How to take over a WordPress site from a previous developer.
You have inherited a WordPress site, but whoever built it is long gone. It still works, though you are not entirely sure how, and you would rather not touch it in case it breaks. Here is a safe order to get back in control, work out what state it is in, and keep it running.
Do the backup step before you change a single thing. It is the one that saves you.
Why WordPress sites end up unsupported
WordPress powers a large share of the web, and most of those sites are built once and left. Core, themes and plugins keep releasing updates, the site quietly falls behind, and the person who set it up moves on. Nothing looks wrong from the front, but underneath it is running years-old code with known, unpatched holes. It is one of the most common situations adoption is built for, and it is entirely fixable.
What you need to take control
Gather what you can, and note what is missing. To fully own a WordPress site you want:
- A WordPress admin login with the Administrator role.
- The hosting account, or its control panel such as cPanel or Plesk.
- The domain registrar, so the address stays in your name.
- SFTP or FTP access to the files, and the database (often through phpMyAdmin).
You do not need all of these to start, but the hosting or the domain is usually enough to recover the rest.
Step 1: Get back in safely
If you already have an admin login, create a fresh Administrator account in your own name and a strong password, rather than relying on the old one. If you are locked out of WordPress but have hosting access, you can reset the password or add an admin user through the database or the file manager. The goal is to hold your own keys, not to depend on credentials the previous developer might still be able to use.
Step 2: Take a full backup before you touch anything
Back up the files and the database, and keep the copy somewhere that is yours. If your hosting allows it, make a staging copy of the site so you can test changes away from the live version. This one step is what separates a calm takeover from an expensive accident. Never start updating a neglected live site without a backup you have checked.
Step 3: Check what state it is in
Before changing anything, take stock. Run through a short list and write down what you find:
- The WordPress core version, and the PHP version the host is running.
- Every plugin and theme, their versions, and which have not been updated in years or are abandoned.
- Whether SSL is in place, so the site loads over https.
- Whether any backups exist, and whether anything is already flagging a security warning.
Step 4: Update carefully, not all at once
Work on the staging copy first if you have one. Update the core and plugins in small steps rather than one big sweep, checking the site still works after each, so if something breaks you know exactly what caused it. Remove plugins that are abandoned or no longer used, since each one is a door left open. Only when staging is stable do you apply the same changes to the live site.
Step 5: Lock it down
Once it is current, close the obvious gaps. Give every admin a strong, unique password and turn on two-factor. Delete accounts that are not needed, especially any left by the old developer. Put a reputable security plugin or firewall in place, set up automated backups, and keep PHP on a supported version. None of this is exotic, it is simply the maintenance the site never had.
Step 6: Keep it supported
This is the step most people skip, and it is why sites end up unsupported in the first place. Updates keep coming, so the site needs someone to keep applying them. You can do it yourself with a calendar reminder and a checklist, put it on a maintenance plan, or hand it over entirely. If you would rather never think about it again, that is what website and software adoption is: we take the WordPress site on, keep it current and secure under your own accounts, and tell you honestly if it would be cheaper to move it to a simpler, faster stack.
Common questions
Can I take over a WordPress site without the old developer's help?
Yes. If you control the hosting or the domain, you can regain admin access through the hosting file manager or the database, even without the developer. It is fiddlier than a simple password reset, but their cooperation is not required to get back in and take control.
Is it safe to keep using WordPress?
Yes, if it is kept current. WordPress runs a huge share of the web and is perfectly safe when core, themes and plugins are updated and unused plugins are removed. The risk is not WordPress itself, it is a WordPress site left unpatched for years. Keep it maintained, or move it to a simpler stack if the upkeep is more than you want.
Should I update everything as soon as I get in?
Not on the live site, and not all at once. Take a full backup first, ideally test updates on a staging copy, then update core and plugins in small steps so you can see what breaks. Updating a neglected live site blindly is the fastest way to take it down.