When One Developer Holds All the Website Knowledge: A Handover Plan
Built for UAE websites that need monthly care, safer updates, and a clearer support routine after launch.
Short Answer
To reduce single-developer risk, keep every website account in the business name with two admins, ask the developer for a short runbook, give everyone individual logins and rehearse a handover once a year.
A UAE business may run its website on the work of one trusted freelancer. The arrangement can work very well, with fast replies and a developer who knows every corner of the site. The weak point is not the person but the concentration of knowledge. If that developer falls ill, travels or takes a full-time job, everything may simply pause.
This guide explains how to spread that knowledge across more people without replacing anyone. It covers which accounts need a second administrator, what a short runbook should contain and how to share access safely. It ends with a simple yearly drill that proves the plan actually works. Nothing here requires changing developers, only writing things down and sharing access properly.
What is the bus factor, and why does it matter for a website?
The bus factor is the number of people who could become unavailable before work on a project stalls. If only one person knows how to deploy, renew and restore your site, the number is one. That is a business continuity risk, not a criticism of the developer.
A website with a bus factor of one can keep running for months without any trouble. The problem appears when something breaks during that person's absence, such as an expired domain or a failed update. Then every fix waits until the developer returns.
Quick Answer
A website's bus factor is how many people could become unavailable before work stalls. If one freelancer alone can deploy, renew and restore the site, the business carries concentration risk.
Which website accounts need more than one administrator?
Every account the site depends on should belong to the business, with at least two administrators. That covers the domain registrar, DNS, hosting, code repository, analytics, Google Search Console and any email sending service. The freelancer remains one administrator, but never the only one.
Platform documentation points in the same direction. GitHub recommends at least two organisation owners, because its projects can become inaccessible when a sole owner is unreachable. Google warns that if all verified Search Console owners are removed, the remaining users lose access after a grace period.
Quick Answer
Every website account, from domain and hosting to the code repository and Search Console, should belong to the business with two administrators. GitHub recommends at least two owners per organisation.
What should a website runbook contain?
A runbook is a short document explaining how the site is built, deployed, backed up and restored. It should list where the code lives, how a change reaches the live site and how to restore yesterday's backup. Renewal dates for the domain, hosting and certificates belong there too.
Add the third-party services the site uses, such as payment gateways, form tools and map keys. Record where each secret is stored, never the secret itself. Pay the developer for this time, because documentation is real work and deserves a fair fee.
Quick Answer
A website runbook explains how the site is built, deployed, backed up and restored, with renewal dates and third-party services. It records where secrets are stored, never the secrets themselves.
How do you share access without sharing passwords?
Give every person an individual login rather than one shared administrator account. WordPress, for example, describes the Administrator role as having access to all administration features of a site. Each administrator should be a named person whose access you can remove later.
Keep shared secrets, such as registrar logins, in a password manager the business owns. Link two-factor authentication to company phones or company email addresses, not to personal ones. When anyone stops working on the site, remove their access the same week and note the change in the runbook.
Quick Answer
Give each person their own website login, keep shared secrets in a business-owned password manager and tie two-factor authentication to company devices. Remove access promptly whenever someone leaves the project.
How do you test the handover plan before you need it?
Run a handover drill once a year, with a second developer following only the runbook. Ask them to restore a recent backup to a staging site and deploy a small change. Every question they have to ask you is a gap in the documentation to fix.
The second developer can be a trusted freelancer or an agency on a small support agreement. They do not replace your main developer and only step in for emergencies or planned absences. Agree how they would be paid and contacted before anything goes wrong.
Quick Answer
Test the plan yearly by asking a second developer to restore a backup to staging and deploy a small change using only the runbook. Fix every gap the drill reveals.
Main Takeaways
A bus factor of one is a business risk, not a judgement of your freelancer. Put every website account in the business name with at least two administrators. Ask for a short, paid runbook covering deployment, backups, renewals and services. Give everyone individual logins, and run a yearly drill where a second developer restores and deploys using only the runbook.
Making your website independent of any one person
Relying on one good developer works well, right up until the day that person is unavailable. A few hours of documentation and account housekeeping turns a single point of failure into a manageable risk. None of it requires changing who builds or maintains your site. It simply makes sure someone else could step in quickly if the need ever arises.
Start with the account checklist in our guide on who owns your website, then compare freelancer and agency support for your stand-in. Auronix Web Studio can act as that second developer through its website maintenance plans. A yearly drill can then be added to the same plan. Send us your site address, and we will review what the runbook needs.
Sources & References
FAQs
Questions readers usually ask next
These FAQs are written to match the topic of this post and to help readers move from understanding to action.
Will my freelancer be offended by a handover plan?
Explain it as business continuity, not distrust, because a plan protects the freelancer's holidays and illness. A freelancer may also welcome documentation that reduces urgent calls when they are away.
How long should a website runbook be?
A few pages can be enough for a small business website. It should be short enough to read in one sitting, and specific enough that another developer can follow it.
Who should hold the domain registrar login?
The business should hold it, in an account registered to the company. Your developer can be added as a user or given access when a DNS change is actually needed.
Should the code be in a repository we own?
Yes, keep the code in a repository under a business-owned organisation account, with your developer as a member. Then every change is recorded, and nothing depends on one person's laptop.
What if my site was built without version control?
Ask your developer to place the current live code into a business-owned repository now. It is a one-off task, and it gives any future developer a clean, documented starting point.
Do we need a second developer on a retainer?
Not necessarily, but you do need someone agreed in advance. A small support agreement or an hourly arrangement can both work, provided contact details and payment terms are already settled.
How often should the runbook be updated?
Update it whenever the hosting, deployment or a major service changes, and review it at each yearly drill. An outdated runbook can actively mislead a stand-in developer during an emergency.
What should happen when a freelancer stops working with us?
Remove their personal logins, rotate any shared passwords and confirm the runbook is current. Thank them, ask for any missing notes and keep their contact details for any later questions.
Can an agency reduce the bus factor instead?
An agency can spread knowledge across several staff, but check who actually works on your site each month. The same runbook and account rules still apply, whichever supplier you choose.
Is two-factor authentication a risk for handovers?
It can be, if login codes only go to one person's personal phone. Register company devices or shared recovery methods, and store backup codes securely in your business password manager.
Related Resources
Need a maintenance partner after launch?
We help UAE businesses keep forms, updates, backups, speed, SEO, and tracking under control so the site stays useful and easy to trust.
Built for WordPress, Shopify, and custom sites that need monthly care or AMC support.
