What you should hold.
WHAT YOU SHOULD HAVE
Domain registrar access Hosting account access Site administrator access Any third-party service account used by your site
WHAT ABOUT PLUGIN AND THEME LICENCES
Ideally in your name.
If bought on the developer's account, you lose updates when the relationship ends.
WHAT TO ASK
Whose account holds each licence What each costs annually What happens if it lapses
WHY THAT MATTERS
An unupdated plugin becomes a security problem.
WHAT TO RECORD
Every service the site depends on Who holds each account What each costs and when it renews
WHAT TO AVOID
Depending on credentials only the developer has Services you cannot see or control
WHAT TO DO IF THE DEVELOPER HOLDS THINGS
Ask for them to be moved into your name.
Now, not later.
WHAT A REASONABLE DEVELOPER DOES
Sets things up in your name from the start, and explains why.