acceptance, not to a polite email saying the files are on their way.

Prove admin access instead of assuming it

Start with the accounts that control the CMS, hosting, domain registrar, DNS, CDN and email sending. Ask for super-admin access, not editor accounts. Check multi-factor authentication, single sign-on settings, API keys, integration accounts and any service users the agency created.

Then test it. Log in from a device and network the agency does not control. Create a test page, publish it, unpublish it, restore a backup, and check that password resets go to your team. If the agency is the only owner of the domain or the cloud account, fix that before the notice period ends.

Untangle licences and recurring contracts

List every paid component: the CMS licence itself, premium plugins, theme support, fonts, stock image subscriptions, form services, email delivery, search, analytics and hosting. For each one, record who holds the contract, who pays, the renewal date and how ownership transfers.

UK teams should also check whether licences are tied to an agency account or to your organisation. A plugin licence that cannot be transferred is a cost, not a handover item. Get the transfer in writing and confirm the vendor has updated the account before the agency stops answering emails.

Take the code, not just a zip file

Ask for ownership of the theme and any custom code repositories, including commit history. A zip file with no history is better than nothing, but it makes future debugging harder. You want the Git repository transferred, build scripts documented, environment variables listed and deployment steps written down.

Test a deployment to a staging environment. If nobody on your side can build and deploy the site without the agency on a call, the handover is incomplete. Also ask where secrets live, how they are rotated and which ones need changing on exit.

Map integrations and redirects

Integrations are where quiet failures live. Check the CRM, payment provider, forms, email marketing, analytics, tag manager, search service and any booking or membership tools. For each one, confirm who owns the account, where the credentials are stored and what breaks if the agency revokes access.

Redirects deserve their own section. Ask for an export of the redirect map, a list of high-traffic URLs and the rules for canonical domains, trailing slashes and HTTP-to-HTTPS. Then test the top 50 URLs by traffic, plus any campaign links still in the wild. A redirect map that exists only inside the old agency's memory is not an asset.

Export content in a form you can actually use

Content export is not just a database dump. Ask for pages, posts, media, metadata, taxonomies, users and forms in a portable format. Check that internal links still point somewhere sensible after import, that alt text survives and that media files are not trapped in a proprietary library.

Run a sample import into a staging CMS. If the export only works inside the agency's tooling, you have not received your content; you have received a hostage note with a filename.

Write the runbook and test the handover

The final deliverable is a short runbook: architecture diagram, hosting layout, backup and restore process, deployment steps, support contacts, licence renewals and known quirks. Keep it in your own document store, not in a shared folder controlled by the agency.

Then run acceptance tests. Can you publish a page? Restore a backup? Submit a form? Change a DNS record? Trigger a redirect? Update a cookie banner? If the answer is no, the handover is not done.

The exit file checklist

• Named internal owner and dated handover plan
• Super-admin access to CMS, hosting, DNS and registrar
• Licence transfer confirmations and renewal dates
• Git repository ownership, build scripts and deployment notes
• Integration accounts, credentials and ownership
• Redirect map export and top-URL tests
• Portable content and media export
• Backup and restore test
• Runbook and support contacts
• Signed acceptance before final payment

A clean handover is boring in the best way. Nobody needs a dramatic rescue later. They just need the exit file to be complete, tested and owned by the organisation that paid for the site.