If your developer disappeared or your agency closed, do not start by clicking “Update All.” Get control of the accounts first, take a backup you own, then audit. Updating an unknown site before you can restore it is how small problems become outages.
This checklist is for small-business owners, nonprofit staff, and marketing teams who suddenly own a WordPress site they did not build. The steps are in a safe order. Technical details stay in plain language; optional developer notes are marked clearly.
1. Get ownership of the accounts
You need access in your organization’s name—not a personal login you cannot reset later. Work through this list and write down where each account lives.
Domain and DNS
- Who owns the domain registrar account (where you renew the domain)?
- Can you log in and change the admin email and password?
- Where is DNS managed (registrar, Cloudflare, host, or another DNS tool)?
- Do you control the records that point the domain at the website and email?
If the domain renews under someone else’s credit card, move billing and ownership before that person disappears for good.
Hosting
- Confirm the hosting company and the account email
- Get FTP/SFTP or file-manager access if it exists
- Confirm who pays the bill and whether auto-renew is on
- Export or screenshot the current plan and server details
WordPress admin
- Log in at
/wp-admin(or the custom login URL if one was set) - Confirm you have an Administrator role
- Note every other Administrator user
- Change the password on accounts you will keep
- Business email (Google Workspace, Microsoft 365, or host email)
- Form notification addresses (where contact-form messages go)
- Transactional email tools if the site sends mail (SMTP plugins, SendGrid, and similar)
Analytics and Search Console
- Google Analytics (or your analytics tool)
- Google Search Console property ownership
- Any tag-manager or ad accounts tied to the site
Plugin and theme licenses
- Page builders, SEO plugins, backup plugins, membership tools, and premium themes often need license keys
- Move licenses into an account your organization controls, or note renewal dates so support does not vanish mid-year
If you cannot get an account, document who has it. That list becomes the brief for a website rescue engagement.
2. Take a backup you own—and test that it restores
Before you change anything, make a full backup that includes:
- WordPress files (themes, plugins, uploads, configuration)
- The database (posts, pages, users, settings)
WordPress.org backup documentation (opens in a new tab) is clear that a typical site needs both files and database to restore. Host-level backups help, but you also want a copy you can download or store off the same server.
Then do the unglamorous step: confirm a restore path exists. That might mean restoring to a staging site, or having your new host confirm they can restore the package you uploaded. An untested backup is a wish, not a plan.
WordPress also recommends backing up before upgrades. Once you own a restore path, updates become much safer.
3. Audit what is installed
Open the site with fresh eyes. Capture:
- WordPress version (Dashboard → Updates, or Tools → Site Health → Info)
- PHP version (Site Health → Info → Server)
- Active theme and whether it is a parent theme or a heavily customized child theme
- Plugin list: name, version, last updated, and whether each plugin is still needed
- User list: every Administrator, Editor, and unused accounts
- Cron/jobs and custom code: mu-plugins, must-use drop-ins, and mystery folders under
wp-content - Forms and checkout flows: submit a test inquiry; confirm the email arrives
- SSL and redirects: does HTTPS work, and do old URLs redirect cleanly?
You are not fixing yet. You are building a map so you do not delete the one plugin that runs memberships or donations.
4. Lock the site down
Once you have a backup you trust:
- Remove or demote users who no longer need access
- Change passwords for remaining admin accounts, hosting, DNS, and email
- Turn on two-factor authentication for WordPress admin where practical
- Review admin email addresses so password resets go to you
- Check for unknown plugins, unknown admin users, and unexpected PHP files in uploads
- Restrict who can install plugins if your process allows it
Do not publicly share staging URLs or backup download links. Treat access like keys to the office.
5. Update safely (preferably on staging)
After the audit and lockdown:
- Copy the site to staging if you can
- Update WordPress core, then themes, then plugins in small batches
- Retest forms, login, checkout, and key landing pages
- Only then update production—with a fresh backup taken immediately before
WordPress.org (opens in a new tab) recommends updating to the latest version and backing up first. If one-click updates fail, stop and get help rather than forcing a half-finished upgrade on a live site.
Optional note for developers: keep a changelog of versions before/after; clear caches after updates; watch the PHP error log during the first hour.
6. Set up ongoing care
A takeover is not finished when the dust settles. Decide who will:
- Apply updates on a schedule
- Watch backups and uptime
- Own security alerts
- Make content edits
If nobody owns those jobs, the site drifts back into the same fragile state within a few months. For what a maintenance plan should include—and how plans differ—see What’s Included in a WordPress Maintenance Plan (and What It Should Cost).
If you want hosting and maintenance under one roof, compare Zen and Zen+ managed hosting.
7. When to call for help
Call a professional sooner rather than later if:
- You cannot get DNS, hosting, or admin access
- The site shows malware warnings, odd redirects, or unknown admin users
- Updates fail or the site is already broken
- WooCommerce, memberships, or donations are involved and revenue is at risk
- The previous build is so customized that you cannot tell theme code from plugin code
Code Samurai regularly takes over WordPress sites from previous developers and hosts—cleanup, migrations, and ongoing maintenance included. See Support & Fixing Issues and Migrations for the service list.
Takeover checklist (printable)
- ☐ Domain registrar access in our name
- ☐ DNS access confirmed
- ☐ Hosting access and billing confirmed
- ☐ WordPress Administrator access confirmed
- ☐ Email and form destinations confirmed
- ☐ Analytics / Search Console access confirmed
- ☐ Plugin/theme license ownership reviewed
- ☐ Full backup (files + database) stored off-site
- ☐ Restore path tested or confirmed
- ☐ Inventory of PHP, WordPress, theme, plugins, users
- ☐ Unused admins removed; passwords changed; 2FA considered
- ☐ Updates tested on staging, then production
- ☐ Ongoing maintenance owner assigned
Next step
Stuck without access? Contact Code Samurai and tell us which accounts you have (and which you do not). We will map the safest next move.
If the site is already in your control and you want someone else to host and maintain it, take over hosting and maintenance with Zen or Zen+.