Client offboarding checklist: hand over the keys, then step out
The final files are delivered and the last invoice is out. On paper, the project is over. Yet part of it may still sit under your name: a domain registered with your email, an admin seat on the client’s site, design files living in your own drafts.
Files and formats are the easy part, and our handoff checklist covers them. This client offboarding checklist covers what doesn’t fit in a folder: the accounts, registrations and logins the work runs on. The end state is simple. Your client controls everything the work depends on, and you can no longer get in.
Start with everything in your name
Every client offboarding checklist starts with one list, made before you move anything. Write down every account you created for this client and every login they gave you. Add keys and integrations you set up, subscriptions on your card and files that live only in your drive. If you kept an access list at kickoff, as we suggest when you work alongside in-house teams, this is where it pays off.
The list looks different by discipline. A developer’s runs to hosting, the CMS, the code repository and analytics. A designer’s centers on design files and font or stock licenses. For a copywriter or strategist, it’s shared drives, email platforms, social schedulers and any posts still queued under your login.
Check whose name is on the domain
ICANN, the nonprofit that coordinates domain names, warns in its registrant FAQ that a developer “may have registered the domain name using their own contact details.” That can happen even when the client paid them to register and manage it. The client may then need proof of payment to show their registrar they are the rightful holder.
If the domain is registered to you, the fix starts at the registrar. A second FAQ, on transfers, says a change of registrant begins with the current registrar, and the confirmation typically goes by email to the registered name holder. That means the change is yours to start, since the confirmation comes to you. This guidance covers generic domains like .com. For a country-code domain, such as .ca, ask the registrar how its process works.
Common platform traps to check before your last day
Each tool handles ownership its own way, and some common behaviors can catch you out. These details are as each company documented them when we checked in October 2026. Recheck them before you work through the client offboarding checklist.
Google Drive. Google’s help page says that if you work from a work or school account, you can only transfer ownership of files to someone in your organization. You also can’t transfer a file from a personal account to someone with a work or school account. If either case fits your project, plan another route, such as the client downloading the files and uploading them to their own Drive.
Figma. Figma’s help center warns that when you delete your account, it also deletes any files in your drafts, “regardless of who owns them.” Transferring ownership doesn’t move a file, either. So move client files out of your drafts into a space the client controls before changing your account.
GitHub. The GitHub Docs say the original owner of a transferred repository stays on as a collaborator. Webhooks, secrets and deploy keys remain attached too. A transfer to another personal account expires if the new owner doesn’t accept it within one day, so tell the client it’s coming. Once it lands, ask them to remove you and replace any keys you created.
WordPress. On a self-hosted site, the Users screen doesn’t show you a Delete link for your own account, per the WordPress.org documentation updated in October 2024. Another administrator has to remove you. When they do, WordPress asks whether to delete your posts or attribute them to another user, so ask them to attribute yours to their own account. Your hosting, SFTP and database logins sit outside WordPress, so they belong on your list too.
Your client offboarding checklist, in order
The order matters as much as the items. Remove yourself too early and the client may be locked out of something only you could reach. Stay in “just in case” and you leave a door open that nobody is watching.
- List what you hold. Use the inventory above, and note whose name, email and card each item sits under.
- Move registrations into the client’s name. Start the domain change at the registrar. Start file and repository transfers from your side.
- Give the client their own logins. Invite their accounts as owners or admins instead of sending your password. The small-business cybersecurity guidance from the US Federal Trade Commission (FTC) says not to share passwords “on the phone, in texts, or by email.”
- Ask the client to confirm each login. They should open every account themselves, from their own device, while you’re still around to fix what fails.
- Write a one-page access record. For each account, note what it does, whose name it’s under, who the admin is and when it renews. For a website, the same FTC page advises businesses to “clarify from the beginning who will manage your website after it’s built.” Ask the client for that name and put it in the record.
- Step out. Remove yourself wherever the platform lets you, and ask the client’s admin to remove you everywhere else. Ask them to change any shared password you ever knew.
- Confirm it in writing. Send one message that lists what moved, to whom, and that your access is gone.
Stepping out meets the standard your clients are given
Removing yourself can feel abrupt, as if you’re closing a door on the client. Yet the guidance written for your clients points the same way.
The US Cybersecurity and Infrastructure Security Agency (CISA) published its Cybersecurity Performance Goals 2.0 in December 2025, written for “businesses and critical infrastructure owners of all sizes.” They recommend an offboarding process that revokes all access to systems and facilities, and they name departing staff “who may include contractors, vendors” in scope. The goals are voluntary and aimed at the business, not rules for you. Even so, when you step out without being asked, you’ve met that standard before the client has to raise it.
What you keep after the handover
The last item on your client offboarding checklist is your own record of the handover: the access record, the client’s confirmations and your final message. Keep no client passwords and no copies of their keys. Whether your working files stay with you depends on your contract, so check it before you delete or archive anything.
If you offer support after the project closes, give it a clear end date. Otherwise a quick favor next spring can send you back into accounts you’ve already left.
The test for a finished handover
A month from now, could your client renew the domain, add a page or edit a file without calling you? And if you tried to log in tonight, would every door stay shut? That’s the whole client offboarding checklist in two questions. When both answers are yes, the project has actually ended.
Work with The Blue Mango. The Blue Mango is a creative services co-op. If you run client projects, see how The Blue Mango works with creators.