A structured WordPress handoff gives the incoming owner or agency the access and operational knowledge needed to maintain the site without depending on shared personal accounts. Prepare a verified backup, an inventory and a clear transfer of responsibilities before removing the outgoing team's access.
IN THIS ARTICLE
01 Prepare the site record
- List the production and staging URLs, hosting service, DNS owner and domain renewal contact.
- Record WordPress, theme and plugin dependencies, including paid licences and who owns them.
- Document backup locations, restore procedures, scheduled jobs and important integrations.
- List custom code, deployment methods, repository access and any changes that cannot be overwritten by routine updates.
- Identify business checks such as forms, checkout, booking and transactional email.
02 Transfer access deliberately
- Create named accounts for approved recipients with the permissions their work requires.
- Transfer ownership of third-party services through their supported account-transfer process.
- Use a secure secret-sharing method for credentials that must change hands, and rotate them after receipt.
- Verify that the incoming team can sign in, access recovery methods and perform the agreed maintenance tasks.
- Remove or reduce outgoing access only after ownership and recovery access are confirmed.
Should we share one administrator login?
Named accounts provide clearer accountability and allow individual access to be removed later. Use the least privilege suitable for the role and enable available multifactor protection. Review application passwords, API tokens, SFTP/SSH access and hosting-account contacts as well as WordPress users, because removing one WordPress account does not revoke every integration.
What should the final acceptance check include?
Restore a recent backup in an isolated environment or review a recent documented restore test. Confirm the incoming team knows how to recover from a failed update and where support requests should go. Run the agreed public business checks and record unresolved issues rather than treating them as undocumented assumptions.
03 Close the handoff
Agree a cutover date for renewals, support and maintenance responsibility. Keep an approved change log and remove temporary copies containing customer data according to the retention agreement. Do not place passwords, licence keys or database exports in the public website or a broadly shared document. A short, accurate operations record is more useful than a folder of obsolete screenshots with no owner.