How to Transfer Website Ownership Safely

A website is not one asset. It is a domain, a hosting account, a codebase, a database, a set of third-party services, and often a payment processor — each with its own transfer process and its own way of going wrong. Most failed transfers are not fraud. They are one forgotten credential discovered three weeks later, when the seller has stopped replying.

Before Anything Moves: The Inventory

Sellers should prepare this list, and buyers should ask for it before agreeing a price.

Domain — registrar name, account access or an authorisation (EPP) code, and confirmation the domain is not inside its 60-day post-transfer lock.

Hosting — provider, plan, control panel access, and whether the plan transfers or the buyer needs their own.

DNS — where records are managed. This is frequently not the registrar. Cloudflare in front of a site is the single most-forgotten item in a website sale.

Code — repository access or a complete archive, plus deploy instructions.

Database — a dump taken at handover, not one from three months ago.

Email — whether the domain handles mail, and where those mailboxes live.

SSL — certificate provider, or confirmation it is auto-issued.

Third-party services — analytics, CDN, error tracking, transactional email, payment processors, and any API keys the site needs to function. List every one, including the free-tier ones.

Licences — premium themes, plugins, fonts, and stock images. Note which are transferable; some are not.

The Transfer Sequence

Order matters. Doing these in the wrong sequence causes downtime.

1. Open escrow first. Nothing transfers before funds are committed. On Escrozon the buyer's payment is held before any credential changes hands, which protects both sides — the seller knows the money exists, the buyer knows it is not released until they confirm.

2. Hand over code and database. These are non-destructive: the seller keeps a copy, the buyer gets one. Low risk, so do it first.

3. Buyer stands the site up independently. Before touching DNS, the buyer should run the site somewhere they control — locally or on their own hosting. This is the single most valuable step in the whole process, and the one most often skipped. If it cannot run without the seller's machine, you have found that out while you still have leverage.

4. Transfer third-party services. Analytics, CDN, email. Change ownership rather than sharing passwords where the platform supports it.

5. Move hosting. Deploy to the buyer's environment and test against the live database.

6. Move DNS, then the domain. DNS first so the site keeps resolving during the registrar transfer, which can take up to five days.

7. Buyer verifies fully, then confirms. Only now does the seller get paid.

8. Rotate every credential. Every password, every API key, every token. The seller had them; assume they still do.

Where Transfers Actually Fail

The forgotten Cloudflare account. The site resolves through a proxy the seller set up years ago and forgot. Symptom: DNS changes appear to do nothing.

A domain inside its transfer lock. A domain moved or registered within 60 days cannot be transferred. Check the date before agreeing a timeline.

Non-transferable licences. Some premium plugins license to a person, not a site. The buyer inherits software that can no longer receive updates.

Hard-coded credentials. API keys committed into the codebase, still tied to the seller's accounts. Grep the repository for anything resembling a key before you confirm.

Payment processor assumptions. Stripe and PayPal accounts generally do not transfer. The buyer needs their own and must reconnect. If the site has active subscriptions, migrating them is a genuine project — resolve it before purchase, not after.

Email that dies quietly. Nobody tests mail during a transfer. Send a real message from the contact form after DNS moves.

Safety Rules for Both Sides

Keep everything in the deal chat. It is your evidence if anything is disputed, and on Escrozon it is monitored for scam patterns.

Never send credentials by email or an outside messenger. Use temporary passwords the buyer changes immediately.

Sellers: do not delete your copies until the buyer has confirmed and the escrow has settled. Buyers: do not confirm receipt until you have run the site independently.

Agree a support window in writing — a week or two of answering questions is normal and costs the seller little. Silence after handover is the most common complaint in website sales.

Frequently Asked Questions

How long does a full transfer take? Code and hosting in a day. The domain registrar transfer takes up to five days by design. Plan for a week.

Can I transfer the domain without the auth code? No. If the seller cannot produce it, they may not control the registrar account — a serious warning sign.

Should DNS or the domain move first? DNS. Point records at the new host while the domain still sits with the old registrar, so the site stays up throughout.

What if the site breaks after transfer? Most breakage is environment configuration — a missing key or a PHP version difference — which is why standing the site up independently before confirming matters so much. Agree a short support window up front.

Do I need a written contract as well as escrow? Escrow handles payment risk. A short written scope handles expectation risk — what is included, what is not, and what support follows. The listing description plus the deal chat usually serves, provided both are specific.