Which documents does an agency need before a website project starts?

Four packages: content (copy, images with provenance, logo as a vector file), master data (legal company name, register, opening hours, locations), credentials (domain, storage, mailboxes, business profile) and decisions (structure, people authorised to sign off, fixed dates). A single directory with five sub-folders, filled continuously, has proved itself. Whatever is missing on the start date moves the launch — not as a penalty, but arithmetically: the build begins once it is settled what is being built.

Who writes the copy for the new website?

That is an agreement, not a given. Three routes are common: you write and we edit, we write after interviews and you review the content, or we take on the entire text as a service of our own. All three work, but they cost different amounts of time and money. Settle it in the quotation, with a word count per page and the number of review rounds. A site with twelve pages typically runs to 6,000 to 9,000 words.

Which credentials do I have to hand over, and which not?

What is handed over is not a shared password but a separate account per service provider, with appropriate rights and an end date. Usually needed: domain administration, storage and database, the administrator account of the existing system, and management of the business profile. Not needed: access to accounting, inventory management or HR systems. Wherever personal data is processed, a data processing agreement belongs with it (GDPR Art. 28(3)).

How long does a website project take?

For twelve to twenty pages without a shop, six to eight weeks is realistic if the handover pack is largely complete at the start. If content is missing, the project extends by the time the late delivery takes, not by the build time. A shop, further language versions or connections to existing systems extend the build phase further. A dependable statement only becomes possible after the structure has been settled — before that, any number is an estimate.

How many correction rounds are usual?

Two rounds are the standard case: one on the design, one on the populated test version. More important than the number is the form: one named person, a deadline of five working days, and one collected, internally agreed response. Contradictory wishes from several departments should be resolved before they are passed on. Further rounds are possible and are then quoted as effort, so the price stays comprehensible.

What happens to the old website and the old addresses?

The old addresses are recorded before switch-off and redirected to the matching new pages, so that search engines and linking sites still arrive somewhere. That list can only be produced while the old site is still reachable — after that, gaps remain. In addition, a complete backup is kept: database, files, mailboxes. Transferring the domain requires the AuthInfo code, which expires after 30 days (DENIC).

Preparing a website project: content, access, dates

A website project rarely fails because of the technology. It fails because of the image folder nobody can locate, the login only a departed colleague ever had, and the sign-off everyone waits four weeks for. Yet the starting position is clear in most companies: in 2025, 92 per cent (Bavarian State Office for Statistics) of Bavarian companies with at least ten employed persons had a website. The next project is therefore rarely a first appearance; it is a rebuild during ongoing operations — with content, credentials and contracts that already exist. That is precisely why preparation decides the launch date. This article describes what a client supplies, when they supply it, and where projects get stuck in practice.

Key takeaways

The date depends on your material: copy, images, logo and master data are the precondition for the first design, not its outcome.
Credentials usually sit with service providers today. 54 per cent (Federal Statistical Office) of companies with ten or more staff buy paid cloud services; among those with 10 to 49 staff it is 51 per cent.
A .de domain transfer needs an AuthInfo code. It expires after 30 days (DENIC), so it is requested to match the transfer date.
Image rights are settled before anything is published: if the types of use are not listed explicitly, the scope follows the purpose of the contract (German Copyright Act).
Mandatory imprint and privacy details come from inside your company (Digital Services Act, Germany). They can be neither estimated nor copied.
Two planned sign-off rounds with a named person and a deadline are usually enough — provided the structure and the goal were settled beforehand.

Why preparation decides the launch date

The sentence "we want to go live in October" describes a wish, not a plan. Whether it holds depends on three things: the size of the site, the number of decision makers, and the day the content is complete. The first two can be settled in a conversation; the third cannot — it depends on how much material already exists in the company and what condition it is in. In practice, the difference between a six-week project and a six-month project is almost entirely a difference in supply. Build time itself varies comparatively little; how the price is composed is shown in our pricing overview and in what a website costs.

On top of that, the feature set determines how much you have to supply. Among Bavarian companies with their own website, 27 per cent (Bavarian State Office for Statistics) provide online ordering, reservation or booking systems, and 64 per cent (Bavarian State Office for Statistics) advertise vacancies or online applications on their own site. Each of these features pulls its own deliverables along: opening hours and capacities for booking, role profiles and a named contact for the careers page, product data for selling. Anyone who discovers these features only at the design stage pushes the date back by exactly the time it takes to gather that data.

The launch date is a result, not a wish

Do not tie the go-live to a date, tie it to a condition: "four weeks after the handover pack is complete". That turns into a date as soon as the pack is there — and the formula makes it visible who is currently holding the schedule. It sounds uncomfortable, but it prevents the most common disappointment in a project: a date nobody has mentioned since week one that slips anyway.

What has to be settled before the first design

A design is the answer to a question. If the question is not settled, what emerges is a pretty picture with no connection to the business — and three correction rounds later, a fundamental discussion about goals that belonged in week one. So before the first design we settle four points: audience, offer, desired action and site structure. Structure has the greatest leverage, because it fixes navigation, volume of copy and image requirements at the same time; how to derive it is described in our article on information architecture. Only once these four points fit on a single sheet of paper does a design have a yardstick it can be measured against.

Audience and occasion: who lands on the page, with what question, and what should happen afterwards?
List of services: which offerings get a page of their own, and which are only mentioned?
Site structure as a tree: main navigation, sub-pages, footer — with a working title for each page.
Existing addresses: which URLs exist today, and which ones should be preserved?
Contact person and a deputy for holiday periods, with a direct line rather than a shared mailbox.
A person authorised to sign off each area: specialist copy, prices, legal texts, image selection.
Fixed dates that cannot move: a trade fair, the start of a season, the end of the old provider contract.
Budget range and decision path, so that additional wishes do not meet an empty pot.

Content: copy, images and master data

Content is the part only you can supply, and the part most often underestimated. A company site with twelve pages typically runs to 6,000 to 9,000 words — written, proofread and approved. The work can be shared: we take it on as a copywriting service, you supply raw material and technical review, or you write and we edit. Which route applies belongs in the scope of the quotation, not in a later conversation. A project in which both sides assume the other one is writing the copy loses several weeks quickly. What matters when writing is collected in website copy that sells.

With images, what counts is provenance rather than quantity. Every shot needs a traceable source: your own photograph, a commissioned photographer with a written agreement, or licensed material with a documented scope. This is not a formality: if the types of use are not expressly listed individually when a right of use is granted, the scope is determined by the purpose of the contract agreed by both parties (German Copyright Act). So a photo taken for a trade fair stand does not automatically cover the website. How to keep and store the evidence is described in our article on image rights and proof; the technical side — formats, sizes, crops — is covered in optimising website images.

Copy and raw material

Existing brochures, quotation texts, technical articles and notes from customer conversations are better raw material than a blank page. Supply unfinished material early rather than finished material late — editing is faster than inventing.

Images with provenance

One line per shot: who took it, when, what agreement is in place, and did the people shown consent? That line takes thirty seconds and saves a later hunt for a contract from years ago.

Master data

Legal company name, register number, VAT identification number, opening hours, locations, direct dial numbers, bank details for invoices — collected in one file instead of spread across six messages and three people.

The one-folder rule

Create a single directory — "website handover" — with sub-folders for copy, images, logos, legal texts and credentials. Everything the project needs lives there and only there. Two effects: you can see at any time what is still missing, and nobody has to search mailboxes for the latest version. If you like, add a text file per sub-folder recording the state as of Friday.

Access: domain, hosting, mailboxes, profiles

Credentials are the second large block — and the one where something is missing most often. The reason is structural: 54 per cent (Federal Statistical Office) of German companies with ten or more staff buy paid IT services as cloud services, among those with 10 to 49 staff it is 51 per cent (Federal Statistical Office), and 76 per cent (Federal Statistical Office) of cloud users obtain their email that way. Domain, storage, mailboxes and analytics therefore often sit with three different providers, frequently on invoices issued by a previous agency. What belongs to clean hosting access should be settled before the build, not on the day of the switchover.

.de is the standard case here: in June 2026 the 18 millionth .de domain was registered (DENIC). A provider change requires an AuthInfo code, a password issued by the losing provider. The code expires automatically after 30 days (DENIC) and then has to be requested again. So do not request it as a precaution, but around a week before the planned transfer. How a change works without downtime, and which order matters, is described in detail in switching web host without downtime — including why mailboxes deserve separate consideration.

Domain: provider, contract holder, notice period and — shortly before the transfer — the AuthInfo code.
DNS management: where are the records maintained, who may change them, how quickly does a change take effect?
Storage: server access, database access, PHP version, most recent backup copy.
Email: where are the mailboxes hosted, how many are there, are they on the same contract as the domain?
Editorial system: administrator account for the existing site, so content and images can be carried over.
Business profile in the map service and trade directories: ownership confirmed or abandoned?
Certificate and redirects: which old addresses point where today, and who administers them?
Analytics and consent: which tool is running, and who signed the data processing agreement?

Access does not mean handing over passwords

Do not hand out shared passwords. Set up a separate account for the service provider instead, with the rights they need and an end date. Wherever personal data is processed, a data processing agreement belongs with it, binding the processing by subject matter, duration, nature and purpose (GDPR Art. 28(3)). After the project the account is deactivated — two minutes of work that saves the question of who still has access two years later.

Sign-off, deadlines and correction rounds

Sign-off is the least conspicuous consumer of time. A design that sits on a desk for three weeks costs three weeks — regardless of how fast the build was. A simple rule helps: one named person per round, a deadline of five working days, and one collected response instead of individual comments in passing. Contradictory remarks from several departments are resolved internally before they are passed on, otherwise we correct against ourselves. Plan for two rounds: one on the design, one on the populated test version. A third round is possible, but then belongs in the quoted effort.

Item	Without an agreement	With an agreed procedure
Copy	Written on the side, arrives in dribs and drabs	Finished before the build, approved page by page
Images	From the shared folder, provenance unclear	Documented per shot with source and agreement
Credentials	Requested one at a time, often over weeks	Available as a package, accounts created for the purpose
Sign-off	Open round without a deadline, several opinions	One person, five working days, one collected response
Legal texts	Arrive the day before go-live	Settled together with the structure
Transfer	AuthInfo code missing on the day	AuthInfo code requested a week in advance
Date	Moves from week to week	Follows from the day the material is complete

The right-hand column is not an ideal; it is the normal case in projects where the procedure was written down once. The effort for that is around two hours at the start: one page of responsibilities, one page of dates. Those two hours are the cheapest investment in the whole project. If you are planning a relaunch, also produce the address list of the existing site early — it is needed for the redirects and cannot be fully reconstructed once the old site has been switched off.

Mandatory details that only your company can provide

Some content cannot be invented by any service provider. Providers of commercial digital services have to keep permanently available, among other things, their name and address, for legal entities also the legal form and the authorised representative, details allowing rapid electronic contact including the electronic mail address, plus the register and the registration number (Digital Services Act, Germany). For the privacy policy, add which data is processed for which purpose and on which legal basis, and how long it is stored (GDPR Art. 13). Anyone also advertising with environmental claims supplies the evidence at the same time; what to watch out for is set out in environmental claims on websites.

Full legal company name, address, legal form and the persons authorised to represent it.
Register court and registration number, plus the VAT identification number where one exists.
The competent supervisory authority and chamber, where the activity requires official authorisation.
A list of the service providers in use, together with the relevant data processing agreements.
Retention periods for enquiry forms, job applications and newsletter consents.
The person responsible for data protection enquiries, with an address that is actually answered.

The schedule week by week

The following rhythm has proved itself for medium-sized sites — twelve to twenty pages, no shop — and matches the procedure we run in our web design projects. It assumes the handover pack is largely in place at the start; if it is not, every following week moves back by exactly the time the late delivery takes. Form fields, incidentally, belong in week one: in the checkout flows of large online shops the average in 2024 was 11.3 fields (Baymard Institute), and every additional field costs completions. The same applies to an enquiry form on a smaller scale — which details are mandatory is a business decision, not a technical one.

Weeks 1 to 2: foundations

Structure, goals, form fields and the schedule are settled. In parallel you assemble the handover pack: copy, images, master data, legal texts. Credentials are requested — the AuthInfo code is not, yet.

Weeks 3 to 5: build

Design, sign-off round one, implementation, populating the content. At the end there is a test version with real copy and real images, because placeholders distort every piece of feedback.

Week 6: switchover

Sign-off round two, request the AuthInfo code, set the redirects, move the mailboxes, check the certificate, go live early in the week rather than on a Friday evening.

After go-live the project does not end, it changes mode. Updates, backups and watching availability belong in a fixed rhythm; we take that on as ongoing care or hand a set of instructions to your team. Also keep accessibility in mind: the German Accessibility Strengthening Act came into force on 28 June 2025 (German Accessibility Strengthening Act). Micro-enterprises are exempt from the service requirements (German Accessibility Strengthening Act), meaning companies with fewer than ten employed persons and an annual turnover or balance sheet total of at most 2 million euros (German Accessibility Strengthening Act). What follows from that is set out in the accessibility act and accessible websites.

Sources and Studies

This article is based on data from the Bavarian State Office for Statistics, the Federal Statistical Office, DENIC eG and the Baymard Institute. The figures quoted refer to the state of the respective publication.