A complete WordPress checklist for taking over a site you didn't build

Last updated: September 2025

Taking over responsibility for a WordPress website you didn't build can feel overwhelming, especially when you're juggling multiple marketing responsibilities on a tight budget. Whether you've started a new role or inherited a site from a departed colleague, this comprehensive checklist will help you understand your new website quickly and identify any urgent issues that need attention.

This guide is specifically designed for small business owners, marketing generalists, and busy professionals who need practical, jargon-free advice. We'll walk you through everything step-by-step, assuming no prior technical knowledge.

Why taking over someone else's website is challenging

WordPress websites can be built in countless different ways. The person who set up your site might have used specific themes, page builders, or custom code that you're completely unfamiliar with. Without understanding these choices, even simple changes can feel impossible.

The good news? This systematic approach will help you understand your website's setup and identify any urgent security or maintenance issues within a few hours.

Immediate security priorities

Security should be your first concern when taking over any website.

User access and credentials

Change your login details immediately - If you're using someone else's username and password, create your own admin account with a unique, strong password. WordPress 6.8+ includes enhanced password security with bcrypt hashing for better protection.
Review all user accounts - Go to Users in your WordPress admin and check who has access. Remove anyone who no longer needs access, especially former employees or previous agencies.
Enable two-factor authentication - This adds an extra layer of security to your login. Plugins like Solid Security (formerly iThemes Security) make this straightforward to set up.
Check for shared logins - Ensure each person has their own user account rather than sharing credentials.

Immediate security scan

Run a security scan to check for malware or suspicious files. Free security plugins like All-In-One Security (AIOS) or Wordfence can do this automatically.

Hosting and domain control

You need complete control over where your website lives and how people find it online.

Web hosting access

Identify your hosting provider (you can usually find this information in your welcome emails or by asking your IT person)
Ensure you have login access to your hosting control panel
Check hosting renewal dates and payment methods
Verify backup policies provided by your host (though you shouldn't rely solely on these)

Domain registration

Find out where your domain name is registered (this might be different from your hosting provider)
Get access to the domain registrar account
Check domain expiry dates and auto-renewal settings
Ensure contact details are up to date

Important: Both hosting and domain should be under your organisation's control, not tied to individuals who might leave or external agencies you no longer work with.

Backup and protection strategy

Backups are your safety net before you make any changes to a site, and with cyber attacks becoming more sophisticated, having reliable, recent backups is vital.

Assess current backup situation

Check if automatic backups are already running (look in your plugins for backup solutions)
Find out if your hosting provider takes backups and how to access them
Test whether you can actually restore from existing backups (many people discover their backups don't work when they need them most)

Set up reliable backup solution

We recommend UpdraftPlus. Still the most popular choice, with over 3 million active installations, the free version is excellent for basic backup needs.

Backup best practices for 2025

Take a full backup before making any changes - This gives you a restore point if something goes wrong
Store backups in multiple locations - Cloud storage (Google Drive, Dropbox, Amazon S3) plus local copies
Test your restore process - Create a staging site and practice restoring from backup
Schedule automatic daily backups - Set these to run during quiet periods (usually early morning)
Keep multiple backup versions - Don't just keep the latest backup; retain several weeks' worth

WordPress version and updates

WordPress releases regular updates for security and functionality. Staying current is crucial for site security, but updates need careful handling.

Check your WordPress version

Look at the bottom of any admin page in WordPress - it shows your version number
WordPress will display update notifications at the top of your admin area if newer versions are available
As of September 2025, WordPress 6.8.2 is the latest stable version

Update strategy

WordPress now offers one-click auto-updates for major releases, with automatic rollback if updates break your site.

Never update without a backup - Always create a full backup before any WordPress update
Update gradually - If your site is several versions behind, don't jump straight to the latest version
Test on staging first - If possible, test updates on a staging version of your site
Check plugin compatibility - Ensure your plugins support the WordPress version you're updating to

End of support notice

As of July 2025, WordPress no longer provides security updates for versions 4.1 through 4.6. If your site runs any of these versions, updating is urgent.

Theme analysis and compatibility

Your WordPress theme controls how your site looks and, to some extent, how it functions. Understanding your theme is crucial for making changes safely.

Identify your current theme

Go to Appearance → Themes in WordPress admin
Your active theme will be highlighted
Note whether it's a free theme (from the WordPress directory) or a premium theme

Theme types and implications

Theme maintenance checklist

Check for theme updates - Premium themes need license keys for updates
Verify license status - Ensure you have access to theme developer accounts
Review subscription renewals - Many premium themes require annual renewals
Find theme documentation - Look for setup guides and feature explanations
Test theme customiser - Go to Appearance → Customise to see available options

Child theme check

Check if your site uses a child theme (this appears in Appearance → Themes). Child themes protect customisations when the main theme updates. If you don't have a child theme but have made customisations, consider creating one.

Custom code assessment

Custom code can add powerful functionality to your site, but it also creates dependencies and potential security risks.

Identifying custom code

Check functions.php - Go to Appearance → Theme Editor and look at the functions.php file (be careful not to edit anything here)
Look for custom plugins - In Plugins, check for any that don't have standard author names or "View details" links
Identify child themes - These often contain custom code
Check for code snippets plugins - Look for plugins like "Code Snippets" that manage custom code

Custom code risks and dependencies

Developer availability - Can you contact the person who wrote the custom code?
Documentation - Is there any explanation of what the custom code does?
Update compatibility - Custom code might break when WordPress or plugins update
Security implications - Custom code can introduce vulnerabilities if not properly maintained

Recommendation: Don't modify any custom code unless you understand exactly what it does. Consider hiring a WordPress developer to audit custom code and document its purpose.

Site structure and content audit

Understanding how your site is organised helps you manage content effectively and spot potential issues.

Content inventory

Page count - Check how many pages exist (Pages → All Pages)
Blog posts - Review Posts → All Posts and check categories/tags
Media library - See what images and files are stored (Media → Library)
Menus - Check navigation setup (Appearance → Menus)

Site architecture tools

For a comprehensive site audit, use tools like:

Screaming Frog SEO Spider - Free tool (up to 500 URLs) that crawls your site and reports on structure, broken links, and SEO issues
Google Search Console - Shows which pages Google has indexed
WordPress admin search - Use the search function in Pages/Posts to find content quickly

Navigation and menu analysis

Menu locations - Check where menus appear on your site
Mega menus - Identify if plugins create complex navigation
Footer links - Review footer content and links
Sidebar content - Check widgets in sidebars (Appearance → Widgets)

Page building methods

WordPress sites can be built using different methods, and understanding which your site uses is crucial for making changes.

Identify your page building approach

WordPress sites typically use one of these approaches:

Gutenberg Block Editor - WordPress's native editor with drag-and-drop blocks
Elementor - Popular page builder plugin with visual drag-and-drop interface
Divi Builder - Visual page builder by Elegant Themes
Beaver Builder - Professional page builder focused on clean code
Classic Editor - The original WordPress editor (mostly phased out by 2025)

How to determine your page builder

Edit any page - the interface will show which builder is active
Look for "Edit with Elementor", "Use Divi Builder", or similar buttons
Check your plugins list for page builder plugins
Look at the page editing interface - Gutenberg shows blocks, page builders show their own interfaces

Functionality and feature testing

Test all interactive elements on your site to ensure everything works properly.

Forms and user interactions

Contact forms - Submit test entries and check where they're delivered
Newsletter signups - Verify connections to email marketing services
Search functionality - Test site search if available
Comment systems - Check if blog comments work and who moderates them

E-commerce functionality

If your site sells products or services:

Test checkout process - Complete a test purchase (use test payment methods)
Product catalogue - Check product listings are accurate and up to date
Payment gateways - Ensure payment processors are working
Inventory levels - Verify stock quantities are correct

Broken links and 404 errors

Use tools like Screaming Frog or online broken link checkers
Check Google Search Console for 404 errors
Test important internal links manually
Verify external links to other websites

Plugin management and security

Plugins extend WordPress functionality but also introduce potential security risks. In 2025, plugin vulnerabilities represent one of the biggest threats to WordPress sites.

Plugin inventory and assessment

List all installed plugins - Go to Plugins → Installed Plugins
Identify plugin purposes - Research what each plugin does
Check for premium plugins - Note which require paid licenses
Review plugin ratings - Check WordPress.org ratings and reviews
Identify abandoned plugins - Look for plugins not updated in over a year

Plugin security

Current threat landscape: Weekly vulnerability reports show hundreds of plugin vulnerabilities, with many remaining unpatched. Priority should be given to:

Regular updates - Update plugins immediately when security releases are available
Reputable developers - Choose plugins from established developers with good support records
Minimal plugin approach - Only keep plugins you actually need
Security monitoring - Use tools like Patchstack or Solid Security for vulnerability monitoring

Plugin maintenance routine

Update one by one - Never update all plugins simultaneously
Test after updates - Check your site works after each plugin update
Remove unused plugins - Deactivate and delete plugins you don't need
Monitor for conflicts - Note if certain plugins cause issues together

Third party integrations

Many WordPress sites connect to external services for email marketing, CRM, analytics, and other functions.

Email marketing integrations

Mailchimp - Check for Mailchimp plugins or API connections
ConvertKit - Look for ConvertKit forms or integrations
Constant Contact - Check newsletter signup connections
Other services - Look for plugins connecting to services like AWeber, GetResponse

CRM and business tools

CRM integrations - Check for connections to Salesforce, HubSpot, or similar
Booking systems - Look for appointment or booking plugins
Payment processors - Identify connections to PayPal, Stripe, or other payment services
Chat widgets - Check for live chat tools like Intercom or Zendesk

Access verification

For each integration you find:

Ensure you have access to the external service account
Check subscription status and renewal dates
Verify API keys and connections are working
Update contact information in external accounts

Content accuracy review

Outdated or incorrect information can damage your business reputation and SEO performance.

Contact information audit

Contact page details - Verify phone numbers, email addresses, and physical addresses
Header and footer information - Check contact details displayed site-wide
About page accuracy - Ensure team information and company details are current
Privacy policy contacts - Update data protection officer details if required

Team and staff information

Team pages - Remove staff who have left, add new team members
Author bios - Update blog post author information
Testimonials - Ensure customer testimonials are genuine and current
Leadership information - Check executive team details are accurate

Product and service information

Pricing accuracy - Update any outdated pricing information
Service descriptions - Ensure services offered match current business model
Product availability - Remove discontinued products or mark as unavailable
Terms and conditions - Review and update terms of service

Blog content management

Publishing frequency - Check when the last blog post was published
Content relevance - Review recent posts for accuracy and relevance
Seasonal content - Remove or update time-sensitive content
Contact calls-to-action - Ensure blog posts link to correct contact information

Pro tip: If your blog hasn't been updated in several months, consider temporarily hiding it rather than letting visitors see stale content. You can always bring it back when you have fresh content to publish.

SEO and analytics setup

Understanding your site's search performance and visitor behaviour is crucial for business success. Google's recent algorithm updates have made proper SEO setup more important than ever.

Google Analytics setup

Verify installation - Check if Google Analytics is running (look for tracking code in site source)
Access accounts - Ensure you can log into the Google Analytics account
Configure key events - Set up conversion tracking for form submissions, purchases, or other key actions
Filter internal traffic - Exclude your own visits from analytics data

Google Search Console

Verify property - Ensure your site is verified in Google Search Console
Submit sitemap - Make sure your XML sitemap is submitted and being processed
Check for errors - Review coverage report for crawling issues
Monitor performance - Check which keywords bring traffic to your site
Fix security issues - Address any security notifications immediately

SEO plugin configuration

Popular SEO plugins:

Yoast SEO - Most popular, user-friendly interface
Rank Math - Feature-rich with built-in analytics
All in One SEO - Good balance of features and simplicity
SEOPress - Lightweight alternative with strong features

SEO essentials check

Meta titles and descriptions - Ensure all pages have unique, compelling titles and descriptions
Image alt text - Check important images have descriptive alt text
XML sitemap - Verify sitemap is automatically generated and updated
SSL certificate - Ensure site uses HTTPS (essential for SEO)
Mobile responsiveness - Test site works well on mobile devices

SEO considerations

Google's recent algorithm updates emphasise:

E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness) - Ensure content demonstrates real expertise
Core Web Vitals - Page loading speed, interactivity, and visual stability
AI-generated content detection - Ensure content provides genuine value, not just keyword stuffing
User intent focus - Content should directly answer what users are searching for

Performance optimisation

Site speed directly impacts user experience, search rankings, and conversion rates. Google's 2025 algorithm updates place even greater emphasis on Core Web Vitals.

Speed testing tools

Google PageSpeed Insights - Free tool showing mobile and desktop performance scores
GTmetrix - Detailed performance analysis with actionable recommendations
WebPageTest - Advanced testing with multiple locations and devices
Core Web Vitals - Check Google Search Console for real user metrics

Common performance issues

Large images - Compress images and convert to modern formats like WebP
Too many plugins - Deactivate unnecessary plugins that slow down your site
Outdated hosting - Consider upgrading hosting if performance is consistently poor
No caching - Install a caching plugin if none exists
Unoptimised database - Clean up spam, revisions, and unused data

Quick wins for better performance

Install caching plugin - WP Rocket, W3 Total Cache, or WP Super Cache
Optimise images - Use plugins like Smush or ShortPixel
Enable compression - Gzip compression reduces file sizes
Minify CSS/JS - Remove unnecessary code and whitespace
Use CDN - Content delivery networks speed up global loading

2025 performance standards

Target metrics for good user experience:

Largest Contentful Paint (LCP) - Under 2.5 seconds
First Input Delay (FID) - Under 100 milliseconds
Cumulative Layout Shift (CLS) - Under 0.1
Overall PageSpeed score - Above 80 for mobile and desktop

Ongoing maintenance planning

Regular maintenance keeps your site secure, fast, and functioning properly. Create a routine to prevent small issues becoming major problems.

Weekly tasks

Update plugins - Check for and install plugin updates (one at a time)
Review security logs - Check for suspicious activity or login attempts
Test key functionality - Quickly test contact forms and important site features
Check site speed - Run a quick PageSpeed Insights test

Monthly tasks

WordPress core updates - Install WordPress updates after backing up
Review analytics - Check Google Analytics and Search Console for issues
Clean up media library - Remove unused images and files
Test backups - Verify your backup system is working properly
Review user accounts - Remove any unnecessary user accounts

Quarterly tasks

Full security audit - Run comprehensive malware and vulnerability scans
Content review - Update outdated information and remove old content
Performance optimisation - Deep dive into site speed improvements
SEO review - Update meta descriptions and review keyword performance
Legal compliance check - Review privacy policy and terms of service

Annual tasks

Theme updates - Major theme updates (test on staging first)
License renewals - Renew premium plugin and theme licenses
Hosting review - Evaluate hosting performance and consider upgrades
Complete content audit - Review all site content for accuracy and relevance
Security assessment - Consider professional security audit

Getting help when needed

Don't hesitate to get professional help when:

Site performance issues persist despite optimisation efforts
Security breaches or malware infections occur
Major updates break site functionality
You need custom functionality beyond basic plugins
Traffic or business growth requires hosting upgrades

Taking control of your WordPress site

Taking over someone else's WordPress website doesn't have to be overwhelming. By working through this checklist systematically, you'll quickly understand how your site works and identify any urgent issues that need attention.

Remember, you don't need to become a WordPress expert overnight. Focus on the security essentials first, then gradually work through the other areas as time permits. The most important thing is having reliable backups and keeping your site secure.

If you discover issues beyond your comfort level, don't hesitate to seek professional help. A few hours of expert assistance can save you days of frustration and prevent costly mistakes.

Quick reference priorities

Security first - Change passwords, review users, install security plugin
Backup immediately - Set up reliable, tested backup system
Update carefully - WordPress, themes, and plugins (with backups first)
Test functionality - Forms, e-commerce, and key features
Review content - Update contact information and remove outdated content
Monitor performance - Set up analytics and monitor site speed
Plan maintenance - Create ongoing maintenance routine

The complete WordPress site takeover checklist: your essential guide to inheriting an existing website