The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Take control of an inherited WordPress site by documenting how it works, securing a restorable backup, and confirming account ownership before changing or deleting anything. Then update and clean up in small steps, test the site, and give the owner a handover record that explains access, backups, changes, and remaining responsibilities.
What should I check first when I take over a WordPress website?
Start by confirming that the person authorizing the work has authority over the site and its accounts. Agree on the scope: WordPress administration alone, or also hosting, domain registration and DNS, email, analytics, payment integrations, a CDN, and other connected services. Ownership, contracts, privacy duties, and retention requirements depend on the specific site and agreement; clarify them with the owner rather than assuming a universal rule.
As an Amazon Associate I earn from qualifying purchases.
Before making changes, record a baseline. In WordPress, open Tools → Site Health → Status to review reported issues, which are grouped by severity. Open Tools → Site Health → Info for diagnostic details such as WordPress version, themes, plugins, server setup, database, and permissions. Info displays technical details; it does not configure the site. WordPress describes Site Health as a diagnosis of your site’s health.
Build an inventory the owner can use
- Public site address and purpose
- WordPress version, active theme, and installed plugins
- WordPress users and their roles
- Hosting provider, domain registrar, and who controls each account
- Backup arrangements, including where copies are stored and how restoration works
- Important integrations and workflows, such as forms, checkout, email, or scheduled tasks
- Known issues, upcoming renewals, and who currently maintains each service
Retain relevant Site Health details for the owner, but do not put passwords, secret keys, or other credentials in the inventory. WordPress roles determine what users can do, including whether they can manage plugins, themes, and other users; review roles with the owner rather than treating every account as interchangeable. WordPress documents roles and capabilities.
#1 Best Overall
How do I safely clean up an inherited WordPress site?
Use a sequence that preserves a way back: establish access and scope, capture the current state, make a restorable backup, address urgent security concerns, then update and remove items selectively. A backup is useful only if you know what it contains and can locate and restore it.
1. Secure a recovery point
Before updates or deletion, arrange a backup of both the site’s files and database, and establish the restore procedure. WordPress recommends backing up before updates; its maintenance guidance advises keeping copies on the host and on a computer. If a migration is involved, preserve the old database backup as well. WordPress’s backup guidance and update instructions explain these precautions.
Where practical, keep a copy separate from the hosting account and confirm who controls that storage. A separate copy can reduce dependence on a single account, but storage alone is not a recovery plan: retain the files and database needed for the site and know how they can be restored. WordPress does not require a particular backup product or storage medium.
Recommended Free Tools
2. Confirm and transfer access deliberately
With the owner, verify access to WordPress administration, hosting, domain registration, backup storage, and essential third-party services. Decide which former contractor accounts can be removed and which people need ongoing access. Confirm that an accountable owner retains working access before removing users or changing credentials. Make changes through each service’s own account process, and document who is responsible without recording secrets in plain text.
In WordPress, review each user’s role and whether that level of access is still needed. Because roles govern capabilities, changing one can affect who can maintain the site or manage other users. Do not remove the only account able to administer the site before confirming the owner has another working administrator account.
3. Handle warning signs before routine housekeeping
Review Site Health issues and look for outdated software, administrator accounts no one recognizes, unexpected redirects, unfamiliar content, or other signs that the site may be compromised. These are reasons to investigate, not by themselves a diagnosis. If compromise is suspected, stop treating the work as ordinary cleanup: follow WordPress’s hacked-site recovery guidance, secure access across the environment, and approach recovery deliberately. A general checklist cannot determine whether a particular site has been breached.
4. Update in controlled steps
After securing a backup, review WordPress core, plugins, themes, PHP, and Site Health. Update according to the site’s normal maintenance process, then check the site before proceeding with more changes. WordPress recommends current software and backup capability because updates can cause problems that require restoration. Its support documentation says only the latest major WordPress release is officially supported. Check WordPress’s version-support documentation for the current status.
After updates, test representative public pages and administration tasks, plus the workflows the site depends on: forms, checkout, email delivery, and scheduled tasks where applicable. If something breaks, use the established backup and restore process rather than layering more unverified changes onto the site.
5. Remove only what you can identify
Housekeeping can include spam, unused plugins or themes, and genuinely unused media. First determine what each item does and whether another part of the site depends on it. An inactive plugin may still support a workflow when re-enabled; a theme may be a required parent theme; media may be embedded in pages or referenced elsewhere. Official housekeeping advice supports cleanup, but does not establish that every inactive item is safe to delete on every customized site. Review WordPress’s housekeeping guidance and theme guidance.
If an item’s purpose is uncertain, retain it in a recoverable backup and investigate before deletion. Make removals in manageable batches and check the affected pages and functions afterward so that a problem can be traced to a specific change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I remove a former developer’s access to WordPress?
First identify where that person has access: WordPress, hosting, the domain registrar, backup storage, and any connected services. Removing a WordPress user does not transfer ownership of those other accounts. Agree with the site owner on which access is no longer needed, confirm that the owner and current maintainers can still sign in, then change or remove access through each relevant service.
- Confirm the owner’s authority and identify the accounts and services in scope.
- Verify that the owner has working access and that another appropriate administrator can maintain WordPress.
- Review WordPress users and roles with the owner; remove or change former contractor access only after confirming it is no longer needed.
- Transfer or update access to hosting, domain registration, backups, and third-party services using their own account controls.
- Record who owns each account and who is responsible for future access changes. Keep credentials out of the handover document.
If a former developer’s account is also the only route to a critical service, resolve ownership and recovery with the provider and site owner before removing it. Exact transfer procedures vary by service.
What should be included in a WordPress website handover?
Give the owner an operational record, not a document full of secrets. It should explain what was reviewed, what changed, what remains unresolved, and who is responsible for the accounts and maintenance going forward.
- Site inventory: WordPress version, active theme and plugins, users and roles, hosting, registrar, and important integrations
- Access and responsibility: account owner and responsible contact for each service, without passwords or secret keys
- Backup details: what the backup contains, where it is stored, who controls it, and the restore instructions
- Maintenance record: updates and cleanup completed, plus the date or status of the work
- Validation: pages and important workflows checked, and any failures found
- Open issues: known risks, work still needed, and the appropriate escalation contact
- Dates and next steps: known renewals, maintenance dates, and the person responsible for each
How do I validate the site before handing it back?
After changes, confirm that the public site is reachable and test representative pages and the interactions that matter to this site. Check administration, forms, checkout or other key workflows, and scheduled tasks where they are part of normal operations. Review Site Health again, locate the backup, and make sure the owner knows how restoration would be handled. Record what was tested and any limits or failures so the handover does not imply that untested functions were verified.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
