Every agency has an onboarding checklist and almost none has an offboarding one. Yet the last month of a care plan is where most of the lasting damage gets done: a backup nobody can open, an admin account that still works a year later, a domain that renews on your card for a client who left in spring. Here is the handover we use, in order, with the time each step costs.
Why the exit matters more than the exit interview
A client leaving is rarely a crisis. A client leaving badly is a slow one. Three things go wrong when you just cancel the subscription and move on.
First, liability stays with you. If you hold the only copy of their backups, and their new host loses the site in March, the phone call comes to you, not to the new host. Second, access leaks. Your agency account, your staff's accounts, your SFTP key and your API tokens all keep working until someone removes them, and "someone" is now nobody. Third, the money gets messy: you keep paying for a domain, a plugin licence or an offsite bucket on a client's behalf, and the final invoice turns into an argument instead of a receipt.
The fix is a short written procedure, run the same way every time, finished with a signed-off handover note. Ours takes about two and a half hours of staff time for a typical site. At $100 an hour that is $250, against a care plan that was paying $100 to $200 a month. Two months of margin to close an account cleanly beats an open-ended support obligation you no longer bill for.
Step 1: fix the end date in writing
Before you touch anything technical, agree the date on which the plan ends and everything after it is somebody else's. Put it in an email the client replies to.
Set the end date at least 14 days out, even if they want to leave today. You need that fortnight to run the steps below without rushing, and the client needs it to get their new host or freelancer ready.
State explicitly that monitoring, updates and backups stop on that date. Clients tend to assume it just carries on. A sentence like "from 30 November we no longer monitor, update or back up the site" is blunt, but it is the sentence that saves you a 2am call in February.
If you wrote a proper contract at the start, the notice period and the handover clause are already in it. If you didn't, the first 30 days checklist covers what should have been in there, and offboarding is a good moment to add it for the clients who stay.
Step 2: hand over a backup they can actually restore
"We sent them a backup" and "they have a backup they can use" are different things. A backup inside your management tool, in a format only that tool reads, is not a handover. Neither is a 4 GB zip on a sharing link that expires in a week.
What to deliver: a full-site archive (files plus a database dump) in a plain format, a second copy of the database as an uncompressed .sql file, and a one-paragraph note saying which WordPress and PHP versions it was taken on. Put it somewhere the client controls, not somewhere you control. If they have no storage of their own, a password-protected archive in their own cloud storage account is fine. Then ask them to confirm, in writing, that they have downloaded it and opened it. That confirmation is what closes your liability.
Keep your own copy for 30 days after the end date, then delete it. Keeping client data indefinitely after the contract ends is a data-protection problem, not a courtesy. The where should your backups live post explains why the agency should own the backup location during the plan; after the plan, that ownership has to end.
Step 3: remove every credential you ever created
Make a list before you start deleting; for a typical site it runs to between eight and fifteen entries.
- WordPress admin accounts for your agency and each staff member, plus any application passwords those accounts hold
- Hosting panel logins, SFTP or SSH keys, and any deploy keys in the host's dashboard
- Your management plugin and its connection key, plus any monitoring, SEO or form plugins licensed under your agency account
- DNS and registrar access, CDN accounts (Cloudflare and similar), transactional email services, and payment-gateway API keys you set up for them
Work through the list in this order: hand the client a new administrator account they control (and confirm they can log in), then remove your accounts, then remove your plugins and keys, then revoke third-party access. The order matters because removing your own admin account first, before the client has one that works, is how you lock everybody out.
Plugins licensed to your agency need a decision, not just deletion. If the client's site depends on a premium plugin you pay for, tell them the renewal price and the date it lapses, and let them buy their own licence. Do not leave it running on your key; it stops updating the day your subscription ends, and you get blamed.
Step 4: DNS, domain and SSL ownership
Domains and DNS hide the longest-lived problems, because nothing breaks on the day you leave. It breaks eleven months later when the registrar bills a cancelled card.
Who is the registrant and who pays for the domain? If it is your agency, transfer it to the client or move the billing to their card now, while they are still answering your emails. Where is DNS hosted, and who has the login? If the nameservers point at your Cloudflare account, the client needs their own account and a zone transfer, or they will be unable to change anything after you go. How is the SSL certificate issued? A host-issued certificate (Let's Encrypt on their hosting) renews itself and needs nothing. A certificate you bought and installed needs its expiry date in the handover note.
Give the client the expiry dates of the domain and the certificate, in plain text, in the handover email.
Step 5: the final invoice and the handover note
The last invoice should contain nothing surprising, so decide the surprises now. Pro-rate or don't, but say which. Itemise anything you paid on their behalf that they are taking over (domain, licences, offsite storage) with the date your payment stops. Charge for the handover time only if the contract said you could; if it didn't, eat the $250 and write the clause into the contract for the next client.
Send the invoice with the handover note, one page, covering the end date, where the backup is and that they confirmed it opens, which accounts were removed and when, the domain, DNS and SSL positions with expiry dates, and anything still open with a named owner. Here is the timing we plan against:
| Step | When | Staff time |
|---|---|---|
| End date agreed in writing | Day 0 | 15 min |
| Backup delivered and confirmed | Day 1–5 | 45 min |
| Client admin created, agency access removed | Day 5–10 | 45 min |
| Domain, DNS, SSL ownership settled | Day 5–12 | 30 min |
| Final invoice and handover note | Day 12–14 | 15 min |
| Delete your copies of their data | Day 44 | 5 min |
That is 2 hours 35 minutes, which is where the $250 above comes from. Most of it is waiting for the client, so start the clock early.
A note on tooling: the parts of this that are tedious are the parts a management dashboard already tracks. WPClientHub's activity log gives you the dated record of what was done and by whom for the handover note, user management lets you create the client's admin and remove your team's accounts across the site from one screen, and domain and DNS expiry monitoring shows you the dates to put in the note before you disconnect the site.
Where this leaves you
A clean exit is cheap, it protects you from the slow liabilities, and it is the one thing a departing client will tell other people about. Write the procedure down once, give it a two-week clock, and run it the same way every time. If you want the access, backup and expiry dates for every client site in one place before the next offboarding, WPClientHub is free for 3 sites, with paid plans from $19/month.