What Developers Should Check Before Taking Over an Existing Website

Taking over an existing website is a different job from building one. The code is unfamiliar, the documentation is usually missing, and the previous developer may or may not answer the phone. What looks like a simple maintenance handover can hide expired credentials, failing backups and SEO problems that surface only after you have accepted responsibility for them. 

At Esco Logics, website takeovers are a regular part of our work, and the projects that go wrong are almost never ruined by bad code. They go wrong because something was not checked before the handover was accepted. This checklist covers what to verify first: access and ownership, backups, security, site health and SEO, in the order that protects you and the client most.

Confirm Access and Ownership First

The first check in any website takeover is who actually controls the accounts. A site is not transferred until the client can run it without the previous developer.

Go through the full list and move each one to accounts the client owns, not the previous developer's personal email:

• Domain registrar and DNS management
• Hosting control panel and server access (FTP or SSH)
• CMS admin and the database
• Code repository
• Email and transactional mail services
• Third-party APIs, from payment gateways to analytics

Agencies on developer forums repeat the same warning for a reason: a domain registered under a vanished freelancer is the most expensive problem in this business.

Once access is confirmed, change every password and remove accounts that belong to nobody. Orphaned admin users are one of the most common findings in inherited sites.

Take a Backup Before Touching Anything

Before any audit or fix, create a complete backup of the files and the database, and store it off the server. Then check what backup system already exists. Inherited sites regularly have a backup plugin that was never configured, points to a folder on the same server, or has been silently failing for months. Set up automated off-site backups and run one test restore. A backup you have never restored is a hope, not a system.

Audit the Technical Health of the Website

With access secured and a backup saved, assess what you have actually inherited. The goal of this audit is a cost and risk picture, not a fix list yet.

Check Versions and Dependencies

Record the CMS version, plugin or package versions, and the PHP or runtime version on the server. Outdated dependencies tell you how much maintenance debt is waiting, and whether an update path even exists. A site running software that is years behind may need staged upgrades on a copy before anything is safe to change in production.

Review Security Before It Reviews You

Scan for malware, check for exposed configuration files and hardcoded credentials, confirm the SSL certificate is valid and auto-renewing, and look at the admin user list again with fresh eyes. The OWASP Top 10 is a sensible baseline for what to look for in custom code. Any payment or personal data flow deserves extra attention, because from the day of handover, its risks are yours.

Test Performance and Core Web Vitals

Run the key pages through a speed test and note the scores before you change anything. That baseline protects you later, because it separates the problems you inherited from anything you introduce. Slow hosting, oversized images and abandoned scripts are typical inherited weight, and many of the same faults appear in our rundown of why most business websites break.

Check the SEO You Are Inheriting

A takeover can destroy years of rankings in one careless deployment, so the SEO audit belongs in the handover, not after it.

Open Google Search Console, or get added to it, and look at indexed pages, manual actions and top queries. Crawl the site to map redirects, broken links and canonical tags. Note which pages earn the most organic traffic, because those URLs and their content must survive anything you change. If the plan includes a rebuild, decide deliberately between preserving and restructuring; our comparison of a website redesign or revamp covers how to make that call without losing what already ranks.

Takeover Strategies That Prevent Surprises

Three habits separate smooth takeovers from expensive ones: auditing on a clone, freezing SEO-critical elements and selling the audit as its own project.

Run the Audit on a Staging Clone

Copy the site to a staging environment and do the deep inspection there. On a clone you can test updates, trigger errors and probe suspicious code without risking the live site, and the copy doubles as a rollback plan if production breaks during the handover.

Freeze SEO Elements for the First 30 Days

Until the baseline is documented, change no URLs, titles, canonical tags or internal links. Most post-takeover ranking drops come from well-meant cleanup in week one. Improvements can wait a month; recovering lost rankings takes far longer.

Sell the Audit as Its Own Project

Quote the audit separately from the fix work. A paid audit gives the client a useful report whichever way they decide, lets you price the real work with open eyes, and filters out clients who want someone to inherit years of liability for free. Developers who skip this step end up owning every historical problem at the price of a small retainer.

Document Everything and Set the Baseline

Finish the takeover by writing down what you found: access inventory, versions, known faults, performance scores and the SEO snapshot. Share it with the client as the official starting point. This document does two jobs. It turns vague risk into a priced, prioritized list the client can decide on, and it protects you when something inherited surfaces three months later. A takeover without a written baseline becomes your fault retroactively.

Agree on scope at the same time: what you are fixing now, what is monitored, and what stays out of scope until the client approves it. Takeovers creep more than any other project type, and the baseline document is the fence.

If you are a business owner reading this from the other side, these checks are exactly what to expect from a competent developer before they touch your site. The team at Esco Logics handles website takeovers with this process, from recovering access and securing the site to protecting the SEO you have already earned. Get in touch and we will review your website before anything changes hands.