Taking over a WordPress site from an agency: access, accounts and a first review
Taking over a WordPress site from an agency starts with access, not with the design. First you reclaim the domain, hosting, the administrator account and the Google accounts, registered to your company. Then you change passwords, tidy up user accounts and make your own backup. Only at the end do you check plugins, licences, technical health and SEO, to know what you have been given.
Author: The TellMyShop team. A guide for WordPress site and WooCommerce store owners: the cause, the manual fix and the same work in a chat conversation.
Last updated: · 6 min read
What access you need to reclaim from the agency
List everything in one table and tick off what you already have. The “whose account” column matters most: access on the agency's account is access the agency can withdraw at any moment.
| Access | Where | Why it matters | Whose account it should be |
|---|---|---|---|
| Domain | registrar panel | without the domain you can't move the site or email | yours |
| Hosting | hosting panel | files, database, backups, PHP version, certificate | yours, the agency at most as an extra user |
| WordPress administrator | /wp-admin | managing the site and users | your own named account |
| Files and database | SFTP, FTP, phpMyAdmin in the hosting panel | repairs when the admin doesn't work | passwords changed after the handover |
| DNS, Cloudflare | registrar panel or Cloudflare | email, redirects, protection | yours |
| Google Search Console | search.google.com/search-console | indexing and errors in Google | you as owner |
| Google Analytics | analytics.google.com | statistics | you as administrator |
| Google Business Profile | business.google.com | the listing in Maps | you as owner |
| Paid plugin and theme licences | the plugin authors' stores | updates and security fixes | on your email |
| Backups | hosting or an external service | getting back after a failure | available to you |
In Search Console only an owner can add and remove other users. How to hand over and take back permissions is explained in Google's help on owners and users.
A checklist for the first week after the handover
The order matters. Control first, then tidying up, fixes last.
- Collect the access in the table above. Ask the agency to transfer the accounts to your company, not just to give you passwords.
- Create your own WordPress administrator account. With a named company email. Log in with it and check that everything works.
- Go through Users → All Users. Delete the agency's accounts or lower their role once the handover is finished. When you delete, WordPress asks who to assign the content to. What each role can do is described in the WordPress roles and capabilities documentation.
- Change the passwords. For hosting, SFTP, the database and email, if the agency knew them. Changing the database password also needs a change in the site's configuration file, so do it with your host or the site's caretaker.
- Make your own backup. Files and database, downloaded to your computer or in the hosting panel. That is your starting point if something goes wrong in later steps.
- Check plugins and the theme. Which are paid and whose licence they use, which have had no updates for years, whether there is an agency plugin for remote management.
- Open Tools → Site Health. Note the critical issues. What they mean is explained in the post on WordPress Site Health.
- Check SEO and 404 errors. Titles, descriptions, indexing, addresses leading nowhere. You will find the full list in the post on a WordPress SEO audit.
What to watch out for in what the agency left
A few traps come back regularly when sites change hands.
Licences in the agency's name. A paid plugin or theme bought on the agency's account works, but once the licence expires you won't get updates. Buy your own licences or ask for them to be transferred.
Changes in the parent theme. If the agency changed theme files without a child theme, a theme update will overwrite them. How a child theme works is described in the WordPress theme handbook. Before updating the theme, sort this out with the site's caretaker.
Remote management plugins. Agencies often use plugins to manage many sites at once. After the handover, disconnect the site from the agency's dashboard and remove such a plugin if you don't use it.
The agency's own plugins. A plugin with the agency's name may hold important site features. Don't delete it blindly. Find out what it does first.
No documentation. Ask for a list: what was built in a non-standard way, what integrations there are (forms, payments, newsletter) and where the backups are.
A first review of the site with the chat
Once you have access, a quick picture of the whole site helps. The TellMyShop plugin for WordPress and WooCommerce only reads the site in the free TellMyShop Free. Your chat (Claude or ChatGPT) reviews site health, the list of plugins and themes with versions and available updates, error logs, SEO gaps in posts, pages and products, and 404 errors, then puts together a plan: what to fix first and who will do it.
You: I've taken over the site from an agency. Tell me what's here and what's most urgent.
Your chat: You have 31 plugins, 9 of them deactivated. Five have updates available, and the plugin with the agency's name is worth discussing with them before you remove it.
Your chat: Site health: an old PHP version, that is a job for your host. The logs show a recurring error from the Sample Form plugin.
Your chat: SEO: 18 pages without a description in Google, 7 addresses with a 404 error that get visits, including the old /offer-2023/ page.
Your chat: I can't see accounts, passwords or roles, so review the users yourself in the admin. Plan for this week: updates after a backup, redirects for the 404s, descriptions for the most important pages.
The numbers and names in this conversation are illustrative. TellMyShop never sees or changes user accounts, passwords, roles or API keys, in Pro too. You do that part of the handover yourself or with the person taking over technical care. The plugin does not replace your host or a technical caretaker either: it won't change the PHP version, transfer the domain or back up the whole site to your account.
In TellMyShop Pro the chat makes the fixes from the plan in the same conversation: descriptions for Google, redirects and content straight away, updates and deactivating unneeded plugins once the Plugins switch is on for 24 hours. Every change has a preview and waits for your agreement. How to look after the site day to day after the handover is described in the post on WordPress site maintenance. You will find what each version covers on the TellMyShop for WordPress page and the pricing page, and the free version on the TellMyShop Free page.
Questions and answers
What access do I need from the agency when taking over a WordPress site?
The most important are the domain registrar account, the hosting panel, a WordPress administrator account and access to the files and database. Then the Google accounts: Search Console, Analytics and Business Profile, plus the licences for paid plugins and the theme. Ideally all of them are registered to your company and the agency has guest access only.
Should I delete the agency's accounts in WordPress after the handover?
First create your own administrator account and check that it works. Then delete the agency's accounts or lower their role, and assign their content to another user. Also change the passwords for hosting, files and the database if the agency knew them.
How is a site audit different from an SEO audit?
A site audit at handover checks whether you are in control and whether the site is in good technical shape: access, accounts, plugins, licences, backups, updates. An SEO audit looks at how Google sees the site: titles, descriptions, indexing, 404 errors. At handover it is worth doing both, in that order.
What if the agency won't hand over access?
Check the contract: who owns the domain, the content and the licences, and how the handover works when it ends. A domain registered to the agency is the hardest case, because without it you cannot move the site. In a dispute over rights to the domain or content, get help from a lawyer.
Will the TellMyShop plugin take over from the agency?
It does not replace a technical caretaker or your host. It helps you see what is on the site and plan fixes. It never sees or changes accounts, passwords or roles, so you sort out access yourself or with the person taking over the site's care.
WordPress is a trademark of the WordPress Foundation. WooCommerce is a trademark of Automattic Inc. Claude is a trademark of Anthropic PBC. ChatGPT and OpenAI are trademarks of OpenAI. TellMyShop is not affiliated with these companies.