A checklist of things to consider if you’re taking on responsibility for a WordPress site that you didn’t build

Is the site secure?

• Are you logging in with someone else’s credentials? If yes then the first thing you’ll want to do is set yourself up as an admin user in your own right with your own login credentials.
• Who else has admin access to the site? Is there anyone on the list who has left the organisation? Anyone from the agency who built the site that you don’t use anymore? Anyone who’s name you don’t recognise? Go through the list and make sure that the only people who have access are those who need to have access. Delete the user profile of anyone who no longer needs access.

Where is the site hosted?

• Find out where the site is hosted and make sure that you have access to the hosting account.
• Similarly, find out where the domain is registered and make sure that you have access to the domain registration.
• You need to ensure that neither the hosting nor the domain are in the control of anyone who has since left the organisation.

Is the site being backed up regularly?

• Is there a development environment where you can make changes before pushing them through to the live site, or can you only make changes on the live site?
• Check whether the hosting company is regularly taking back ups of the site.
• Is there a backup plugin installed that enables you to take backups of the site yourself? If not then we recommend you install one yourself so you can take a backup of the site – UpdraftPlus is the one that we use.
• Take a backup of the site before you make any further changes to it.

What version of WordPress are you using?

• WordPress will tell you if there’s a newer version that you could install via a message at the top of the admin console
• Generally it’s a good idea to ensure you’re running the latest version of WordPress as this helps to keep your site secure, however if your site is using a very old version of WordPress then you should not simply update to the latest version as you may find that elements of your site do not work in the newer version.
• Make sure that you have a backup of the site before you make any changes to the WordPress version you’re running.

What theme is the site built with?

• Go to the Appearance menu and select the Theme option to see which theme your site has been built with.
• Check whether the site is running a free theme or a premium theme
• If it’s a premium theme check whether there’s an annual subscription that needs to be renewed.
• Make sure you have access to the account that was set up with the theme developers.
• If you’re not familiar with the theme then check the theme developers’ website for documentation that will help you understand how the theme works.
• Check YouTube to see if there are any videos showing you how the theme works.
• Go to the Appearances menu and select the Customise option then go through each of the options in the Customise menu – this will help you start to understand which areas of the site you can control.

Has any bespoke code been written?

• Look in the Appearances -> Themes section and look to see if the active theme is a child theme.
• Are there extra files or functions stored in the theme? You can check by carefully reviewing the functions.php file in the theme editor.
• Are there any plugins that aren’t publicly available? Often you can check the “Author” and “View details” links in the plugins list to check this.
• If your site does include bespoke code, do you have access to the developer if it needs changing or if there are security problems?

How is the site structured?

• Take a look at the front end of the site and start to get a sense of how the site is structured.
• Is there a blog? If so, how many posts are there? Does the blog have different categories?
• How does the site navigation work? What are the key areas of the site and how are they linked?
• How many pages are there on the site? You can use a tool like Screaming Frog to run a report telling you how many pages the site has (as well as a lot more information).
• Is the menu built using just the standard WordPress menu functionality or is there a megamenu plugin used to build the menu?
• How many menus does the theme allow you to have? Are these all being used on the live site?

How are the pages built?

• Take a look at the list of pages in the backend of the site and see how they are built – is the site using the Gutenberg page editor or the classic WordPress interface or a third party page builder such as Beaver Builder, Elementor or Site Origin?
• If the site is using a third party page builder then you’ll need to learn how to use that in addition to understanding how the theme works.
• Do your pages have sidebars? If so, can these be controlled via the theme customisation options?
• Look in the Appearance menu at the Widget option to see what the different widget areas are on the site and what’s in those widgets.

What functionality does the site have?

• Start going through the pages on the frontend of the site and making a note of any additional functionality that you spot. This means things like forms, ecommerce functionality, embedded social media feeds, sliders – anything at all that goes beyond simple text and images.
• Look at the backend of the pages that have additional functionality to find out how that functionality is being generated – for example, what plugin is being used to generate the forms?
• Does the functionality on the site actually work in the way that it should? Fill in and submit the contact forms – where do the completed form entries go? Who has access to them? Are they being followed up?
• Are there any broken links on the site? For a small site you can check this just by going through the site and clicking on all the links yourself. On a larger site Google Search Console can help you identify broken links. There are also numerous free services that will check your site for broken links, if you Google ‘check my website for broken links’ you’ll see a selection.
• Are comments enabled on blog posts? If so, who is checking the comments to ensure that they’re appropriate for publication.

What plugins are running on the site?

• Go to the plugins list in the backend of the site and look at what’s been installed.
• Check to see what each plugin does.
• Does the site use premium versions of any plugins that have subscriptions that will need to be renewed at some point?
• Do you have access to the account with the plugin developer so you can renew the plugin when the time comes?
• Do your plugins need to be updated? Note, you should make sure you have a backup of the site before you start updating plugins and you should update them one at a time rather that all together.

Is the site GDPR compliant?

• Do you have a privacy policy on the site?
• Is the privacy policy still correct? For example, are the contact details of the company and the data protection officer correct?
• If you have a contact form is there an opt in tick box on it enabling people to consent to hearing from you? Does the contact form give people a link to the privacy policy?
• What user data is being stored in the backend of your site? Look at your form plugin to check whether form entry data is being stored in the backend of the site. If you’re using an ecommerce plugin like WooCommerce check to see whether order data is being stored and for how long.

Are there any third party integrations?

• Is your site integrated with mailing services like Mailchimp or Constant Contact or another CRM system? You can generally check this by looking at the list of plugins.
• If so then you need to make sure that you have access to the relevant third party system.

Is the site integrated with your social media channels?

• Are you linking to your social media channels from your site? Check that the links are correct.
• Are your social media channels being actively managed? Who manages them? Make sure you have log in access to the channels and, as with the website, ensure that anyone who’s left the organisation no longer has access.
• Check Facebook, Twitter, LinkedIn, Instagram, YouTube, Google My Business and any other channels that you use.
• Do you have any tracking tags running on the site from any of your social channels such as a Facebook Pixel or LinkedIn Insight Tag? If so, check you have access to the relevant advertising accounts.

Is the information on your site correct?

• Are the contact details on your site correct? Look at the contact us page and also at any contact information in other areas such as the header, footer or privacy policy.
• If there’s a ‘Meet the team’ page, do all of those people still work for you? Are their contact details correct?
• If you’re selling online is your product list up to date? Are the prices correct?
• Look at the dates on your blogs – if no new blogs have been added to the site for months then consider whether it might be better to hide the blog until you’re able to add new content rather than give the impression that the site is not being actively managed.