The safest time to plan a hosting move is before the first invoice. At that point, the buyer can still reject a service that hides exports behind support, keeps backups inside the same account, or leaves email and DNS ownership unclear.
An Exit Test is a paper rehearsal followed by one small technical proof. It asks whether the client could move the domain, website, and related services without waiting for the original developer or rebuilding the site from a screenshot.
Draw the dependency map
Start with the domain in the middle and add every service that depends on it:
- authoritative DNS provider;
- website hosting and content system;
- business email and mailbox provider;
- transactional email used by forms or the store;
- analytics, search, payment, and social verification records;
- certificate issuance or validation;
- subdomains for portals, campaigns, or APIs.
This matters because moving the website does not require moving the domain, and moving the registrar does not automatically move the website. DNS records can direct the website and email to different providers. A rushed migration often breaks email because the team copies the web records but misses MX, SPF, DKIM, or verification records.
Collect four portable packages
1. Domain package: registrar name, registrant, expiry date, nameservers, lock status, and the process for obtaining the transfer authorization code. Do not store the live authorization code in a general handover document.
2. DNS package: an export of the current zone when available, plus a readable list of every record and its purpose. Cloudflare’s DNS documentation explains how records connect names to services and how DNSSEC adds signatures that help prevent forged DNS responses. If DNSSEC is enabled, coordinate DS-record changes carefully during a DNS-provider move rather than copying settings blindly.
3. Website package: files, database, media, configuration notes, application version, licensed component list, scheduled jobs, and restore instructions. A backup inside the same hosting account is useful for routine recovery but weak as the only exit copy.
4. Communication package: mailbox list, aliases, forwarding rules, mailing service, form destinations, and the DNS records required by each service. Protect this package because it can reveal account structure and recovery routes.
Prove that the backup can become a site
Downloading an archive proves only that a file was produced. A restore test answers the harder question: can the team use it?
- Create a fresh backup using the method included in the proposed plan.
- Restore it to a staging location or isolated local environment.
- Open several pages and media files.
- Submit a test form without sending messages to real customers.
- Sign in with a temporary administrator account.
- Record the duration, missing pieces, and person who completed the test.
- Remove the temporary environment and credentials when finished.
NIST small-business guidance treats backup and recovery as related activities and recommends testing backups so the organization knows it can restore data. The appropriate test frequency depends on how often the site changes and how much data the business can afford to lose.
Know the domain transfer path
For generic top-level domains covered by ICANN policy, the registered name holder typically unlocks the domain and obtains an AuthInfo code. Transfer restrictions can apply, including during the first 60 days after registration, after a previous transfer, or following certain registrant changes. The current ICANN policy also describes registrar obligations around providing the code and removing transfer-prohibited status.
Do not begin a registrar transfer days before expiry or immediately before a major campaign. Confirm contact information, renewal status, access to the registrant email, and the destination registrar first. Country-code domains can follow different registry rules, so check the operator for the specific extension.
Prepare the Launch Handover Pack
The handover should let an authorized person operate the site without reading the developer’s private notes. Include:
| Section | What the client receives |
|---|---|
| Ownership | Completed Domain Ownership Card and named account owners |
| Billing | Renewal dates, payment owner, current plan, and notice windows |
| Access | Password-manager collection, MFA custody, and recovery process |
| DNS | Zone export, record-purpose list, and DNSSEC status |
| Website | Admin access, repository or source package, database and media export |
| Operations | Update owner, monitoring route, backup schedule, and restore runbook |
| Vendors | Support contacts, contract scope, licences, and cancellation process |
| Evidence | Date and result of the latest restore and recovery checks |
Credentials should be transferred through a secure password manager or another approved secret-sharing method, not pasted into an ordinary document or email. Remove the developer’s access after the client confirms that its own access works, unless an ongoing support agreement requires it.
Run the 30-minute Exit Test
A provider passes when the authorized owner can complete or clearly document these actions:
- sign in to the registrar and identify the transfer controls;
- export or accurately reproduce DNS records;
- download current website files and database;
- restore a representative backup;
- identify every email dependency before changing nameservers;
- find the cancellation and data-retention terms;
- name the person responsible for the final move.
A failed test does not always mean the provider is unsuitable. It may mean the plan needs an export add-on, management service, or clearer contract. Price that fix in the Real Cost Ledger. If the buyer cannot obtain a portable copy of essential data or reliable control of the domain, the risk is structural.
The finished journey
The buying order is now complete: understand domain and hosting, assign ownership, match hosting to the team’s responsibility budget, compare full cost, and prove the exit. The result is not a universal provider ranking. It is a purchase record a client can defend and a handover another professional can understand.
How we researched this guide
This article uses ICANN transfer guidance, current DNS documentation, and NIST backup-and-recovery guidance. It is a general operational checklist, not legal, security, or provider-specific advice. Confirm the policies for the chosen domain extension and service before acting. No affiliate links appear in this article.
