Access and ownership first
- Is the domain registered to your business?
- Is the hosting account in your name?
- Do you have administrator access to WordPress?
- Do you have the code, if anything was custom-built?
- Are there accounts belonging to people who have left?
Start here, because everything else is academic if you cannot actually control the site.
Then check it is not compromised
- Unfamiliar administrator accounts
- Files modified recently that nobody changed
- Unexpected redirects or injected content
- Search results showing pages you did not create
- Outbound mail you did not send
Verify the fundamentals
| Check | How |
|---|---|
| Backups exist and restore | Restore one to staging |
| Forms deliver | Submit each one and confirm receipt |
| Updates are current | Check core, themes and plugins |
| Site is indexable | Settings, and check for stray noindex |
| Analytics is recording | Look at yesterday's data |
Understand what it is built on
Which theme, which plugins, what is custom, and whether any of it is abandoned. That determines what you can safely change.
An abandoned theme or a heavily-modified core is a finding that changes your plans.
Write it down
A one-page summary: what it is built on, where things live, what is wrong, and what needs doing first.
That document is worth having whether you keep the site, fix it or replace it.