We inherit other people’s websites regularly. Some were built well. Some were built in 2017 and touched by six different people since. This is the list we work through before we change anything, and it is worth running whoever ends up doing the work.
Ownership
- Domain registrar, and whose name the domain is in.
- DNS provider and current records.
- Hosting account, and whose payment card is on it.
- SSL certificate, and when it expires.
- Any third-party services the site depends on: email sending, CDN, payment gateway, search.
Access
- Administrator access to the CMS, not editor.
- Hosting control panel and, where relevant, server access.
- Repository access, and whether the code in it matches what is actually live. It often does not.
- A list of every user account, and removal of everyone who has left.
State of the thing
- Core, plugin, theme and dependency versions, and how far behind each one is.
- Whether backups exist, where they go, and whether anyone has ever restored one.
- Error logs. Recent failures tell you more than any documentation.
- Page speed on a real phone on a normal connection, not on a developer’s laptop.
- Whether staging exists at all.
Nobody has ever regretted testing a restore. Plenty of people have regretted assuming backups worked.
Legal and compliance
- Cookie consent, and whether it actually blocks anything before consent.
- Privacy policy, and whether it matches what the site really collects.
- Accessibility, at least an automated pass to see how bad it is.
Content and traffic
- Analytics access, and whether tracking is still working.
- Search Console, indexing status, and any manual penalties.
- A crawl for broken links and redirect chains.
The short version
Ownership, access, state, compliance, traffic. Five headings, one afternoon. Do this before anyone starts fixing things, because half the fixes people plan turn out to be unnecessary and the urgent problem is usually something nobody mentioned.