WordPress agency takeover checklist

Switch WordPress agency with a tested handover

Classify every account and dependency before the old relationship ends. The incoming team should prove it can restore, release, receive enquiries, and recover access before former accounts are removed.

By ·2026-07-29·7 min read

Discuss a WordPress takeover ↗See maintenance plans
Maintenance and reliability work
On this page
  1. Direct answer
  2. Takeover or relaunch?
  3. Dependency register
  4. Separate change boundaries
  5. Before giving notice
  6. Outgoing supplier request
  7. Controlled takeover
  8. Protect organic search
  9. Handover pack
  10. Buyer questions
  11. Primary sources
  12. How Some Tech Work handles takeovers
Direct answer
  • Keep the domain, hosting, and live website where they are during the first handover step.
  • Mark every dependency as company-controlled and verified, transferable, replace before exit, or missing and unverified.
  • Create an independent backup of files and database, then test restoration away from the live site.
  • The new team should review the live setup with read access, reproduce it on staging, test forms and backups, and release one small change.
  • Remove former accounts and rotate shared passwords after the new team confirms access and accepts incident responsibility.
Takeover or relaunch?

Decide separately whether the website needs a relaunch.

An agency takeover changes who maintains the website. A relaunch changes its design, structure, content, or technical foundation. The first decision does not require the second.

Keep the current website when marketing can publish, important forms work, and the theme can be maintained. Consider a relaunch when routine changes break the site, critical extensions are abandoned, or the content structure no longer fits the business.

Ask the incoming supplier to price takeover, initial repairs, and any relaunch as separate items. You can then approve the smallest useful change.

Dependency register

Give every account and service one transfer status.

Apply the status to the domain registrar, DNS, hosting, WordPress, code, forms, email, analytics, Search Console, consent platform, licences, and vendors.
StatusMeaningEvidenceDecision
Company-controlled and verifiedA company account can recover, renew, grant access, and complete the required action.Role, recovery, MFA, invoice, export, and a successful taskAccept
TransferableThe current holder or provider has confirmed the transfer process.Recipient, steps, deadline, cost, and completion recordSchedule before notice ends
Replace before exitThe account or licence cannot transfer, or company control is the safer operating model.Replacement account, reproduced settings, and working testDo not cancel the old service yet
Missing or unverifiedThe owner, recovery path, configuration, export, or test is incomplete.Open question and the person who can resolve itBlock acceptance if critical
Separate change boundaries

An agency switch does not require a domain, hosting, DNS, or email move.

DENIC separates domain administration from webspace, email addresses, and name services. Change only the dependency that must move.
DependencyRecord before noticeIf it changesAcceptance evidence
Domain registrarHolder, provider, renewal, billing, recovery, MFAFor a .de provider move, record the AuthInfo recipient and expiryCompany can renew and recover the domain
Authoritative DNSProvider, users, complete zone export, nameserversChange window, old and new values, rollbackWebsite and required records resolve
Web hostingContract, panel, database, files, access, backupsRestore and test on the target before cutoverPages, forms, jobs, logs, and rollback work
Email hostingMailboxes, forwarding, delivery service, support contactPreserve and verify MX, SPF, DKIM, and DMARCSend, receive, and form-delivery tests pass
Before giving notice

Reduce risk without changing production.

✓
Create a company password-vault folder and name an owner for every account.
✓
Verify domain registrar, recovery email, renewal, and MFA.
✓
Verify hosting, DNS/CDN, WordPress admin, database, SFTP/SSH, and repository access.
✓
Export Search Console, analytics, tag-manager, consent-platform, and ranking baselines.
✓
Test every important form and record its recipient and confirmation path.
✓
Create and restore-test an independent files-and-database backup away from production.
✓
Inventory themes, plugins, custom code, cron jobs, webhooks, APIs, licences, and renewals.
✓
Review the contract for notice, handover, IP, hosting, licence, and data-return clauses.
✓
Choose a change window, escalation contact, and rollback owner before removing credentials.
Outgoing supplier request

Send one dated request and track what was received and tested.

✓
Subject: Website access and operating handover for [domain], required by [date].
✓
Request company and provider accounts, recovery methods, roles, MFA transfer, invoices, and renewal dates.
✓
Request a current files-and-database backup plus the code repository, theme source, build, release, and rollback instructions.
✓
Request form routes, mail delivery, integrations, scheduled jobs, consent setup, analytics, Search Console, and current monitoring contacts.
✓
Request vendors, paid licences, transfer terms, support contacts, open work, recent incidents, known defects, and workarounds.
✓
Mark every item received, tested, replacement needed, or blocked. A received password is not an acceptance test.
✓
Use the contract and legal advice for disputed ownership, licence, intellectual-property, or data-return rights.
Controlled takeover

Move responsibility in four bounded stages.

WordPress production inventory and access review
1

Check access and inventory

The incoming team uses individual read access to record hosting, WordPress, code, plugins, forms, analytics, monitoring, and recent incidents. The live site is unchanged.

WordPress staging environment restored from backup
2

Restore and test

Restore a current backup into staging. Confirm build and deployment, compatibility, scheduled tasks, form delivery, consent, caching, monitoring, and rollback.

Agency handover with one accountable release owner
3

Agree the handover window

Agree who receives incidents and who may release changes. Transfer instructions, supplier contacts, open defects, renewals, and known workarounds.

Small reversible WordPress release completing a takeover
4

Release one small change

Release a small fix through staging, backup, approval, production, and verification. Accept responsibility only after forms, alerts, recovery, renewals, rollback, and changed provider dependencies pass their tests.

Protect organic search

An agency change is not an SEO migration unless the website changes.

Keep the domain, URLs, canonicals, robots rules, sitemap, content, redirects, and analytics stable during takeover. Record Search Console clicks and coverage, top landing pages, crawl errors, Core Web Vitals, and conversion events before the first release.

Do not combine credential transfer with an unreviewed hosting move or plugin cleanup. If hosting must move, treat it as a separate release with source and target baselines, rollback, DNS planning, and post-change verification.

Compliance next step

Get a compliance check on: Switch WordPress agency

Send us where your site stands today. We reply with the risks that carry real exposure, not a generic checklist.

Name the regulation, the page, or the deadline you are working against.

By submitting you agree to our privacy policy.

Handover pack

What the incoming supplier must receive, test, and accept.

AreaRequired handoverAcceptance check
ArchitectureHosting, environments, DNS, CDN, database, storageDiagram matches live accounts
ReleaseRepository, branches, build, deploy, rollbackSmall change reaches staging
WordPressTheme, custom plugins, extension policy, rolesNo unknown production-only code
OperationsBackups, monitoring, incidents, maintenance windowsRestore and alert tested
MarketingForms, CRM, SMTP, analytics, GTM, consentEnd-to-end test reaches owner
SearchSitemaps, robots, redirects, canonicals, hreflangPriority pages match baseline
CommercialVendors, licences, renewals, support contactsTransfer or replacement status recorded
Known debtDefects, security exceptions, workaroundsRisk, responsible person, and review date recorded
Buyer questions

Questions during an agency transition.

Will switching WordPress agency hurt Google rankings?

Not by itself. Risk appears when the switch also changes hosting, redirects, canonicals, robots rules, performance, content, or analytics without a controlled migration.

Should we tell the current agency before appointing a replacement?

Review the contract and secure company-owned access and an independent backup first. Then follow the agreed notice and handover process. This operational preparation carries no legal advice.

What if the agency owns our hosting or plugin licences?

Document what transfers and what must be replaced. Create company accounts, reproduce the configuration in staging, and migrate one dependency at a time. Do not cancel the old service before testing the replacement.

Do we need to rebuild when changing agency?

No. A maintainable site can be taken over and improved incrementally. Rebuild only when evidence shows the theme, content model, workflow, security, or business requirements cannot be corrected economically.

When should old agency accounts be removed?

After the new team verifies company recovery and role-level access, restores a backup, reproduces the release path, tests forms and alerts, records open risks, and accepts incident responsibility. Remove former users, verification tokens, and shared credentials only then.

Primary sources

Check provider and platform rules at the source.

DENIC explains the AuthInfo process for a .de provider transfer and separates domain administration from webspace, email, and name services. An agency change alone does not trigger either process.

WordPress documents roles and capabilities and recommends backups outside the host. Google documents separate roles for Search Console owners and users and Analytics account and property access.

How Some Tech Work handles takeovers

Stabilise first. Improve after the operating path works.

Some Tech Work can take over an existing WordPress platform without making a relaunch the default. We inventory ownership, restore staging, verify releases, forms, search signals, backups, and monitoring, then agree a correction plan.

If the platform is beyond correction, we separate the relaunch scope from takeover. For updates, security, monitoring, and incident response, compare the published WordPress maintenance plans.

Written by

Vineet Talwar

Co-founder, Tech & Operations at Some Tech Work. WordCamp speaker across Europe and Asia, and host of the WP Shoutout podcast.

More about Vineet →Book a call →

Related articles

Start here

Ready to talk.Book a short diagnostic.

Tell us what needs fixing

A process, a tool, a decision that's stuck. One sentence is fine.

By submitting you agree to our privacy policy.

We read every brief and reply within one business day.

Prefer to talk first?or request a tech stack audit →or email us directly →

Not sure where to start? Send the stuck decision, workflow, or page. We will say whether you need a diagnostic call, a tech stack audit, or a different first step.

Reviewing first?
See outcomes and metrics →About the team →