The person in charge of creating the inn’s homepage has resigned. I would like to review my contract with the production company. I want to hand over management to my family. However, I don’t know who has the contract for the domain and server.
If you delete the old person’s account in this state first, no one may be able to access the homepage, reservations, email, or access analysis. On the other hand, it is also not safe to leave the old person with strong authority even after the contract ends.
This article explains how the host, who is not an IT expert, can safely take over management of the inn site while letting Codex and Claude Code help with organization.
- Conclusion: Confirm that the new person in charge can join, then remove the old authority.
- WordPress is not the only thing to be taken over
- First check the contract name and payment
- Leave a continuous management account under the inn name
- WordPress separates permissions according to roles
- Google services will also be taken over individually
- Separate reservations and payments from normal site management
- Server and DNS takeover will be done with a specialist.
- Safe order on handover day
- Transfer materials to be passed to AI
- Request text to AI that can be used with copy and paste
- Handover completion checklist
- Information used for reference
- Summary
Conclusion: Confirm that the new person in charge can join, then remove the old authority.
Handover will take place in the following order.
- List the services used by the inn
- Check the contract name, billing address, administrator, and recovery destination
- Prepare a continuous management account under the name of the inn.
- Add a new person with the minimum necessary privileges
- Try to see if the new person in charge can log in and confirm.
- Check backup and emergency contacts
- Remove the authority, key, and cooperation of the old person
- Reconfirm public website, reservation, email, and measurement
The basic idea is to add a new individual account and transfer privileges instead of giving the password and taking over.
WordPress is not the only thing to be taken over
Operating an inn site involves multiple contracts and management screens.
| Classification | Things to check | Information not to include |
|---|---|---|
| Domain | Registered company, contract name, renewal date, contact information | Login password, authentication code |
| DNS | Management company, change manager, current usage | API key, secret information for zone change |
| Server | Company, plan, billing address, maintenance staff | SSH private key, root password |
| WordPress | URL, administrator, editor, updater | Password, 2-step verification recovery code |
| Administrator, representative address, forwarding destination | Email password, text | |
| Analytics, Search Console, Tags | Google Account Password | |
| Reservations | Reservation engine, OTA, inventory synchronization, person in charge | Reserver information, payment information |
| Payment | Contract corporation, administrator, payment destination, accountant | Card information, private key, identity verification documents |
| External collaboration | SMTP, backup, monitoring, SNS | API key, access token |
What is recorded in this table is “where, who, and what is managed.”Confidential information itself is managed in a separate secure location, such as through an organization-approved password management tool.
First check the contract name and payment
Accessing the admin screen is not the same as owning the contract. Check the bill, contract email, card details, and contractor display on the management screen.
Especially important is the domain. If your domain expires or is no longer under the control of your old production company, it will affect not only your site but also your email. ICANN advises that domain registrants contract with registrars to manage contact information, transfers, and renewals.
Record the following as “confirmed”, “confirming”, or “unknown”.
- Official contractor/registrant
- Renewal deadline and automatic renewal status
- Billing and payment method administrator
- Email address to receive update information
- Person who can approve contract changes and transfers
- Contact information and contract number storage location
Instead of letting the AI guess what you don’t know, ask questions to your contract partner or current production company.
Leave a continuous management account under the inn name
If you make your personal email address the only top-level administrator, you run the risk of losing control due to resignation, illness, or unavailability.
Prepare a contact point that the inn can continue to manage, and arrange at least the following:
- There is an administrator at the inn who can manage the property.
- Update recovery email/phone number
- Enable 2-step verification
- Store recovery methods in a safe place
- Prevent one person from being the sole administrator
- Add production companies and personnel using individual accounts
However, avoid using the same password for the representative email for everyone. Separate accounts for which the inn maintains ownership and individual accounts used by each person in charge on a daily basis.
WordPress separates permissions according to roles
Official WordPress separates the operations that can be performed by role, such as administrator, editor, and poster. Someone who is only in charge of updating articles does not necessarily need administrator privileges to add plugins and manage users.
Items to check when transferring:
- Inn administrator account
- Production company/maintenance company account
- Person in charge of updating articles and their roles
- Unused users
- Display name and public profile
- Target of 2-step verification
- Authentication for external posting/cooperation
Do not remove the old administrator before confirming the new administrator’s login. If you need to remove the author, also check what happens to the article’s attribution.
Google services will also be taken over individually
Add new contacts to Analytics or Search Console instead of sharing the same Google account. Google Analytics allows you to manage users and permissions on an account or property basis. The visible range changes depending on the layer you add, so only add the necessary range.
What to check:
- Google Analytics account and GA4 properties
- Search Console properties and verified owners
- Google tags and tag management methods
- Google Business Profile
- Google Ads if you are using ads
- Channel authority when operating YouTube
Official Google advises that if there is only one administrator, there is a possibility of losing control if that person becomes unavailable. The authority of the old person in charge will be removed, leaving the inn as the continuing administrator.
Separate reservations and payments from normal site management
Reservations and payments include guest information, sales, refunds, and payment details. Do not copy the reservation person’s name or card information to the WordPress transfer table.
Check the following management relationships.
- Contractor and billing address
- Top level administrator
- Authority of person in charge of daily operations
- Who can change the deposit destination
- Who can issue refunds or cancellations?
- Cooperation with OTA and site controller
- Retired person/former production company account
- Operation history and contact information
Deposit destinations, refunds, and reservation changes are not performed by AI alone; humans confirm the target and amount. Use the official procedures for each service to verify your identity and change your business information.
Server and DNS takeover will be done with a specialist.
Changes to your server, DNS, TLS certificates, or email delivery can bring your site or email down. Please do not change the settings even if it is to pass them on to a new person in charge.
Please check the following with your technical representative.
- Server method and administrator
- Distinction between production and verification environments
- In charge of backup storage location and restoration
- DNS management location and current usage
- How to update TLS certificate
- SSH/SFTP/Management API users
- Monitoring notifications and contact information in case of failure
- Terms of use for production company-specific themes and plugins
Before removing the old contact’s SSH key or API key, test that the new route can provide the necessary confirmations. Instead of pasting the private key into chat or transfer materials, a new key will be issued and the old key will be invalidated.
Safe order on handover day
1. Record the state before the change
Check the arrival status of public pages, reservation pages, inquiries, emails, and management screens. Record the target and time and take any necessary backups.
2. Add a new person
Add a new individual account with the minimum necessary privileges. You will need to check the invitation email and set your own password and two-step verification.
3. Confirm with the new person in charge
In addition to being able to log in, check whether you can see the screens necessary for your work and whether you can change unnecessary screens.
4. Check the recovery route for the inn name
Make sure that your old contact’s email or phone number is not the only destination for recovery. The recovery code itself is not written in the work report.
5. Remove old permissions
Check the contract end date and agreement details, and remove old accounts, SSH keys, API keys, forwarding destinations, and external linkages for each target. Check them one by one instead of deleting them all at once.
6. Reconfirm the publishing side
Check access to the top page, reservations, inquiries, HTTPS, email, and Analytics/Search Console. If there is a problem, stop making additional changes and find out which changes caused the effect.
Transfer materials to be passed to AI
AI helps organize asset ledgers and unconfirmed matters. However, we do not include confidential information in the materials.
Service name: [Example: Domain management]
Usage: [Keep site and email name]
Contract name: [Accommodation/Corporation/Confirming]
Administrator: [Role name. Do not write personal passwords]
Authority: [Administrator/Editor/Viewer]
Renewal/Billing: [Monthly only. Do not write card number]
Restoration person: [Inn side/Production company/Confirming]
Official contact: [Official support URL]
Unconfirmed matter: [Question content]
Last confirmed date: [year/month/date]
With this format, you can ask the AI to “extract unknown items” and “arrange them by person in charge.”Specify that authentication information is managed separately.
Request text to AI that can be used with copy and paste
Organize without changing the current situation
In preparation for a change in the person in charge of the accommodation site, please organize the management targets.
Please do not add/delete accounts or change settings yet.
Domain, DNS, server, WordPress, email, Google, reservation, payment,
Regarding backup and monitoring, contract name, administrator, billing, recovery destination,
Please list unconfirmed items.
Password, API key, private key, recovery code, and reservation information are
Do not read it or include it in the output.
Create a question to pass to the production company
From the list of managed targets you created, please create a question to ask your current production company.
Questions include contracts, ownership, rights, backups, usage licenses,
Please arrange in the order of transfer after cancellation and suspension of old account.
Don't make assumptions about what you don't know, and include an answer section and a deadline for confirmation.
Do not ask us to email you the credentials themselves.
Audit before removing old permissions
Please create a confirmation list before removing the authority of the old person in charge.
Login of new person in charge, accommodation administrator, recovery route, backup,
Please include public site, reservation, inquiry, email, and Google measurement.
We only investigate and make suggestions, such as account deletion, key revocation, DNS change, etc.
Please do not change the contract.
Handover completion checklist
- [ ] I have confirmed the domain, DNS, and server contracts.
- [ ] Confirmed contract name, billing address, and renewal deadline.
- [ ] We have secured a continuing manager for the inn.
- [ ] There is only one administrator.
- [ ] The new person in charge is using a personal account
- [ ] Set the minimum necessary permissions
- [ ] The new person in charge was actually able to log in.
- [ ] Confirmed recovery contacts and 2-step verification
- [ ] Confirmed backup and restore personnel
- [ ] Reservation/payment information is not copied to regular materials.
- [ ] Confirmed the old contact’s account, key, and link.
- [ ] Re-confirmed public website, reservations, inquiries, and emails.
- [ ] Verified permissions for Analytics and Search Console
- [ ] Recorded the handover date and confirmation results.
If you don’t know the server system, click Which type of WordPress is yours?.Daily permission design is explained in Permission design when letting AI access the production server, and monthly review is explained in Monthly inspection of accommodation facility sites.
Information used for reference
- ICANN: Information for domain registrants
- WordPress official: Authority groups and permissions
- Google Analytics official: User and authority management
- Google official: Google tag user management
Summary
When handing over an inn site, it is not enough to hand over just the WordPress password. Check contracts and management privileges one by one, including domains, servers, email, Google, reservations, and payments.
Add a new person with an individual account, confirm that they can actually use the person, and then remove the old authority. AI can be entrusted with listing, creating questions, and creating confirmation sheets, but humans must check confidential information, contract changes, payments, and account deletions.
