When a website agency leaves, review every account that can change, run, measure or bill for your restaurant’s website. That usually means the site editor, hosting, analytics, connected ordering and reservation services, payment-related accounts, and the email addresses used for login and recovery.
Give a named restaurant-controlled account the appropriate access to each service, check that it works, and then remove access the departing agency no longer needs. The order matters: removing an agency’s only administrator before transferring control can leave you locked out when you need an urgent menu change.
List the accounts behind the website
Start with the website itself, then follow the connections around it. Ask the departing agency for an account list, the access level it holds, the billing contact and any renewal dates it knows. Ask your manager or bookkeeper for invoices and company email records that may reveal subscriptions the agency missed.
For each service, record the provider, what it does, who can administer it and which email address receives important notices. Do not put passwords, recovery codes or payment card details in a shared handover spreadsheet.
- Website editor or content management system: Who can publish pages, change menus, manage users and alter settings? An editor who can update a lunch special may not be able to invite a replacement administrator.
- Hosting and technical services: Who can manage the server or website hosting account, backups, certificates and deployment? Some builders bundle these functions; other sites use separate providers.
- Analytics and advertising: Who can view reports, administer the analytics property or manage advertising accounts? Check whether the restaurant can retain access to historical reporting when the agency leaves.
- Connected services: List ordering, reservations, forms, email marketing, accessibility tools and any other services linked from or embedded in the site. Identify who controls each connection, not just who edits the page containing it.
- Billing and recovery: Note the account owner, invoice recipient, renewal contact and recovery method for each service. These roles can belong to different people.
Domain access belongs on the list, but it is a separate ownership question with its own details. Use the domain ownership guide for that review; do not assume control of a domain also gives you control of the website editor or its other accounts.
Assign named, owner-controlled access
The restaurant should be able to reach an administrator for each important service without relying on the former agency. That does not mean the owner must perform every technical task. It means the business has a named person with enough authority to manage access or work with the provider when something goes wrong.
Use individual accounts where the service allows them. A named account makes it easier to see who can make changes and to remove one person without disrupting everyone else. Give a new agency the permissions it needs for its job, rather than automatically making every staff member an administrator. Ask which tasks require higher access and whether those permissions can be reduced after setup.
Consider a hypothetical independent restaurant changing agencies. The owner handles contracts, a manager updates the menu, and a new agency maintains the site. The owner needs administrative access or a reliable business-controlled route to it. The manager may need publishing access but not billing controls. The new agency needs the access required to maintain the site; the exact level depends on its agreed work.
There is a trade-off. Restricting access can reduce accidental changes, but permissions that are too narrow can slow urgent fixes. Decide who can approve a temporary increase in access and when it will be reviewed. Also name a backup restaurant contact for key accounts, using a separate login where supported. Avoid making a shared agency inbox the sole recovery route.
If the current site is difficult to administer, compare the practical editing and account controls of another restaurant website builder. Ask whether your team can make routine changes without an agency, what access a contractor needs and how you would retrieve your content if you later leave.
Check the handover before removing access
Arrange a short overlap between the departing agency and the person taking over. Agree on the handover date, the work each party is responsible for during that period and who can reverse a change if something breaks. Request a current backup or export where available, along with instructions for restoring it. Having a file is useful only if someone knows what it contains and how to use it.
Before removing the old agency, sign in with the restaurant-controlled account and check the permissions that matter. For example, can the owner view the user list and invite or remove a user? Can the manager open the menu editor? Can the new agency reach the hosting settings it needs? Check each service separately; successful access to the website editor does not prove access to analytics or hosting.
For the hypothetical restaurant above, a safe practice check could use a draft page or preview to change a sample menu description, then discard the draft. Separately, confirm that the ordering and reservation links point to the intended destinations. Do not place a real order, make a real card payment, send a guest message or dispatch a courier as part of this practice check. A preview confirms only the parts visible in that environment; it does not prove that every live transaction or integration will work.
If a live service pilot is needed, plan it separately with the relevant providers and staff. Agree on its scope, authorization and how any real transaction or guest communication will be handled before starting. Keep the previous contact available for an agreed period if possible; a handover check reduces uncertainty but cannot guarantee uninterrupted service or prevent every lost order.
Once the required access and handover materials are confirmed, remove the departing agency’s individual users from each service as appropriate. Review shared credentials and access tokens with the incoming technical contact before changing them: a connection may depend on them. Replace or revoke them in a coordinated way, and check the affected connection afterward. Record what was removed, by whom and when.
Use a handover matrix for recovery and billing
The matrix below shows how the hypothetical restaurant could divide responsibilities. It is a working example, not a claim that every provider offers the same roles. Add a row for each actual account and replace the role descriptions with named people and confirmed permissions.
| Account or service | Restaurant control | Agency access | Handover check |
|---|---|---|---|
| Website editor | Owner administers users; manager edits menu | New agency maintains pages as agreed | Owner views users; manager opens a draft |
| Hosting and backups | Owner has administrative or provider-supported recovery access | New agency has access needed for maintenance | Identify backup location and restoration contact |
| Analytics | Owner can administer access and view reports | New agency receives agreed reporting access | Confirm the correct property and historical reports are visible |
| Ordering and reservations | Owner controls the relevant business accounts | Access limited to agreed setup or support tasks | Check account access and link destinations without a live transaction |
| Billing and recovery | Owner and designated backup receive appropriate notices | Departing agency is not the sole contact | Review invoice, renewal and recovery details for each service |
The last row applies across the other rows, not to one universal billing account. A website subscription, hosting account and ordering service may each have different invoices and recovery settings. Check them individually.
For recovery, verify that the listed business email addresses and phone numbers are current and controlled by the people named. Review multifactor authentication and backup methods with each provider. Where a provider offers a safe recovery verification process, follow it with the account holder present. Store recovery codes securely, with a designated backup who can find them; do not paste them into the matrix.
For billing, check who receives invoices, who can update payment details and when each subscription renews. Ask whether a service is billed directly to the restaurant or through the agency, and what must change for it to continue after the contract ends. Do not cancel an agency-billed service until the replacement arrangement is clear. Ask the providers for written quotes covering recurring charges, transfer or setup work, and any one-time costs. A qualified adviser can help with contract or tax questions.
Put the completed checklist beside your service agreements and review it whenever an employee or agency changes. To evaluate another setup, ask Fleksa about its restaurant website and online ordering, including verified US availability, account roles, recovery options and how your team would manage access after an agency handover.
Frequently asked questions
Should I remove my agency’s website access immediately?
First confirm that a restaurant-controlled account has the necessary permissions and that the replacement contact has what they need. If there is an urgent security concern, contact the relevant provider promptly and coordinate access changes with someone who can maintain the site.
Does owning my domain give me access to my website?
Not necessarily. Domain, hosting, website editing and connected services can be separate accounts. Check access and recovery for each one.
What should I ask for if the agency pays for hosting?
Ask who owns the hosting account, what is included in its bill, whether the site can be transferred or exported, and what must happen before agency billing ends. Confirm the replacement arrangement before canceling anything.
